Short Blog
To my regular readers, you know the flow of data within a network is complex (see Data Games). The news that OpenAI is effectively shelving its “Instant Checkout” initiative in favor of a referral-based “conversational commerce” model shouldn’t come as a surprise. While the tech press might frame this as a strategic pivot, those of us in the eCommerce trenches know it for what it is: a collision with merchant’s role in risk, costs, CX, control and their own AI dreams.
OpenAI attempted to solve its monetization problem by trying to seize control of the top of the funnel, betting that the sheer volume of consumer demand would force merchants to bow to their interface. They were wrong. They fundamentally miscalculated the power dynamics of the transaction and the complexity of the global conversion funnel, a funnel that Google understands intimately because they serve both ends of it globally (ie merchant partners).
The Hubris of the “Model-First” Approach
OpenAI’s vision for agentic commerce was an extension of the old Web 2.0 platform mentality: aggressive disintermediation. By pushing for an “Instant Checkout,” they wanted to collapse the funnel entirely within ChatGPT, rendering the retailer’s eCommerce UI (and their data capture) obsolete.
But OpenAI hit a wall built on a simple truth: Merchants own the risk.
In the U.S., 100% of the fraud risk for card-not-present (CNP) transactions lands on the merchant’s balance sheet. Tier-1 retailers like Walmart, Target, and Macy’s have spent decades and billions building proprietary risk stacks. These stacks aren’t just software; they are “dense meshes” of behavioral telemetry (mouse movements, dwell times, and device graphs).
OpenAI has no ability to take the risk on these transactions. While they could lean on Stripe’s Adaptive Checkout Partnership (ACP) to “backfill” device information, Large merchants weren’t about to hand over their customers to a black box, especially when their own internal AI tools are already winning. Walmart’s “Sparky,” for instance, has delivered a 35%+ lift in basket size by keeping the customer context within their own ecosystem where OpenAI’s conversion were less than 35% of native!! Why would they outsource that to Sam Altman?
Google’s Pragmatic Pivot: The UCP Masterstroke
Contrast this with Google’s NRF announcement of the Universal Commerce Protocol (UCP). As I discussed in my recent blog, UCP was the first sign that Google understood the “Agentic Era” is actually the “Conversational Era.”
Google’s “Embedded Checkout” flow is a masterstroke of diplomacy. Unlike OpenAI’s “Native” vision which sought to hide the merchant, Google’s UCP allows for a referral model that leads to the merchant site. This respects the merchant’s need for a Human in the Loop (HIL) to capture device telemetry and maintain the customer relationship. Google isn’t just a model provider; they are the world’s largest data business, serving merchants via Campaign Manager 360 at the top of the funnel and Google Cloud/Vertex at the bottom (think AI model collaboration). They are building a “virtuous cycle,” not a walled garden.
The Paradox of Perfect Authentication and the VAS Trap
I’ve long maintained that Visa and Mastercard (V/MA) will play the central role in agentic commerce because they own the rules and governance. But changing a network is REALLY HARD. Retailers are rightfully hesitant to shift risk without a clear understanding of dependencies and costs. The current battle to shift risk is tightly intertwined with how the economics of agentic commerce will work and who will control key Value-Added Services (VAS).
Herein lies the paradox: V/MA have the tech, the rules and the governance for how agentic should work. They could do this in 6 months if everyone was aligned. BUT, Perfect Authentication is a threat to the ecosystem’s incumbents AND the Banks want to price the value of this service.
For example, the networks already provision hardware-bound, “perfect” authentication (using tools like Titan M2 or Secure Enclave). But if you eliminate all authentication risk, you eliminate the need for fraud prevention services. This would effectively:
- Crush Processor Differentiation: If authentication is perfect and risk is zero, a processor can no longer differentiate based on their superior fraud-detection algorithms or VAS stacks. Device graphs die.
- The Incentive Problem: There is a massive misalignment on fees. A 5 bps 3DS fee is insufficient to incentivize an issuer to take on a 100% liability shift while also paying for the infrastructure of perfect authentication. This fee may need to look more like 40-50 bps, which would certainly give some merchants pause.
The industry is stuck: merchants want the risk shift but won’t pay the premium; processors won’t support a tech that commoditizes their value; and banks want to control the credential but lack the reach.
Disconnected Innovators: Pushing a String Uphill
While Google and Shopify are building rails for the real world, with REAL retailers, others are “pushing a string uphill” in a lab.
Mastercard, for example, is demonstrating its “Agent Pay” capabilities in a lab, focusing on Google AP2 mandates. While technically elegant, it’s a solution in search of a mandate. Neither processors, merchants, nor even Google are currently moving toward these mandates. The market is moving toward merchant-led checkout experiences, not network-enforced rules that haven’t been battle-tested.
Similarly, Paze (the US bank-led wallet) is attempting to solve for authentication with a new Payment Passkey and a liability shift. But Paze has a fundamental “Cold Start” problem: they have no merchant network to drive adoption. Merchants, who have a historically litigious relationship with US banks, are not exactly rushing to adopt a bank-controlled identity solution that offers no clear advantage over the device-native credentials Google already provides.
Shopify and the Rise of the Agentic Storefront
While the giants squabble over mandates, Shopify is doing the actual work of prepping the web for conversational commerce. They are building agentic storefronts—optimized “landing pages” that serve as the destination for AI agents.
Shopify’s advantage is operational. They are doing the heavy lifting of publishing retailer inventory and integrating that data into LLMs through the Model Context Protocol (MCP). They understand that for an agent to buy something, it needs a “common language” to talk to the merchant’s backend. This standardized, open-web approach is a direct rebuke to OpenAI’s attempt to keep the transaction “headless.”
Conclusion: The Operational Void
OpenAI’s retreat from “Instant Checkout” is a victory for the merchant-centric model. It proves that you cannot solve commerce with a better “brain” alone; you have to solve for the Operational Void (the messy reality of liability, risk, and commercial incentives. See Commercial Models for AI Agents)
Google’s UCP works because it acknowledges that “agentic commerce” in the near term is actually conversational search that respects the merchant’s sovereignty..
OpenAI tried to build the destination before the road was paved. Google, Shopify, and eventually V/MA are building the road. In the agentic era, the winner won’t be the one with the smartest agent, but the one who builds the framework where merchants feel safe enough to let the agent click “buy.”