AI agents can now pay for things. Researchers keep finding ways to trick them

Imagine asking an AI assistant to book you a train ticket, and it simply does it: finds the fare, pays, and sends you the confirmation. No card details typed in, no "confirm purchase" button. That is the promise of "agentic payments", and some of the biggest names in tech and finance are building the plumbing for it right now.

But the most interesting signals in this space aren't coming from product launches. They're coming from research labs, where security researchers are showing how these systems can be fooled, and from law firms reading Europe's new payment rules and noticing that AI agents aren't mentioned at all.

This is a story about a technology where the problems are showing up before the customers. That is often exactly the moment worth paying attention to.

What "agent payments" actually are

An AI agent is software that doesn't just answer questions but takes actions: searching, booking, buying. For it to pay for things, it needs a way to move money that doesn't depend on a human filling in a checkout form.

Several competing standards have appeared to do that. The best known are:

• x402, started by Coinbase. It revives an old, unused web code, "402 Payment Required", so that a website can ask an agent for a tiny payment, often in stablecoins, before serving data or a service. In July 2026 it moved to a neutral foundation hosted by the Linux Foundation.
• AP2, Google's Agent Payments Protocol, which uses signed "mandates": a digital instruction from the user saying what the agent may buy, and up to what amount.
• ACP, the Agentic Commerce Protocol, another open specification for agent checkout.

Developers are clearly interested. On GitHub, the x402 project has about 6,700 stars and 2,200 copies ("forks") that people are building on, AP2 about 3,300 stars and ACP about 1,500. Card networks are also working on special payment tokens for agents.

How much money is actually moving? Very little

Here the hype meets reality. The most careful estimate comes from a report by Visa and the data firm Artemis, using data as of April 2026. After stripping out fake "wash" transactions and testing, they found about $15 million had moved through x402 across about 110 million payments, roughly 14 cents each. The raw, unfiltered figures were about $136 million, so the filter removed close to 90% of the dollars.

Since then, the trackers disagree wildly. A raw on-chain counter shows steady machine-to-machine traffic, while other trackers report a collapse in value: settlement down 93% for the year by August, according to Helios Analytics data cited by CCN, against peaks near $800,000 a day in late 2025. Nobody has yet produced a neutral, audited number for genuine agent payments.

What's left is mostly software paying other software for tiny bits of data or computing, not people buying train tickets. When agents do buy things for consumers today, they mostly use ordinary cards. One startup from Y Combinator's summer 2026 batch, Agentcard, simply issues prepaid virtual Visa cards to AI agents.

Researchers found the weak spots first

While real volume stays small, academic attention has grown fast. Three papers published in 2026 stand out.

"Five Attacks on x402", posted in May by researchers from Ohio State, Australia's CSIRO and the University of Manchester, tested the protocol across more than 25,000 payment requests. They showed a user being charged without receiving the service, a single payment being reused to unlock a service 248 times on a live endpoint, paid content leaking through ordinary web caches, and a fake server capturing almost 72% of agent traffic during discovery. They found 11 vulnerabilities in three open-source toolkits.

A security analysis of Google's AP2, published in August, catalogued 48 different threats, eight of them rated high severity. Its central finding matters most: a valid signed mandate does not guarantee the user really wanted the payment, if the information the agent saw before signing was manipulated.

A formal analysis of four protocols (x402, MPP, ACP and AP2), also from August, used mathematical verification tools to run 86 test cases. Forty of them produced findings that had not been documented before.

These attacks were mostly tested on reference toolkits and test networks. Large production operators such as Coinbase and Cloudflare may already have fixed some of them. But they show that the security layer around agent payments is far from finished.

Europe's new rules don't mention AI agents

The European Union has spent years rewriting its payment rules, known as PSD3 and the Payment Services Regulation. The final compromise texts were sent for approval in April 2026, with publication expected in the second half of the year. Rules would apply 21 months after they enter into force.

According to a summary by PwC's legal arm, the text contains no provisions on AI agents, agent-initiated payments or payment mandates. A September analysis by the law firm Annerton lists the open questions: whether an advance mandate counts as authorising a payment, whether an agent could itself be a regulated payment service, and how strong customer authentication, the "confirm in your banking app" step, should work when a machine is acting for you.

The general rules still apply, and they point in one direction. The payment provider stays liable when authentication fails or when it misses suspicious transactions, and a consumer's own liability is capped at €50. Our reading of the analyses, which is an interpretation and not settled law, is that banks and payment firms in the EU are the most likely to end up carrying losses when a manipulated agent pays for something. That would make them the natural first customers for tools that check what an agent was really asked to do.

The European Central Bank is also paying attention. In September it opened a call for companies to join its digital euro innovation platform, with a workstream on "AI in payments" covering AI agents and micropayments in 2027.

The money is starting to follow, slowly

If payment firms are going to need agent-checking tools, someone has to build them. In Europe, that "trust layer" is still at the very earliest stage:

• Ralio in London raised a $2.5 million pre-seed round in April. It checks each agent payment against rules, sends uncertain cases to a human, and logs the decision trail.
• SolvaPay in Stockholm raised €2.4 million, also in April, to let software services charge AI agents directly.
• Cygrid in Berlin raised €2.66 million in October to control what AI agent identities are allowed to do, though it doesn't focus on payments.

For comparison, the US company Baselayer raised a $35 million Series A in September for a "Know Your Agent" credential, roughly ten times the European rounds.

There are also signs of positioning by incumbents. A sponsored patent analysis by GlobalData found that Mastercard's share of patent publications about AI agents rose from 0.7% to 5% over the past year, including one application on verifiable payment delegation. Visa's barely moved.

Why this matters if you never touch crypto

It's easy to file all of this under niche tech. But the question underneath it, who pays when software makes a mistake with your money?, will reach ordinary bank customers long before most people use an AI agent to shop.

The EU's new rules already contain some protections that point the way. The text gives consumers a refund right when fraudsters impersonate their payment provider, and it says that completing the authentication step on its own is not enough to prove a payment was authorised. Combined with the €50 cap on a payer's own liability, that suggests regulators lean towards protecting the person, not the paperwork. If that approach carries over to AI agents, the cost of a manipulated agent would mostly land on banks and payment firms, which gives them a strong reason to demand better safeguards before letting agents spend freely.

For the people building these systems, the research points to a clear gap: something that sits in front of the moment of signing, checks what the agent was actually asked to do and what it read along the way, and keeps a tamper-proof record. Whether that becomes a standalone product or a feature inside existing bank systems is one of the open questions of the next two years.

What could go wrong with this story

• Volume may never catch up. If agents keep using ordinary cards, new protocols may stay niche.
• General rules may be enough. EU regulators could handle agents through existing authentication and liability rules, or through technical guidance, before any startup gains an edge.
• The attacks may already be fixed in the large production systems that handle most real traffic.
• Card networks may bundle the solution. Visa and Mastercard could build risk scoring into their own agent programmes, shrinking room for independent startups.

What to watch next

• A neutral, audited count of real agent payments. Today's trackers disagree by orders of magnitude.
• Cloudflare's Monetization Gateway, launched in July 2026 and settling via x402, is the one large-distribution product that could revive volumes.
• Official publication of PSD3 and the PSR in the EU's Official Journal, and any guidance from the European Banking Authority on how mandates and authentication apply to agents.
• Larger funding rounds for European agent-verification startups, which would show investors believe banks will pay for this.
• Mastercard's patent filings on delegated payments, which could shape what others are allowed to build.

The technology for machines to pay each other exists. Whether you'd trust one with your card is a different question, and right now researchers are answering it faster than the market is.