With all parties holding veto power, why has proxy payment fallen into a deadlock?

Author: vignesh sreedhar, Meta Software Engineer

Compiled by: AididiaoJP, Foresight News

Consumer-grade AI agents are booming, and this article focuses solely on traditional card payment systems in B2C scenarios.

Where the Problem Lies

AI agents are browsing webpages, filling out forms, and increasingly placing orders directly. Agents should strictly act according to consumer authorization, yet they can still produce incorrect or unexpected results, executing actions that do not reflect the consumer's true intent. Anyone who has built, used, or interacted with agents knows this can happen at any time.

Suppose I ask an AI agent to book a hotel: two nights, total price under $600, free cancellation until the day before check-in, within walking distance of a specific venue. The agent finds the right hotel for $580 and pays. The problem is, it books a non-refundable, non-changeable room type. The card is valid, the merchant is real, and the amount is within budget—yet this remains a flawed purchase. This can happen whether humans are in the loop (for instant confirmation) or out of the loop (fully autonomous execution).

This raises a fundamental question: a payment can succeed while still violating user intent. There are two underlying scenarios for this.

First, intent is not accurately or completely understood. A natural language request must be translated into explicit conditions that users can confirm and other parties can verify. This translation process may miss or misinterpret key conditions, such as refundability, delivery date, or exchange options. Intent currently lacks a standard format—despite each card network claiming to have one—so once requirements become vague or ambiguous, mistakes can easily occur.

Second, agent behavior deviates from already clarified intent. Even when requirements are clear, agents may hallucinate, use outdated information, lose context across multi-step operations, misread checkout options, be manipulated by malicious prompts, make errors during checkout, or encounter bugs.

Given these risks, let's examine how they affect each key participant in the transaction.

Consumers: Lack of trust. Consumers need assurance that agents buy what they actually want, protect payment information, and provide clear remediation paths if issues arise. An NMI survey of 1,000 U.S. adults found that 69% distrust AI's ability to securely process payments, 70% want to review or veto AI decisions before placing orders, and only 10% are willing to fully delegate purchases to AI. Currently, most agent-driven purchases come from a small group of tech pioneers (likely including VCs); everyday users remain hesitant to entrust payments to agents.

Merchants, PSPs, and Acquirers: Fraud and chargeback risks. Merchants face worse circumstances. They must distinguish between legitimate shopping agents and malicious bots, and defend themselves if orders are later disputed as "unauthorized" or "against customer instructions." Their PSPs (especially risk management providers like Forter, Riskified, Signifyd, Sift, Accertify, and Sardine) and acquirers must assess this risk and handle disputes, yet see zero visibility into user intent. All risk service providers currently rely on signals supplied by merchants, which merchants can only obtain when users shop on their own websites.

Issuing Banks: Approving payments without any context. Issuing banks decide whether to authorize a payment and evaluate disputes, but like merchants, they cannot see exactly what the user authorized. In that case, how dare issuing banks underwrite credit risk? They cannot confidently differentiate between fraudsters, agent errors, and valid delegated purchases.

Card Networks: Missing accountability and intent in transactions. Card networks are rulemakers: they need a consistent set of rules to identify delegated authorizations, allocate losses, and assign liability. Without evidence passed between parties, where each side only sees part of the transaction, clarifying responsibility becomes nearly impossible.

Agent Companies: Need monetization. Agent companies urgently need a sustainable way to monetize transactions, but simply facilitating purchases doesn't establish who pays, why, or how much. Common proposals involve taking a cut from merchants (percentage-based or affiliate programs), but neither path has succeeded historically. Instant Checkout failed precisely because of this: launched by OpenAI in September 2025, it had already scaled back to product discovery and merchant-owned checkout flows by March 2026. Affiliate programs also struggle to scale—agents must build relationships one by one, join merchant programs one by one, and each program has its own terms, tracking, and settlement methods; even then, this only covers a fraction of agent activity. Moreover, why would merchants pay affiliate fees while bearing disproportionate risk?

Negative flywheel effect. These gaps reinforce each other: unclear authorization and liability lead to merchant blocklists, tighter issuer checks, declining approval rates, and interrupted checkout flows. Poorer experience makes users less willing to hand over purchases to agents. Consumer trust is also fragile: A YouGov survey commissioned by ACI of 2,080 UK adults found that 60% said they would stop using an AI shopping agent after just one mistake.

