When Agents Hold the Card: What Delegated Spending Sets in Motion

This piece follows one change. The authority to spend is moving away from a person clicking "buy" and into software that carries its own scoped credential. We trace what that does to fraud, liability, fees and the price of web content.

Key points

• Card networks, processors and banks now issue payment credentials scoped to a single agent. The open question is no longer whether agents can pay, but whose rails carry that authority.
• Prompt injection turns every agent that can spend into a target. Because it likely cannot be fully patched, spending limits and containment become the working security layer.
• US consumer law does not say who is liable when an agent pays, and merchants absorb disputed agent purchases by default.
• An attempt to take a fee at checkout has already failed, so platforms will likely charge for discovery and ranking instead.
• Per-request pricing is spreading from APIs to web content, and network intermediaries are setting the prices.

The change

Through 2026, spending authority has been separated from the human at checkout. Mastercard and Visa issue agent tokens that carry spending ceilings, merchant categories and time windows¹. Google's AP2 records each purchase as three signed mandates². x402 lets an agent pay inside the HTTP request, and Visa, Mastercard and Amex now help govern it³. Usage is high in count and low in value: about 75 million x402 payments moved roughly $24 million⁴. The infrastructure is ahead of demand, the pattern our signal scan found.

What follows

First-order

• Spending limits become the product. Credential issuers will compete on how finely a person can fence in an agent: per-merchant caps, time windows and rules for recurring purchases¹.
• Disputes get harder to settle. Merchants lose the device fingerprints and browsing evidence they rely on, and under OpenAI's spec they handle refunds by default⁵. "My agent did it" becomes a new kind of friendly fraud.
• Fraud follows the money. Hidden payment instructions are already live on web pages and in API documentation⁶. Google measured a 32% relative rise in malicious injection content over four months⁶.

Second-order

• Security moves from filters to architecture. Theory suggests an attacker can always build a context in which a blocked action looks legitimate⁷. If so, the controls that last are least privilege, low caps and human approval for large payments. For consumer purchases above small amounts, that favours card tokens with chargebacks over stablecoin transfers, which are final.
• Signed mandates cut both ways. They create an audit trail, but they also let issuers argue "you signed the intent", and injection can still steer an agent within a valid mandate². This is one of the unresolved questions from part 2. We think it is likely, about 65%, that the first substantive Reg E guidance on agent payments comes only after a well-publicized loss.
• Fees move upstream. OpenAI's 4% checkout fee attracted only a few dozen merchants and was retired⁸. Platforms will likely charge for being found rather than for completing the sale, a fee that is harder for buyers to see.
• Regulation splits the rails. The OCC's GENIUS Act rule turns dollar stablecoins into a licensed instrument that cannot pay yield⁹. The BIS argues that tokenized deposits should carry tokenized payments¹⁰, and the four largest US banks plan a shared deposit network for 2027¹¹. Agents may have to route payments differently depending on jurisdiction and counterparty.

Third-order

• The web gets a price list. From 15 September 2026, Cloudflare's defaults block mixed-use AI crawlers unless they pay, at prices starting from $0.001 per retrieval¹². Once agents can settle sub-cent payments natively, metered access plausibly spreads from content to data, search and tools. A publisher's main counterparty becomes an edge network rather than an ad buyer.
• Tool calls become billable. MCP SDKs are approaching 500 million downloads a month¹³. Pairing tool calls with in-request payment, the convergence traced in part 3, would make the agent supply chain metered. A poisoned tool server would then be a payment risk, too.
• Certification becomes a gate. If the card networks decide which agents count as "trusted"¹, small and open-source agents may be pushed onto permissionless stablecoin rails, the tier the BIS warns about¹⁰. That sorts risk by rail without reducing it.

The shadow side: stablecoin payments made through injection are final⁶. A few large, documented losses could prompt blanket rules that slow agent payments on every rail.

Who gains, who loses

• Card networks gain. Chargeback protection becomes their selling point, and they now help govern x402³¹.
• Vertically integrated processors gain. Stripe co-develops ACP and MPP, is a founding member of x402 and runs the Tempo chain¹⁴.
• Edge networks and large publishers gain, because they can meter access to content¹².
• Merchants lose. They carry disputes without the evidence they used to rely on⁵.
• Small AI labs and open-source agents lose. They face certification hurdles and pay crawl prices that larger buyers negotiate down¹¹².

A glimpse ahead

A plausible dispute notice from 2028:

Reason code A-14: Agent acted outside intent. The cardholder's Intent Mandate authorized "replacement printer cartridges under $60." The Cart Mandate shows a $59 toner subscription, added after the agent read a product page later flagged for hidden instructions. Both mandate signatures are valid, and there is no device data. Under the network's agent rules, the merchant is liable unless it can show the page was not served from its domain. Response window: 10 days.