Walmart’s AI shopping gateway lets agents buy for you with spending limits and approval controls

Walmart has launched its Agent Gateway, a new infrastructure component designed to manage transactions initiated by artificial intelligence agents on behalf of shoppers. According to TechCrunch, the retailer announced this move on Wednesday, positioning itself in direct contrast to competitor Amazon, which recently began blocking AI agents from making purchases on its platform. The initiative supports both Walmart and Sam’s Club operations, aiming to prepare for a future where agentic shopping becomes mainstream for consumers.

Root cause

The development stems from Walmart’s strategic decision to embrace agentic commerce rather than restrict it, differentiating the retailer from other online businesses and travel sites that have locked out AI agents. John Furner, Walmart’s President and CEO, stated at the Masters of Scale Summit in San Francisco that the company is expanding efforts to support AI integration. This follows previous partnerships with Meta’s Muse and integrations with applications like ChatGPT and Gemini.

Attack path

The technical foundation is Walmart’s new MCP server, which allows approved agents to connect via the Model Context Protocol originally created by Anthropic. This protocol enables AI agents to search online inventory and execute purchases without users sharing personal information or purchase history directly with the agent. The system differentiates agent-initiated purchases from those made directly by customers, ensuring distinct transaction trails and maintaining user control over automated spending.

Affected versions

The Agent Gateway is currently live and supports agentic shopping for Walmart and Sam’s Club. Agent Profiles, a feature allowing customers to authorize specific AI agents with dedicated account profiles, are scheduled to roll out next month. These profiles will enable users to view agent purchases separately and set specific controls, such as requiring approval for each transaction or authorizing spending within predefined limits.

Mitigation

• Monitor agent activity through dedicated account profiles to distinguish automated purchases from manual ones.
• Configure spending limits and approval workflows to restrict unauthorized transactions by connected AI agents.
• Review connected applications and ensure only trusted agents are authorized within the retail ecosystem.

What it means for organisations

Organisations adopting similar automated purchasing tools must establish clear governance for agent permissions. Procurement teams should define spending thresholds and approval hierarchies before deploying such systems. IT departments need to verify that agent identities are distinct from human users to maintain audit trails. Leadership must communicate these controls to all stakeholders to prevent financial leakage. Legal teams should review data privacy implications when agents access inventory without direct user data sharing.

Background: AI agents

AI agents matter for security because they move beyond generating text to executing code and accessing systems. This autonomy means a single compromised prompt can trigger cascading failures across your infrastructure, requiring new controls for intent verification and action boundaries rather than just content filtering.

Read the full guide: Why AI Agents Matter for Security: Autonomy Risks

What to do and how to stay safe: Walmart

• Audit current integrations with third-party AI applications to identify any automated purchasing capabilities.
• Implement strict spending caps and mandatory approval steps for any agent-initiated transactions.
• Ensure logging systems can distinguish between human and agent actions for accurate financial reconciliation.
• Review privacy policies to confirm that personal data is not unnecessarily exposed to external AI services.

Step-by-step guide: Prevent Prompt Injection Attacks: Practical Defences for AI Systems

General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is Walmart's Agent Gateway?

It is a new MCP server that allows approved AI agents to connect to Walmart’s inventory and make purchases on behalf of customers using the Model Context Protocol.

How does this differ from Amazon's approach?

While Amazon has begun blocking AI agents from making purchases, Walmart is actively enabling them with controls for spending and transaction approvals.

When will Agent Profiles be available?

Agent Profiles, which allow customers to authorize specific agents and set spending limits, are scheduled to roll out next month.