The crux is: even if models advance to the point where agents perfectly understand and follow user intent, the problem persists. No matter how perfect an agent is, its executed intent remains invisible to others, leaving fraud, chargeback, and dispute risks in the ecosystem unchanged: merchants still cannot distinguish legitimate agents from malicious actors, issuers still cannot verify what users actually authorized, and user claims remain unprovable and unfalsifiable.

Do Existing Solutions Work?

I won't cover every company individually, but I will explain broader agent payment approaches that have garnered attention.

Auto-filling Raw Card Numbers

An unusually common practice is storing users' real card details in a vault and using a browser agent to auto-fill them into merchant payment forms. Key personal agents like Instinct and Hark Labs operate this way. Though Instinct began supporting Stripe Link, the vault mechanism remains.

Instinct's payment operations run in cloud virtual desktops, making live demos inconvenient. So I tested Hark's vault instead—it directly auto-filled my raw card number and CVV into the payment form without masking. Strangely, despite these agents boasting high DAU and valuations, few point out this glaring security vulnerability.

Musk also tweeted that you could send a photo of your credit card to the Grok Bot, throw it into a chatbox, and let it shop online. But xAI's own terms state clearly: "Grok Bot may retain customer data, files, browser sessions, credentials, memories, and routines in a persistent cloud environment... Deleting the Bot may not delete shared files, sessions, credentials, or routines."

Are these companies PCI compliant? Auto-filling card numbers isn't inherently a PCI violation, but storing and exposing payment credentials brings heavy security and compliance obligations. PCI DSS prohibits vendors from retaining CVVs for future purchases, including via vendor-managed vaults or browser auto-fill. I couldn't find any PCI compliance certifications in several companies' terms, so these practices sit in a highly gray area.

Agentcard (a YC S26 company providing card vaults for agents) offers an interesting approach. Technically PCI compliant, it works similarly to 1Password: users encrypt and store their raw card info, and Agentcard itself cannot access it. It requires agent browser integration (Kernel, Browserbase), and transactions are approved via Face ID. Ultimately, merchants receive real credit card information. Kudos to Agentcard for finding a novel, PCI-compliant method allowing agents to pay with raw card details. Even if agent browsers become mainstream and users accept this 1Password-like model, I believe it remains a reliable transitional solution before agent tokens truly scale. They also support auto-approval; users can set threshold-based auto-approval when saving cards (e.g., automatic approval for amounts under $50). Agentcard currently supports 30 PSPs, including Stripe, Shopify, Worldpay, etc.

Agent Tokens

Paying without sharing real card info is nothing new: tokenization. Here, "token" does not refer to blockchain crypto, but a string of payment credentials substituting for actual card numbers. Device-bound credentials in Apple Pay are products of tokenization, and merchants also use network tokens to boost approval rates and reduce fraud. Tokens replace underlying card details and can be scoped to devices, merchants, or usage scenarios. Agent tokens are network tokens representing consumers' existing cards, augmented with agent identity, authentication instructions, and payment controls. Visa, Mastercard, and American Express each launched their own agent token programs over the past year.

Visa Intelligent Commerce (VIC) was the first agent token program. According to Visa's disclosed flow, users first verify the card, set up passkeys, and then authenticate instructions authorizing agent purchases. When the agent requests a checkout credential (the agent token), Visa applies network-level controls against the original instruction. Upon reaching authorization, VisaNet cross-checks the instruction. The instruction contains higher-level authorization conditions like spending limits, credential expiration dates, and merchant domain restrictions. However, every major agent platform features a passkey exemption—which I will explain later as critically problematic for issuers.

Mastercard Agent Pay follows a similar path, starting with agent registration, obtaining user consent, and authentication. Mastercard's tokenization service issues tokens representing the user's existing card for agent use. Per its disclosed advanced checkout flow, the agent submits purchase details and restrictions via an Intent API in exchange for an intent ID and tokenized payment credential.

AmEx's Agentic Commerce Experiences (ACE) splits registration, intent approval, and credential acquisition into three steps. Account activation lets users register cards to verified agents and complete issuer authentication. As both issuer and network, AmEx controls the entire issuance lifecycle itself. Agents call the Create Intent API to submit purchase directives and restrictions, then exchange a proof token for a scoped checkout credential when ready to pay.

