AI Agents Are Starting to Pay, and Incumbents Are Setting the Rules

The plumbing for AI agents to spend money is being built quickly, and the incumbents are building it. Card networks now help govern the crypto-native x402 standard, banks are preparing deposit tokens, and regulators are drawing the line between bank money and stablecoins. The rules for who is liable when an agent overspends have not kept up.

Key points

• Card networks and processors now help govern x402 instead of competing with it, and Stripe runs its own settlement chain for agent traffic.
• Agent payments are frequent but tiny: about 75 million x402 payments have moved only about $24 million, and growth has levelled off.
• Regulation is splitting machine money into tiers: federally licensed stablecoins, bank-issued tokenized deposits backed by the BIS, and whatever sits outside both.
• Signed mandates and agent-scoped card tokens set out what a person authorized, but US consumer law still does not say who pays when an agent's purchase is disputed.
• Prompt-injected payment instructions are now live attacks, and stablecoin rails cannot reverse them.
• Fee capture is unsettled: OpenAI's 4% checkout fee failed, while Cloudflare is putting a price on content access per request.

What's changing

Incumbents are absorbing the open standards

The clearest shift is consolidation. x402 moved from Coinbase to a Linux Foundation body whose premier members include Visa, Mastercard, American Express, Stripe, Adyen, Google and AWS¹. The card networks are also building their own layer. Mastercard's Agentic Tokens and Visa Intelligent Commerce issue credentials scoped to a single agent, carrying spending ceilings, merchant categories and time windows, and they extend card-not-present dispute handling to those tokens². Stripe co-develops ACP and the Machine Payments Protocol, sits on the x402 foundation and launched its own stablecoin chain, Tempo, in March 2026³. The evidence here is strong. The direction is toward standards that look neutral but are governed by the companies that already collect payment fees. One company holding the protocol, the chain and merchant acquiring at the same time is plausibly the largest concentration risk in the field.

Regulation is sorting money into tiers

The OCC's proposed GENIUS Act rule makes dollar stablecoins a licensed instrument with 1:1 reserves, mandatory redemption and a ban on paying yield⁴. The biggest US banks are building a shared tokenized-deposit network through The Clearing House, targeting the first half of 2027⁵. The BIS argues that tokenized deposits, not stablecoins, should carry tokenized payments⁶. That creates a clash of doctrine between US policy and central banks. We think it is likely, at about 65%, that agent payments split into a regulated bank and card tier for consumer and enterprise spending and a looser stablecoin tier for API and machine-to-machine traffic. The bank network is still early, and earlier bank consortia often failed to coordinate.

Authorization is formalizing faster than liability

Google's AP2 records each purchase as three signed credentials covering intent, cart and payment, which gives an audit trail the user cannot later deny⁷. Regulation E does not say whether an agent's action counts as the consumer's authorization, and OpenAI's spec leaves disputed purchases with merchants by default⁸. Fraud is already exploiting this gap. Unit 42 and the Cloud Security Alliance document live pages with hidden payment instructions, Google measured a 32% relative rise in malicious indirect-injection content over three months⁹, and red-team work shows injection can steer an agent inside mandates that look valid⁷. The risk is that signed mandates end up shifting liability onto consumers before the law decides where it belongs.

Pricing is going per request, but fee capture is unproven

Machine payments are numerous and small: about $0.30 on average per x402 payment, with volume flat since early 2026 and some of it possibly incentive-driven¹⁰. The strongest early demand may come from content, not commerce. Cloudflare will block mixed-use AI crawlers by default from 15 September 2026 unless they pay per crawl or per use¹¹. On the commerce side, OpenAI's 4% Instant Checkout fee failed after only a few dozen merchants went live, and ChatGPT now sends buyers to retailers' own sites¹². Platforms have not yet shown they can take a cut of completed transactions. Network intermediaries that meter access look better placed.

What to watch

• Real x402 volume. Watch whether dollar volume, not payment counts, grows after incentives fade. Continued flat volume through 2027 would weaken the micropayment thesis.
• CFPB action on Regulation E. Guidance on agent-initiated transfers would settle the liability question. Without it, merchants and courts will set precedent dispute by dispute.
• The first large injection loss. A widely reported loss from a prompt-injected stablecoin payment would likely push agent spending toward reversible card and bank rails, and could bring broad restrictive rules.
• The Clearing House launch date and access terms. A 2027 launch that excludes permissionless agents would confirm the tiered split. Slipping past 2027 would leave more room for stablecoins.