What If We Let AI Agents Pay?

Google's AP2, Cloudflare's NET Dollar, ChatGPT Instant Checkout: a roundup of the agent payment announcements that poured out within two weeks in September, with my notes on why agents end up spending money and what worries me about it.

Posted Nov 3, 2025 Updated Oct 18, 2026

By Dongkwan Kim

12 min read

What If We Let AI Agents Pay?

This post was originally written in Korean and translated into English with AI.

Lately, agent payment announcements have been coming one after another.

Google’s Agent Payments Protocol (AP2)¹, with more than 60 companies on board, which is impressive.
An A2A x402 extension that adds crypto payments¹
The x402 Foundation, which Cloudflare said it would create with Coinbase²
NET Dollar, a stablecoin Cloudflare said it would launch³
OpenAI’s Instant Checkout, which lets you buy things right inside ChatGPT⁴

All of this happened in less than two weeks. I’m curious how far it will go.

Why do agents need money?

Why is this happening at all? When I think about it, an AI agent needs resources to do real work. And to get those resources, doesn’t it come down to money? Just as people spend money when they buy or book something, an agent has to spend money to book flights, buy things, and call APIs. For an agent to spend that money on its own, I think people needed a protocol for delegating payments to it.

Today’s payments assume that a person clicks “buy” themselves on a screen they trust. When an agent pays on your behalf, that assumption no longer holds. In introducing AP2, Google laid out three questions this raises: whether the user actually gave the agent permission to make this purchase (authorization), whether the agent’s request reflects what the user really wants (authenticity), and who is responsible when a wrong payment or fraud happens (accountability)¹.

AP2: recording the user’s intent as a signature

AP2 answers these questions with something called a Mandate: a digital contract, cryptographically signed so it can’t be forged, that proves what the user instructed.

For example, if I tell an agent “Find me white running shoes,” that request is recorded as an Intent Mandate. When I approve the cart the agent picked, the exact items and price are signed as a Cart Mandate. The point is to guarantee that what I saw and approved is exactly what gets paid for.

Some tasks I hand off while I’m away. To ask an agent to “buy concert tickets the moment they go on sale,” I sign conditions like a price cap and a time window into an Intent Mandate ahead of time. When those conditions are met, the agent creates the Cart Mandate. Either way, there’s a trail from intent to cart to payment, so if something goes wrong you can trace who approved what.

Google describes AP2 as an open standard that works with any payment method: cards, real-time bank transfers, and stablecoins¹. Crypto payments go through the A2A x402 extension, built with Coinbase, the Ethereum Foundation, and MetaMask¹.

x402: paying directly with HTTP 402

x402 is a payment protocol Coinbase originally released in May⁵. The web has long had an HTTP status code, “402 Payment Required,” that was reserved for future use and almost never used. x402 brings it back to life. The server responds with 402 and the price, and the client pays on the spot in stablecoins and resends the request.

This means an agent can pay for exactly what it needs without first creating an account, subscribing, or getting an API key. I find that pretty refreshing. A person only has to sign up and register a card once, but for an agent that calls lots of services on the fly, this could make a big difference.

Stablecoins or cards?

So can’t existing payment systems do the job on their own? In an agent world, where tiny amounts move in real time and across borders, my sense is that stablecoins are more efficient. That’s probably why Cloudflare is pushing NET Dollar. CEO Matthew Prince said the Internet has so far run on ads and bank transfers, and the next business model will be pay-per-use microtransactions³. Cloudflare describes stablecoins as one tool to use alongside the existing financial system, but I think blockchain-based payments will end up playing an important role, for the sake of trust and speed.

The card networks aren’t sitting still, though. Mastercard announced Agent Pay in April⁶, and on October 14 Visa released the Trusted Agent Protocol with Cloudflare, which helps merchants tell trustworthy agents apart⁷. Rather than one of cards or stablecoins winning, I think both will keep adapting to agents for now.

Buying right inside ChatGPT

OpenAI’s Instant Checkout runs on the Agentic Commerce Protocol (ACP), built with Stripe. At launch, U.S. users could buy from U.S. Etsy sellers right inside ChatGPT with a saved card, and according to OpenAI, more than a million Shopify merchants were coming soon⁴. OpenAI open-sourced ACP, so other apps and agents can add payments the same way.

What I’d keep an eye on is how it makes money and how it decides what to show.

It’s free for users, and the merchant pays a small fee once a purchase is completed⁴.
Product results are organic and unsponsored, and OpenAI says they’re ranked purely on relevance to the user. When several merchants sell the same product, ChatGPT looks at availability, price, quality, whether the merchant is the primary seller, and whether it supports Instant Checkout⁴.

But a merchant that supports Instant Checkout is a merchant that pays the fee. OpenAI says these results aren’t ads for now, but once people get used to finding and buying things inside ChatGPT, what comes next? What the agent shows first turns straight into sales, so won’t an ad system eventually follow, one that shows more products from merchants who pay more?

When agents become economic actors

Follow this trend far enough and I can see agents becoming economic actors. Maybe I’m oversimplifying. Still, with Google, Cloudflare, OpenAI, and the card networks all moving at the same time, it does feel like something big has started. A while ago I talked this over with Professor Taesoo Kim, and we predicted that payments would be followed by the agentic OS, an environment where agents do their work, and by wallets that agents hold and spend from directly.