Looking across networks, two critical decisions stand out: issuance and payment authorization. Issuance determines whether a card can be registered and an agent create usable tokens. Authorization (as today) dictates whether the network approves the payment once credentials reach checkout. Given these programs, why aren't they used widely? The issue is that several issuers currently do not support cross-network issuance of these tokens. Major banks like Chase explicitly refuse agent tokens, and many others cannot support them stably. Furthermore, authorization friction is high, with 3D Secure challenge rates remaining elevated.

Network-launched agent tokens sound ideal theoretically, but practical deployment faces hurdles due to two reasons: technical architecture and issuer pushback.

Crossmint targets the gap left by issuers refusing agent tokens. It does not issue new cards but uses users' existing ones. During registration, it first checks if the card qualifies for an agent token (VIC, Agent Pay, or ACE); if not, it falls back to a PCI-compliant vault routing raw card numbers: the card number is encrypted via a public key generated by the agent browser, computer use, or UCP component, then locally decrypted and auto-filled at checkout. Alfongi told me Crossmint discussed this with Visa and Mastercard, ultimately deciding against issuing virtual cards because networks guaranteed long-term disapproval.

Real-world performance hasn't been stellar either. Crossmint admits approval and issuance rates are still subpar but improving over the last two to three months. Their data shows Mastercard performs significantly better than Visa, particularly struggling with Chase and commercial cards.

Networks can define credentials and controls, but issuers must still assess risk and serve cardholders when things go wrong. Without reliable proof of what users authorized or whether a purchase matches intent, issuers cannot underwrite the extra risk brought by agent delegation. AmEx holds a unique advantage as both network and issuer, explicitly emphasizing handing intent to the issuer before execution. This highlights exactly why the passkey exemption is fatal: passkeys are the sole step cardholders take to prove they authorized an instruction. Exempting passkeys across every major agent platform means issuers lose this crucial signal precisely when they need it most.

The Issuance Model: Stripe Link Agent Wallet and Link Balance

For reference, Stripe was the first to roll out this approach at scale, though I know several others have already launched or are building issuance plans.

How it works: An intermediary issues a new card to the agent (typically a single-use virtual card), splitting each purchase into two hops: your card pays Link, Link's card pays the merchant. Link has effectively become the de facto agent wallet, with agent purchases growing 38x month-over-month in September 2026.

Economics: After deducting plan costs and prior to paying the agent, credit card funds yield roughly a $0.40 margin on a $100 purchase. On the user side: Link appears on your statement, category rewards don't apply, and disputes/refunds route back to the merchant through Link. On the merchant/issuer side: merchants receive a commercial card devoid of risk data, increasing acquiring costs by up to ~200 basis points; issuers lose merchant-level data. On the network side: Visa prohibits real-time card fronting outside its phased wallet rules. Mastercard went further during its Q3 2026 earnings call: CEO Michael Miebach stated, "We do not support issuing one-time virtual card numbers to front transactions," calling VCN a bridge and "not a long-term solution we will support."

Operators I spoke to conveyed the same message from another angle: current practices are converging toward issuing trusted virtual cards. The math is glaringly obvious—when you're essentially designing around a MOR/card-to-card funding model, the economics simply don't add up. Privacy.com spent over a decade perfecting this model: sophisticated strategies optimize acquiring costs and network fees on the funding side, fraud models are finely tuned, and credit/transaction loss underwriting, customer service, and chargeback handling are handled in-house. Stripe might be willing to force-feed this playbook and absorb massive losses to grab market share.

Network attitudes are nuanced. While some network franchise teams dislike fronting, networks ultimately earn more because each purchase generates additional swipe volumes. Affirm/Klarna-style BNPL serves as an example: paying merchants via virtual cards at e-commerce POS terminals first, then collecting installment payments from consumers' underlying debit cards. Moreover, Visa will never allow Mastercard to gain the upper hand in agentic commerce, and vice versa. Thus, both will make exceptions to support transitional solutions, just as they did with stablecoin settlement and cross-border issuance exemptions.

