Every AI-agent payment system I reviewed proves the agent was allowed to pay. None records what the agent read before it chose, or lets a bank check that without the operator.

I read the specs for the five systems that let AI agents pay for things, plus every public security paper on them from this year that I could find. They all do a decent job of proving an agent was allowed to pay. None of them records what the agent looked at before it picked what to buy. None lets anyone outside the agent's operator check that afterwards.

That gap is already being exploited in the lab. A team at Ariel University planted ordinary sentences in product listings and got Google's AP2 sample agents to go wrong at rates of 90%, 56% and 73.3% across three attack families. The carts those agents built still passed every check the protocol runs. [R2]

The part I keep coming back to sits in AP2's own security section. It says all LLMs and agents “MUST be considered potential attackers.” Then, for purchases made while the user is away, it puts the job of not signing overlapping closed mandates on the shopping agent as a MUST. Credential providers and networks only get a MAY to reject them. So the one hard rule against double spending lands on the component the spec has just told you to distrust. [A1]

What's missing is something I'll call decision provenance: a record of the inputs behind a purchase, committed to before signing, that a bank or a consumer can verify without going through the agent's operator.

Google's Agent Payments Protocol (AP2). Announced in September 2025. Version 0.2 shipped on April 28, 2026, the same day Google handed the protocol to the FIDO Alliance. It uses Checkout and Payment Mandates, each with an open and a closed form, encoded as SD-JWTs. In Human-Not-Present (HNP) mode the user signs the open mandates and walks away, and the shopping agent signs the closed ones later with its own key. Keep that last detail in mind. [A1][A2][A3]

Mastercard Agent Pay and Verifiable Intent. Agent Pay registers agents and issues agentic tokens that can be limited by agent, merchant, category, amount, time window and usage. Verifiable Intent came out in March 2026, built with Google, and Mastercard pitches it as cryptographic proof of what the consumer authorized, something merchants and issuers can lean on. It went to FIDO alongside AP2. [C1][C2]

Visa Intelligent Commerce and the Trusted Agent Protocol (TAP). TAP launched with Cloudflare in October 2025. Agents sign their HTTP requests under RFC 9421, in line with Web Bot Auth. Under Visa's spec a valid signature shows the agent is enrolled in the program, and changing a header or the path breaks it. In April 2026 Visa added Intelligent Commerce Connect, which takes agent payments over TAP, ACP, UCP and the Machine Payments Protocol. [C3][C4][C5]

The Agentic Commerce Protocol (ACP), from OpenAI and Stripe. Under the Delegated Payment Spec the agent gets a token with a spending cap and an expiry, and that's about it for scoping. ChatGPT Instant Checkout, the consumer front end, was switched off in March 2026 because too few merchants joined. ACP itself is still around. [C8][C9]

x402, from Coinbase. It revives HTTP status 402 for per-request stablecoin payments. Off-chain facilitators check a payment, then settle it on-chain. A USENIX Security 2026 paper by researchers at EPFL and Zhejiang University examined 15 facilitators carrying 99% of observed x402 traffic. Every one broke at least one of 8 security rules, with 31 flaws found overall. [R5][R11]

Each one handles part of the payment. The trouble starts a week later, when a customer calls their bank to say the agent bought the wrong thing. The bank wants to know what the agent was looking at. Only the company running the agent can answer, and the bank has to take its word for it.

I sorted the published failures by the point where one party accepts something nobody else can verify, and ended up with six. The grouping is mine. A seam only made the list if a paper or the spec itself shows it happening.

These ratings are mine, based only on public documentation. They'll shift as the specs change.

A few things stand out. AP2 and x402 have the most published attacks because they're open, which makes them the easiest to study. The card-network stacks and ACP have had very little public research. That's a gap in scrutiny, and it says nothing about whether they're safe. Mastercard has the strongest stated goal on binding intent. And every system gets a No on the inputs row, because nothing I read commits to what the agent saw.

Every mechanism here is already public, and there's no exploit code in this report.

Visa said last December that it expects millions of shoppers to be buying through agents by this holiday season. Its risk team reported in November 2025 that dark-web posts mentioning AI agents had jumped more than 450%, and that malicious bot-initiated transactions were up 25% (40% in the US). [C7]

The rules are being written at the same time:

• The UK Treasury's consultation on modernising payment services asks directly how authentication, consent and liability should change for agentic payments. It closes on October 6, 2026, with a government response planned for Q4. [L3][L4]
• After the July Mills Review, the FCA said it would look at its regulatory perimeter within three to six months, which puts that somewhere between now and January. [L5]
• EMVCo's draft agentic payments framework lists Know Your Agent and agentic transaction indicators as possible features. Its comment window closes on September 30. [L6]
• FIDO's Payments Technical Working Group, chaired by Mastercard and Visa, now owns both AP2 and Verifiable Intent. [A3]

Whatever these four groups publish by early next year will set the proof an agent's purchase has to carry. If decision provenance is left out, my guess is it gets bolted on later, after the disputes pile up.

Sources were the AP2 v0.2 spec (security section included), Visa's TAP spec, OpenAI's Delegated Payment Spec, what Mastercard has published on Agent Pay and Verifiable Intent, and FIDO's April 28 announcement. On top of that I read the AP2, x402 and MCP security papers that came out between February and September 2026. For each control, I marked where in the transaction it sits and which handoff it covers. The handoffs nothing covers became the six seams.

No production system was tested for this. No number above comes from my own lab. Three things are on my list to change that. First, rerun Ariel's selection attack on the AP2 v0.2 samples using CRUCIBLE, my adversarial eval harness. Second, point the MCP Trust Scanner at public MCP servers that touch payments. Third, build a small Matrix Scroll prototype that commits to an agent's inputs and verifies offline. I'll post results here as they land.

Most of the papers cited are arXiv preprints that haven't been through peer review. The x402 facilitator study is the exception, since it was presented at USENIX Security. The Ariel paper describes AP2 using older mandate names (intent, cart and payment). I've used v0.2's names throughout, and the authors say they tested the v0.2.0 reference build.