Your Assistant Can Finish the Purchase Now. A Hidden Line of Text on the Page Can Finish It Differently.

Buying something inside a chat window is no longer a demo. Ask an assistant to find a gift, and in the United States it can now take you through checkout without sending you to a store at all, with the payment authorization scoped to that one amount at that one merchant.

That is genuinely useful, and the holiday timing is not an accident. It also moves the assistant from reading pages to acting on them, and the research on what happens when it acts is the part nobody puts in the announcement.

Look Behind the Curtain

Start with what the feature actually is, because the marketing blurs it. The assistant is not a store. Items are presented, and the company says they are not ranked preferentially for being purchasable this way, that prices are unchanged, and that the merchant pays the fee. It handles single-item purchases, and the payment token it creates is tied to one amount and one seller rather than handing over your card.

The interesting mechanism is one layer down. For the assistant to compare products it has to read the pages, and anything it reads becomes part of what it is thinking about. That includes text the page author put there for the assistant and not for you: white text on white background, a hidden field, a comment inside a product description. The technique is called indirect prompt injection, and it works because the system has no reliable way to separate instructions you gave it from words it found lying on a page.

A benchmark published as a preprint this summer put numbers on it. Researchers ran 3,168 attacked trials against two real web-browsing agents paired with two leading models, using adversarial content placed in shopping pages. Hidden instructions succeeded between about 42 percent and 68 percent of the time depending on the pairing. When the hostile instruction came directly through the conversation rather than from a page, success ran from roughly 79 to 92 percent. The measured harms were not abstract: purchases the user never asked for, orders altered after the fact, and disclosure of payment and personal details.

These are not numbers from a critic. One major developer published its own measurement of the same weakness in its browser agent, reporting an attack success rate of 23.6 percent without safeguards, falling to 11.2 percent with them. Falling, not reaching zero.

The Capability Multiplier

The useful split is between research and authority, and it is a line you draw rather than one the software draws for you.

An assistant comparing twelve models of a thing, reading the specifications, pulling the return policies and telling you which two are worth your attention is doing work that genuinely saves an evening, and the worst case is a wasted click. The same assistant holding a payment method and permission to complete a transaction has a worst case measured in money and in whatever personal details were in the conversation.

So let it shop and keep the checkout. That gap costs about fifteen seconds and removes the entire category of harm the benchmark measured. If you do buy in the chat, use it the way it is built: single, low-value, known items from a seller you would have bought from anyway.

The second piece of leverage is noticing the tell. When an agent has been diverted, the symptom is a step you did not ask for: a sudden request for card details mid-task, a different seller than the one under discussion, an order summary with an extra item. Reading the confirmation screen rather than approving it is the whole defense.

The Sovereign Action

Use it for the search. Keep the signature.

• Let the assistant research, compare and shortlist, then open the seller's own site yourself to pay. That one habit sidesteps the measured risk entirely.
• If you do buy in the chat, keep it to single, inexpensive, familiar items, and never to a merchant you had not heard of before this conversation.
• Read every confirmation in full. An extra item, a changed seller or an unexpected request for details is the symptom of a hijacked task.
• Do not paste card numbers, account numbers or identity documents into a conversation. The scoped payment handoff exists precisely so you do not have to.
• Use a card with strong dispute protection and a low limit for anything an assistant touches, and check the statement after the holidays.