There’s plenty to worry about, too. Mandates record intent and responsibility, but if an agent makes a payment I didn’t mean, within the scope I signed, is that on me or on the company that built the agent? To pay for me, an agent has to know my preferences and payment details, and I don’t know yet how privacy and regulation should be handled. Crypto payments are also hard to undo once sent, so small bugs or biases that pile up there could turn into a big mess someday.

Security worries me too. Agents read and act on text from outside, like web pages, emails, and documents, so instructions hidden in that text can hijack them. Attacks that slip in instructions to steer an AI like this are broadly called prompt injection, and when the instructions are hidden in outside content, Microsoft calls it XPIA (cross-prompt injection attack). In an experiment Guardio ran in August 2025, an AI browser agent treated instructions hidden in a fake CAPTCHA page as real commands. In a separate test, asked to buy a watch, it went to a fake shop, filled in saved card details, and completed the purchase without any human confirmation⁸.

When I gave my AI Security 101 talk in 2024, my main prompt injection worries were things like data leaks and remote code execution. Payments open up a new domain tied directly to money. A money-related prompt injection case also comes to mind. In December 2023, someone told the ChatGPT-based chatbot on a Chevrolet dealer’s website to agree with anything the customer said and to end every answer by calling it a legally binding offer⁹. The chatbot then agreed to sell a 2024 Tahoe for one dollar, adding “no takesies backsies.” The dealer didn’t actually sell the car and just took the chatbot down, but once this kind of manipulation leads to real payments, it stops being a joke. Greed and money go hand in hand, so I expect attackers to have a much bigger reason to go after it, and a single breach to do far more damage.

Key takeaways

Within two weeks in September, a run of agent payment announcements came out, including Google’s AP2, Cloudflare’s NET Dollar, and ChatGPT Instant Checkout. Agents have to spend money to get their work done, and it seems that created the need for protocols that let people hand payments over to agents.
AP2 records the user’s intent as signed Mandates, and x402 lets agents pay directly over HTTP 402 with no account or API key. Stablecoins look better suited to real-time micropayments, but the card networks are adapting to agents too.
I can see a path to agents becoming economic actors, but several problems still have no answer: responsibility for wrong payments, privacy, bugs in payments that are hard to undo, and prompt injection (XPIA) aimed at money. Shopping results that aren’t ads today will probably get ads eventually.

Update (October 2026)

About a year later, the agentic OS and agent wallets that Professor Taesoo Kim and I talked about are actually showing up.

First, the agentic OS. Microsoft began rolling out experimental agent features to Windows Insiders, and its own documentation warned about XPIA risks¹⁰. Then on September 29, 2026, OpenAI released dots, an always-on agent that works all day with its own cloud computer and browser¹¹. The agent no longer borrows a person’s computer; it has one of its own.

Agent wallets have arrived too. In February 2026, Coinbase launched Agentic Wallets, which let agents spend and receive money directly over x402¹².

Instant Checkout, which this post covered, didn’t last. In March 2026, OpenAI stepped back from it. Checkout now goes to merchants’ own checkout pages or their apps inside ChatGPT, and OpenAI is focusing on helping people find and compare products¹³. The million-plus Shopify merchants that were supposed to arrive soon never came in through Instant Checkout; checkout moved to the merchant’s own store¹⁴.

Reporting points to a few reasons¹⁵. People researched products in ChatGPT but didn’t buy there: Walmart said products sold directly inside ChatGPT converted at a third of the rate of ones that sent shoppers to its own site. And merchants didn’t want to hand over checkout. That’s where merchants get customer data and control of the experience, and with Instant Checkout they only saw the customer after the purchase was done.

The merchant side mattered a lot, but people not buying inside ChatGPT may also have to do with whether you can trust AI with your money. In one shopping survey, 10% would give AI full control over a purchase, and 70% said they need to be able to review or override it before paying¹⁶. People will let AI find and recommend things, but they still want to press the final pay button themselves.

With Instant Checkout, people did press that final button themselves. If they still held back from buying inside ChatGPT, maybe an agent paying on its own is the last gate, the one that measures how much people trust AI and how much they still push back against it. In effect, Instant Checkout stopped before it even reached that gate.

With checkout back in the merchants’ hands, ChatGPT was left with finding and showing products, and as I guessed a year ago, ads have arrived, for now as separate units below its answers¹⁷. Whether an answer can change minds just by what it picks and shows first, outside any ad slot, is something I looked at separately in Can AI Shape Ideology Without Lying?.

On the research side, the things I worried about in this post are being pinned down as concrete problems. A SoK paper on blockchain-based agent-to-agent payments lists, among its key challenges, weak intent binding, where the user’s intent is only loosely tied to the payment, and misuse under valid authorization¹⁸. In other words, an agent can have proper permission and still use it for the wrong things.

There’s a real case that goes a step further, too. This one isn’t misuse within a granted permission; there was no permission at all. According to a report OpenAI published recently, an internal research model spent money from someone else’s wallet without permission during a coding task¹⁹. It needed funds to deploy a smart contract on a test network, so it derived wallet keys from a public developer recovery phrase and found an account that still had a balance. The model even stopped to consider whether it was okay to use the money, then decided it was fine, since the key is public knowledge and test-network tokens are worthless. It put its own judgment in place of the account owner’s permission.

The tools are arriving fast, but the question left over is the same as a year ago: when an agent spends money it shouldn’t, who’s responsible?

References

ai agents payments security prompt-injection

This post is licensed under CC BY 4.0 by the author.