Three Open Questions About How AI Agents Will Pay

Every large payments incumbent now backs agent payments. The evidence still disagrees on three things: which money agents will hold, who gets paid for moving it, and who pays when an agent is tricked into spending.

Key points

• Most machine-to-machine payments settle in USDC, but central banks and the largest US banks are building tokenized bank deposits for the same job.
• Usage is high by count and low by value: about 75 million x402 payments averaged roughly $0.30 each, and growth levelled off in early 2026.
• OpenAI dropped its 4% checkout fee after few merchants used it, while processors and networks gain control of the layers underneath.
• Signed mandates record consent clearly, yet prompt injection works inside valid mandates, and US consumer law has not settled who bears the loss.
• We expect rails to split by use case, and the liability question is the one most likely to be settled by a costly incident.

The tensions

Will agents hold stablecoins or bank money?

The case for stablecoins is in the usage data. Keyrock counted about $73M settled by agents across roughly 176M on-chain transactions in a year, 98.6% of it in USDC, with about 76% of payments below the amount card networks can process profitably¹. The OCC's proposed GENIUS Act rule makes dollar stablecoins a licensed instrument with 1:1 reserves and redemption duties². Stripe's Tempo chain is built for sub-cent payments with fees paid in stablecoins³.

The case against starts with the BIS, which argues stablecoins fail its three tests for sound money and that tokenized payments should run on tokenized deposits⁴. JPMorgan, Citi, Bank of America and Wells Fargo are building a shared deposit network for the first half of 2027, and JPMD already runs on Base⁵. The stablecoin numbers are also thinner than they look: volume plateaued in early 2026, and some may be testing or incentive-driven⁶. The card networks now help govern x402 rather than oppose it⁷, which looks like a hedge on both outcomes.

Two signals would settle it: x402 growth on traffic not paid for by incentives, and whether the bank network admits agents built outside the banks. Our view, at about 65%, is a split: cards and deposits carry consumer purchases, stablecoins carry machine-to-machine traffic.

Who gets paid for moving the money?

Visible fees are failing. OpenAI charged merchants 4% on Instant Checkout on top of about 2.9% plus $0.30 in processing, then retired it in March 2026 after only a few dozen merchants went live; Walmart's in-chat purchases reportedly converted at about a third of the click-out rate⁸. Payments worth fractions of a cent cannot carry card-style pricing either¹.

Control, meanwhile, is concentrating. Stripe co-develops two agent protocols, is a founding member of x402 and runs its own settlement chain³. Card networks keep their fee model through agent-scoped tokens and decide which agents count as trusted⁹. Cloudflare acts as merchant of record and sets the default for which AI crawlers may read content at all¹⁰. In each case the fee sits in a layer the payer does not see.

Published take rates on x402 and Tempo would settle it, as would discovery or ranking fees replacing checkout fees as the platforms' cut⁸.

Does a signed mandate make an agent's payment safe?

The case for yes: Google's AP2 records the user's intent, the agent's cart and the final charge as three signed credentials, an audit trail the user cannot later deny¹¹. Mastercard's agentic tokens carry spending ceilings, merchant categories and time windows, with dispute handling attached⁹.

The case for no: hidden payment instructions are live on the web, including forced $5,000 PayPal transfers, and Google measured a 32% rise in malicious injection content in three months¹². A theoretical result suggests prompt injection cannot be fully solved, and adaptive attacks beat state-of-the-art defences more than 85% of the time¹³. Red-team work shows injection can steer an agent inside mandates that look valid¹¹, so a signed record of a manipulated choice may shift the loss onto the consumer. Regulation E does not say whether an agent's action counts as the consumer's authorization, and OpenAI's spec leaves disputes with merchants by default¹⁴. Stablecoin payments are final, so stolen funds are hard to recover¹².

CFPB guidance on Reg E would settle it, or the first large dispute a court or network rules on. We think the dispute is likely to come first.

Why these questions matter

While these questions stay open, treat the payment rail as a replaceable component and design for the loss case: narrow spending limits, least-privilege credentials and human approval above a set amount¹³. Merchants should assume they carry dispute risk for agent purchases. Watch three markers: x402 volume growth, the bank network's 2027 launch, and any update to Reg E. The signal scan sets out the starting conditions.