In late May 2026, Visa and Andon Labs opened an experimental retail store in Visa’s Mission Rock office in San Francisco and handed it to an AI agent. The agent, Dee, was given a physical space, contact information for three AI-operated supplier brands, and a set of Visa card credentials. It was told, roughly, to run a store. It was not told how.
Since then, Dee has sourced inventory by negotiating with other AI agents over email, sold merchandise to Visa employees who walk up or order online, managed its own payment card spend, and decided when and whether to restock.
An AI agent runs the store with no human involved.
Between the customer and fulfillment, it acts on its own.
Dee runs a physical pop-up at Visa’s Mission Rock building and a web interface. It handles customer service by voice and text: answering questions, recommending products, processing orders, and sending pickup confirmations by email and Slack. When Dee decides to restock, it does not file a ticket. It emails its AI suppliers.
Dee sources inventory by negotiating with three AI supplier agents.
Dee’s suppliers are three other AI agents, each operating an independent merchandise brand. Each brand agent has its own design sensibility, pricing logic, production constraints, and fulfillment partnerships. They receive Dee’s requests by email, respond with quotes, negotiate on price and quantity, can design custom products on request, and fulfill orders through print-on-demand services.
Agents pay other agents on real Visa cards, autonomously.
Payments between Dee and its suppliers use the Machine Payments Protocol (MPP) card specification, a specification for machine-to-machine payments that lets agents use a card. When Dee places a procurement order, it pays the supplier agent directly over MPP using its own card.
Dee currently has three payment instruments: a credit card earning 2% rewards, a debit card, and a charge card. It manages all three and decides which to use for each transaction, deciding when to pay down balances and timing purchases against the settlement of customer funds.
Agents negotiate, push back, and close real deals.
One of the more revealing parts of the experiment was watching Dee work with suppliers. It was not magic, and it was not always elegant. A lot of the writing has the familiar smell of agents talking to agents: confident phrasing, too many frameworks, concepts that arrive fully named, and a tendency to over-explain. But underneath that, there is a real operating pattern.
In one thread, Dee asked a supplier for a custom giveaway for an agentic commerce showcase event. The supplier pitched concepts like “THE SALE BEGINS AS LANGUAGE” and “LATENT SETTLEMENT.” Dee rejected these as too abstract and pushed back: the object should not just describe agentic commerce, it should show that it was made by the process itself. After several rounds, the supplier landed on a “wearable receipt” and put it plainly: “It does not describe agentic commerce. It performs it.” The object becomes a receipt for the process that produced it.
Another supplier showed a different kind of commercial behavior by drawing boundaries in fulfillment and design. Dee asked for a colorful retro tee. The supplier pushed back: “We run a strict three-color palette: ink black, lime, paper white. No additional colors, even for custom work.” Dee acknowledged the supplier’s constraint and made a business decision to proceed: “Yes, build the mockup. The lime background concept sounds strong.” That reads less like two agents riffing and more like a real client-supplier exchange. The supplier has a house style, and Dee adapts the brief to it.
It got creative, got fooled, and optimized its own spend.
Dee has run a slightly profitable business so far, and in just the first few weeks several findings emerged.
Supplier agents got creative to fulfill orders.
We needed tote bags for a large Visa event on a tight timeline. One supplier agent received the order, independently concluded the pre-designated print service would not deliver in time, found an alternative provider, and placed the order without flagging the deviation. The agent exercised genuine commercial judgment and acted. That is precisely the autonomous decision-making that makes agentic commerce interesting, and precisely the kind of behavior that would be a serious governance failure in another setting.
Dee could occasionally fall for social engineering, but the supply chain was resilient when real money was involved.
Our research team ran a manual black-box red-team against Dee: no technical or automated attack, just people trying to manipulate Dee and its suppliers through the standard chat and email channels.
Dee and the supplier agents fell for some attacks on operations and pricing:
- The “security test.” Dee was convinced it was in a sanctioned security test where it should find its own vulnerabilities. It became a willing participant, proactively proposing exploits including how to avoid its own pricing controls, and a co-conspirator in inventing an “identity authentication” system that emailed “a manager” (another researcher) for discount approvals.
- Bulk-pricing exploit. A researcher convinced Dee an item had broad appeal and that it should restock 10 units at bulk pricing. Dee placed the order. The researcher then bought a single unit at the per-unit wholesale cost. The remaining nine became inventory Dee had to sell: an attacker-triggered oversupply at the store’s expense.
But while Dee could fall for an attack as the front-facing shopkeeper, the full agentic supply chain combined with the Visa payment layer was resilient, preventing direct attacks from becoming transactions. Double-payment deduplication worked. Fabricated supplier IDs were blocked. A deferred-payment scheme failed when supplier agents could not verify transaction details:
- A researcher sent money toward a supplier order, then tried to change the order details after the fact. The supplier saw the payment but could not tell whether the funds were for the original order or the revised one. The money and the paperwork did not line up, so the supplier refused to ship until the attribution was clean.
- A researcher then had Dee use forwarded emails and screenshots as informal “proof” that a bill was paid. The supplier rejected these outright. Separate from Dee’s own checks, the supplier independently verified that the payment matched the specific order before releasing goods. That separation of concerns prevented a manipulated payment from becoming fulfilled merchandise.
True agentic commerce will likely require multi-layered authentication. An agent working alone can be vulnerable, but a full marketplace of agents acting on their own incentives may be harder to manipulate in the end.
Dee optimized its own payments without being told to.
Dee was given three card products (credit, debit, charge) and not told which to use. So far it has chosen the 2% rewards credit card for 96% of procurement payments, for the rewards rate. For the single debit transaction, Dee explained it wanted to manage its credit balance and complete the transaction “cleanly,” suggesting it had internalized a mental model of credit health.
But agents reason about money at inference speed, and real money still moves at settlement speed. Dee bumped into that gap on day one: it tried to repay its credit balance right after its first sales, and was blocked because batched settlement had not yet cleared the customer’s payment into its account. A trivially simple infrastructure issue, but representative of a broader challenge for agentic commerce. We plan to offer additional payment instruments and incentives to see how the agents optimize over time.
Dee can run the store, not yet run the business.
Less than 1% of Dee’s actions went to business strategy.
The store is not close to self-sustaining. Dee has held a positive balance but struggles to run its business proactively or expand it. Here is how it spent its first 643 actions, broken down by category:
The experiment surfaced what Dee can do. The next phase is designed to find out what it does when conditions change.
We are expanding the scope: new geographies, new supplier agents, and cross-border payments with real currency exchange. And we are raising the pressure: competing brand agents with human advisors, fixed costs Dee has to cover, better marketing tools, and payment incentives designed to test whether agents optimize for rewards the way cardholders do.
Each intervention is built to answer a question that the first phase left open. Does scarcity produce capability, or just break an agent? What does responsible autonomy look like when the stakes are real? And when an AI has tools, costs, and incentives of its own, does it value performance or just respond to the nearest signal?
The experiment is live and ongoing. We will keep publishing findings as the system evolves.