On October 26, Stripe launched Link Balance for agents, initially rolling out through Instinct. The architectural shift separates funds from individual purchases: consumers preload balance and grant spending permissions, enabling agents to act autonomously when consumers are offline. In short:

How it works: A preloaded, KYC-verified balance exists as stablecoins (USDC on Tempo) in a Privy wallet, spent via a consumer prepaid Visa card issued by Lead Bank, which benefits from the Durbin exemption.

Why stablecoins?: With stablecoins, agent permissions reside at the wallet layer, granting Stripe distribution leverage: a programmable balance can pay ordinary card merchants, settle on machine payment rails (like Stripe's Machine Payments Protocol), and expand USD balances overseas without building local deposit products in every market. However, this balance lacks FDIC insurance.

Economics: Debit funding is cheap at ~$0.26 per $100; each $100 purchase yields ~$1.95 in interchange fees. Add float income from idle balances, which would increase further if Link shifts to Bridge's OUSD.

Liability: Consumers bear the cost of agent mistakes. Link's terms do not cover unauthorized transactions, and your original issuer only sees a single deposit.

This is currently the most mature payment and monetization solution for agent companies, but it worsens outcomes for consumers, merchants, issuers, and networks alike. The full breakdown, figures, and sources above provide complete context.

Checkout Execution: Shopify and UCP

Shopify's path contrasts with merchants like Amazon, which outright blocks Meta's Muse and similar agents from purchasing on their sites. In January, Shopify partnered with Google to develop the Universal Commerce Protocol (UCP), enabling agents to search products, add to cart, and checkout across merchants. In September, Shopify extended WebMCP support to checkout, including Shop Pay, covering all eligible merchants. This allows browser-based agents to read, update, and complete checkout via structured tools, eliminating reliance on screenshots and scraping.

It also partners directly with Muse and Instinct, though reportedly, unlike Stripe, it does not share economic revenue with agent companies. For payments, Shop Pay uses agent tokens for non-Shopify stores, but as noted earlier, agent token approval and issuance rates are poor.

Several third parties are building atop this, such as Crossmint and Sapiom. Crossmint's headless checkout API uses UCP and WebMCP where merchants support them, and custom browser tools otherwise. It claims coverage of 90% of e-commerce sites, with median implementation taking under two minutes.

Also worth highlighting is Agentcard's opencommerce.sh: providing agents with an endpoint and SDK enables product search, checkout, and order tracking across 5,026 online stores. Once users approve the cart, payment routes through the Agentcard vault, with upcoming support for Stripe Link and Shop Pay. A 1% fee applies per completed order.

Yet this only solves the checkout环节. While Shopify, Crossmint, and Agentcard make it easier for agents to complete purchases, none change a fundamental reality: who bears the risk when an agent buys the wrong thing.

We Have Reached an Impasse

Commerce is fundamentally a multilateral risk network where both merchants and issuers hold vetoes. Consumers can spend all day wanting agents to buy for them, but unless merchants (suppliers of goods) accept it or issuers (providers of purchasing power) authorize it, the transaction won't happen, and users will likely place orders manually instead.

One might argue that pure consumer demand alone can spin a positive flywheel: as more people use agents to shop, merchants will naturally build infrastructure to accept these payments, resisting issuers and networks will simply be bypassed, and players like Stripe and Shopify will dominate agentic commerce.

I believe it's far from impossible, largely because Stripe is playing a grand chess game. Alfongj noted that Visa built its empire by securing both ends of the road; Stripe now grips both: merchants, with enterprises processing $19 trillion on Stripe last year; and consumers, with over 350 million using Link, pre-installed in popular agents.

Surrounding these two poles, Stripe has aligned the rest of the network: Tempo acts as the rail, OUSD as currency, and MPP as protocol. Once Link balances on Tempo can pay Stripe merchants via MPP, a complete payment path emerges bypassing Visa entirely—zero interchange fees, no chargeback risk, instant merchant settlement.

This path will undoubtedly face layered obstacles from issuers, networks, and possibly users. Yet Stripe is betting precisely on this ambitious wager: building a closed-loop network for agentic commerce. They should bet this way.

However, I believe the probability of success is quite low, for two main reasons.

