Guardrails for AI agent purchases leave merchants exposed

New payment protocols lock down card credentials and set spending caps for autonomous software, but online retailers still carry the financial risk when models get orders wrong.

The three primary engines of digital payments in the West have started laying down track for software spending human money. As first reported by The Information, Visa, Mastercard, and Stripe are rolling out cryptographic safeguards and authentication standards designed specifically for AI agent purchases. The technical effort tackles an urgent problem: keeping raw credit card numbers out of automated agent prompts. Yet payment giants are sidestepping the messiest issue in online retail: who pays the bill when an autonomous agent hallucinates and buys the wrong item.

The shift is already evident in production traffic. By mid-2026, financial data showed that roughly 70% of API calls and balance inquiries reaching Stripe originated from automated AI agents rather than people clicking through desktop browsers. That sudden concentration of automated traffic pushed card networks to act before static payment credentials ended up leaking across arbitrary software prompts.

Scoped tokens and safeguards for AI agent purchases

The first defensive layer focuses on card data security. Stripe broadened its Shared Payment Tokens (SPTs) architecture in partnership with Visa and Mastercard, issuing agentic network tokens for autonomous shoppers. Instead of handing a bot real card details, the system supplies a scoped credential tied to explicit mandates: a strict spending ceiling, a tight expiration window, and a single authorized merchant. If prompt injection compromises the agent during checkout, an attacker cannot extract or reuse that token elsewhere.

Mastercard built its framework through Mastercard Agent Pay. Working with Google, the company co-developed Verifiable Intent, an open-source cryptographic specification connecting the consumer’s original prompt, the merchant authorization, and the resulting receipt. The suite also incorporates Know Your Agent (KYA), a protocol verifying that an autonomous purchasing agent comes from a recognized, vetted developer.

Visa structured its response around Visa Intelligent Commerce. Partnering with Cloudflare, the network introduced the Trusted Agent Protocol to list certified agents in central registries, alongside its Intelligent Commerce Connect service. This directory allows online storefronts to verify an agent’s credentials and standing before accepting its checkout request.

The chargeback loophole and merchant liability

While technical defenses are moving ahead, commercial rules remain stuck in another era. In the United States, consumer protection statutes such as Regulation E and Regulation Z, along with traditional card-not-present operating regulations, recognize only two basic states: a deliberate transaction approved by the cardholder, or outright criminal fraud through stolen credentials.

When a consumer asks an agent to book a flight and the model hallucinates travel dates or destinations, the transaction does not qualify as unauthorized fraud. Card networks currently have no chargeback dispute code for model hallucinations or agent execution errors. Because the purchase was technically authorized with valid credentials, existing network rules treat the charge as legitimate, leaving the merchant of record to absorb dispute fees and refund costs when the customer complains to their bank.

American Express addressed part of this dilemma through its proprietary Amex Agent Purchase Protection, enabled by its closed-loop model where the company acts as both card issuer and merchant acquirer. Visa and Mastercard operate open four-party networks involving thousands of independent issuing banks, acquiring processors, and merchants. Without a multilateral contract across those institutions to redistribute algorithmic losses, the financial cost of mistaken AI purchases will continue falling straight onto merchant ledgers.

Guardrails for AI agent purchases leave merchants exposed

Scoped tokens and safeguards for AI agent purchases

The chargeback loophole and merchant liability

Sources

Sources

Markers