AI Agents in Payments: 30% Ready to Trust Autonomous Transactions Despite Security Gaps

AI Agents Are Making Payments Without Your Approval

AI agents in payments are moving from recommendation engines to autonomous executors. They book flights, pay invoices, and move money when balances drop—all without checking in first. About 30% of consumers say they would already let an AI agent make purchases on their behalf1

1

. Banks, fintechs, and payment providers are building infrastructure to support this shift, but the safeguards have not caught up with the speed of deployment.

The appeal is straightforward: reduce friction, automate repetitive tasks, and let software handle financial decisions faster than humans can. What remains unresolved is what happens when the agent acts beyond your intent. AI agents in financial transactions can clear every fraud filter, look legitimate on the backend, and still execute something you never approved. In digital asset platforms, where transactions are often irreversible, the stakes are higher. Regulators have not yet established clear rules for who is responsible when an autonomous system gets something wrong1

1

.

Spending Limits Live in Prompts, Not Payment Layers

The first structural problem with AI agents in payments is where spending limits are enforced. In most current setups, limits live inside a prompt—an instruction given to the agent, not a technical constraint enforced at the payment layer. Sachi Kamiya, Director of Venture and Growth at Sentient Foundation, explained: "Spending limits cannot simply live in a prompt; they must be enforced at the wallet or payment layer, covering cumulative spending and actions delegated to other agents"1

1

.

This distinction matters when autonomous AI agents start passing tasks to other agents. Each one acts within what it understands to be its scope. Collectively, they can push past the boundary you set without any single agent technically breaking a rule. A single hard spending cap might stop one large mistake, but it will not stop an agent that misreads an instruction and sends the same smaller payment repeatedly. Kamiya pointed to open-source infrastructure as part of what is needed: independent parties verifying how programmable safeguards work, not just taking a platform's word for it1

1

.

Fraud Detection Was Built for Stolen Identities, Not Authorized Agents

The security tools banks rely on today were designed around a specific threat model: someone stole your credentials and is impersonating you. PINs, Face ID, and behavioral anomaly detection all assume a bad actor on the other side. An AI agent with legitimate access does not fit that picture. It is not impersonating you—it is you, as far as the system can tell.

Roman Yermoshyn, General Manager at GoBTC Pay, described the problem: "Today's payment security assumes a human with a thumb and a heartbeat on the other side of the screen. An agent with valid access isn't stolen. To a fraud engine, it looks like normal traffic. So the question has to change from 'is this really you?' to 'did you actually allow this?'"1

1

. His proposed model is one where you define what the agent is allowed to do before it acts: how much it can spend, how often, with whom, and until when. Anything outside those parameters comes back to you.

Fraud detection systems built for human users cannot distinguish between an authorized agent acting within technical permissions and one that has exceeded your actual intent. This gap creates a vulnerability that traditional security infrastructure was not designed to address.

Prompt Injection and Data Manipulation Create New Attack Vectors

An AI agent decides what to do based on the data it reads. Anyone who can corrupt that data can steer the agent toward a worse outcome without ever needing access to your account. Hugo Renaudin, CEO of Ulys, identified two categories of risks of AI agents: "The first risk is the obvious one: a bug or a hallucination. The agent overspends, buys something that doesn't match what the user wanted, or simply misunderstands what the user asked for. The second risk is manipulation. An agent makes its decisions based on the data it reads, so anyone smart enough to manipulate that data can push it toward a product or a service that isn't the best one for the user"1

1

.

Prompt injection attacks exploit this vulnerability. An attacker manipulates information consumed by the agent to redirect funds or trigger unauthorized transactions without directly stealing wallet keys2

2

. In AI agents in cryptocurrency transactions, where blockchain transactions are generally irreversible, mistaken transfers can be difficult to recover. Automated strategies also face price manipulation, slippage, and liquidity shocks during volatile trading conditions2

2

.

Coinbase Builds Infrastructure for Autonomous Financial Agents

Coinbase introduced Agentic Wallets in February 2026, allowing agents to hold funds, trade, and send payments using predefined controls. The infrastructure supports programmable spending limits, session restrictions, and isolated private-key management. In June, Coinbase expanded this approach with dedicated agent accounts and subaccounts, designed to separate automated activity from broader customer holdings2

2

.

Chainalysis research cited by CoinDesk states that Coinbase's x402 payment protocol recorded more than 138 million transactions involving automated payments for digital services in October. Over 87% of analyzed payments were worth USD 0.10 or less, demonstrating the appeal of blockchain micropayments. In July, the protocol processed approximately 75 million payments worth USD 24 million across 30 days2

2

. However, researchers cautioned that some activity might not reflect genuine commercial demand, and transaction counts do not measure successful security outcomes.

Google's Agent Payments Protocol also emphasizes verifiable authorization, helping distinguish user-approved transactions from unauthorized agent behavior2

2

.

Accountability Remains Undefined When Agents Make Mistakes

When an AI agent pays the wrong party, the list of candidates for who is responsible is long: the company that built the model, the app that gave it financial access, the institution that processed the transaction, or the user who set up the permissions in the first place. Right now, none of those parties have clear obligations mapped out. That is not a theoretical gap—it will produce real disputes1

1

.

Accountability gaps are particularly acute in digital asset platforms, where an unauthorized transaction cannot be reversed at all1

1

. Blockchain's irreversibility, combined with the autonomous nature of AI agents, creates a scenario where users may have no recourse when something goes wrong. Regulators have not yet set clear rules for liability in these situations.

Safeguards for AI Agents Require Layered Defenses

Effective safeguards for AI agents begin with dedicated wallets holding limited balances. Developers should enforce daily spending caps, approved recipient lists, transaction simulations, and independent authorization for unusually large transfers. Hardware-backed key protection, audited smart contracts, real-time alerts, and emergency shutdown mechanisms add defensive layers2

2

.

Human approval remains particularly important for transfers involving unfamiliar contracts or significant capital. Until these protections show resilience under real attacks, unrestricted access to substantial cryptocurrency holdings is difficult to justify2

2

. The challenge is implementing these safeguards without eliminating the speed and flexibility that make autonomous systems attractive in the first place.

What to watch: regulatory guidance on liability for AI agent errors, adoption of open-source verification for agent safeguards, and whether fraud detection systems evolve to distinguish authorized agents from authorized actions.