First, the bar is extremely high. Over the past decade, payment experience has been honed relentlessly: saved payment details, one-click checkout, wallets like Apple Pay, and the joint rollout of wallets and network tokenization in 2014. Today's checkout flows are polished by decades and tens of billions in investment, nearing optimality. How mature is it? Global payment revenue grew only 3% from 2024 to 2025, compared to an average of 11% in prior years. Therefore, if agentic commerce delivers a worse experience—more chargebacks, more verification challenges, more blocked sessions—people will not adopt it at scale. They will bypass agents and shop manually.

Second, trust. Payments are highly sensitive, and trust is extraordinarily fragile. Many agent companies treat PCI compliance as an afterthought, inviting numerous security incidents. Unanticipated purchases may also proliferate: lacking consumer protection, dispute rights, clear rules, or ecosystem participants willing to assume liability. If just one person around you gets burned—a non-intended purchase, a blockage by a merchant or issuer, a security breach—they will never use it again.

Building payment trust takes a very long time. The first secure online card payment occurred in August 1994 for a Sting CD. By Q4 1999, e-commerce accounted for only 0.64% of U.S. retail; 4.2% in 2010; and just 17.1% today. A full 30 years. Furthermore, this growth was backed by institutional trust: Visa's zero-liability policy in 1997, 3DS in 2001, PCI DSS in 2004, network tokenization and Apple Pay in 2014. Agentic payments lack all of these. Seeing others use it might encourage trial, but true scaling requires institutional trust.

Moreover, we are building an ecosystem where stakeholder incentives are fundamentally misaligned:

Card Networks want to preserve influence. They've built agent tokens, passkeys, and Intent APIs (which barely capture genuine intent), hoping to run agentic commerce on their own rails and rules. But issuers like Chase refuse to fund them, and every major agent platform features passkey exemptions. Worst of all, they compete fiercely, standards clash, and rules lie in shambles. They should not grow complacent: Stripe is betting itself into becoming a true payments behemoth; anyone competing against Stripe sits in precarious positions.

Merchants are on defense. Large merchants are integrating agents to handle overflow traffic, but still rely on black-box fraud models designed for humans: mismatched IPs, browser session history, fingerprints, geolocation discrepancies, etc. Hundreds of companies pitch KYA and complex fraud models, yet none possess wide enough coverage or distribution to generate serious interest. I suspect KYA fails entirely if you cannot see the human behind the agent and their intent, and agent companies will hardly relinquish this data willingly.

Issuers cannot, in good conscience, underwrite transactions they barely see. Yet they could play a pivotal role here. As Nikil Konduru stated, only issuers possess the full stack to cushion agent errors: premium interchange, underwriting, funding credentials, dispute resolution. They could require agents to submit intent before authorization to grant purchase protection, then combine this intent with cross-merchant purchase history to finally build the retail media networks they've long sought. But issuers move slowly, and this model only works if the Big Five align to resist and set demands before standards are finalized (which they likely won't). Agent companies also have no reason to onboard issuers one by one—one wallet already works everywhere, plus no one wants to shop through bank apps.

Agent companies need scalable GMV monetization to pay compute bills. So whatever method today gets purchases through and pays them, they'll use: vaulting raw cards, issuing via Link, negotiating custom agreements with merchants—it doesn't matter what costs it imposes on merchants, issuers, or networks.

They also enjoy macro tailwinds. In Q1 2026, AI captured ~80% of the ~$300 billion global VC funding pool; OpenAI and Anthropic raised ~$217 billion in the first half alone; Alphabet, Amazon, Microsoft, and Meta plan to spend ~$725 billion on AI infrastructure in 2026, up 77% YoY. Consumer-grade agents are equally flush with capital: Instinct launched invite-only in August, secured $1 billion at a $10 billion valuation in September, whereas just a month prior it raised a round at a $2.5 billion valuation.

With so much capital, influence, and pressure funneled into consumer AI, and agentic commerce poised as a sustainable monetization vehicle, agent companies and their investors will not wait for the payment ecosystem to slowly figure things out. They will move fast, get it done, indifferent to whether others participate—that is where Stripe and other companies betting on "servicing agents" show their cunning.

Yet I believe they will ultimately have to monetize these users. For all the reasons stated above, users will not adopt at scale unless the entire commercial ecosystem has the incentive to keep it running.

Benefits only users without benefiting merchants? Won't scale. Benefits only merchants without benefiting issuers? Won't scale. Benefits only issuers without benefiting agent companies? Still won't scale.