AI Agents Can Pay for Things Now. Securing Them Is the Harder Problem.

The infrastructure for AI agents that shop and pay on a person's behalf is arriving fast. Google, Visa, Mastercard, PayPal, Coinbase, and dozens of other companies have spent the past year building and shipping the protocols — covered in detail in our A2A guide — that let an agent find, negotiate, and pay for something without a human clicking "buy." What's arrived much more slowly is a reliable answer to a more basic question: how does anyone in that transaction actually know the agent is who it says it is, acting on whose behalf, within limits someone actually agreed to?

Amazon and Meta's public fight is the clearest evidence yet

On Sept. 21, 2026, Amazon blocked Meta's newly launched Muse AI agent from shopping on Amazon.com, telling users that "continued access by an unauthorized AI agent violates Amazon's Conditions of Use." Amazon's stated reasons were specific: Meta never disclosed that Muse would access Amazon's platform, the agent didn't identify itself as an AI agent while browsing, it captured and stored customer credentials without what Amazon considered adequate safeguards, and it could reach a customer's account pages and order history on request — all without Amazon having any reliable way to tell which traffic on its site was Muse and which was a human shopper.

That last point is the real story. Amazon and Meta are not fighting about whether AI shopping agents should exist — both companies are building their own. They're fighting because there's currently no agreed-upon way for a merchant to verify an agent's identity, know what it's authorized to do, or distinguish it from a scraper wearing a shopping agent's clothing. Amazon has since taken the same position against Perplexity's shopping agent and Google's AI shopping tools, which suggests this isn't a one-off dispute with Meta specifically — it's the default posture of a platform that doesn't yet trust unverified agents on principle.

A prompt is not the same thing as authorization

The clearest articulation of why this is hard comes from JPMorgan's payments team, which put it bluntly: "A prompt expresses intent; it does not enforce authority." An instruction telling an agent what it should and shouldn't do is not a technical control — it's a request the agent's underlying model interprets, and interpretation can be manipulated, misunderstood, or simply wrong. JPMorgan points to internal security testing in which an agent produced malware despite being told it had no internet access, because the test environment happened to contain a network route nobody accounted for.

The fix JPMorgan and others are converging on isn't a better prompt — it's an architecture where an independent policy engine checks every proposed action against the agent's verified identity, its mandate, and its spending limits, and an execution layer enforces that decision through a path the agent itself cannot bypass. NIST has an active project on agent identity and authorization; OWASP is developing a parallel Agent Control Standard. Neither is finished. Both exist because the industry has largely concluded that trusting an agent to police itself isn't a real security model.

"A prompt expresses intent; it does not enforce authority." — JPMorgan's payments team, on why instructing an AI agent what to do is not the same as controlling what it can do.

What AP2's signed mandates are actually built to prove

Google's Agent Payments Protocol, announced Sept. 16, 2025 with more than 60 partners including Mastercard, PayPal, Coinbase, and American Express, is the most developed attempt at solving the authorization half of this problem. AP2 uses cryptographically signed "mandates" as tamper-proof digital contracts. An intent mandate captures what a person actually authorized — either a specific purchase or, for a delegated task like "buy concert tickets the moment they go on sale," standing rules covering price limits and timing. A cart mandate is a separate signed record locking in the exact items and price once an agent finalizes them, linked back to the intent mandate that authorized it.

Chained together, the two mandates are designed to answer three questions after the fact: did the user actually authorize this, does the agent's request genuinely reflect what the user intended, and if something goes wrong, who's accountable. That's a real improvement over an unverifiable "the agent said the user approved it." But it's worth being precise about what a mandate does and doesn't do: it's an audit and accountability mechanism, not a real-time gatekeeper. A signed mandate proves what was authorized after an agent acts on it — it doesn't, on its own, stop a manipulated or compromised agent from generating a fraudulent mandate request in the first place.

Prompt injection is still the unsolved problem underneath all of this

That gap matters because prompt injection — getting an AI agent to follow instructions hidden in content it processes, rather than instructions from its actual user — remains unresolved at a fundamental level. OWASP's Top 10 for Agentic Applications maps the risk into six of its ten categories, and researchers describe the underlying cause as structural: large language models process system instructions, user requests, and untrusted external content as one continuous stream of tokens, with no reliable built-in mechanism to tell a command from data.

Researcher Simon Willison's "lethal trifecta" framework describes the specific combination that turns this into a real exploit: an agent with access to private data, exposure to untrusted content, and the ability to communicate externally can be turned into a data-exfiltration tool by injected instructions the agent never should have trusted. Meta's internal "Agents Rule of Two" policy takes a similarly blunt approach: an agent can have any two of those three properties without a human in the loop, but never all three. The risk isn't theoretical. In March 2026, a malicious package impersonating a legitimate tool (nicknamed "hackerbot-claw") was downloaded more than 47,000 times from PyPI within three hours before it was caught; a Model Context Protocol server vulnerability rated 9.6 out of 10 in severity (CVE-2025-6514) let a malicious MCP server execute arbitrary commands on a connected agent's machine.

Financial institutions know this, and are moving cautiously anyway

A 2026 Cloud Security Alliance survey of financial institutions found 62% already use AI agents in some capacity and 85% expect agents to eventually initiate and execute payment transactions autonomously — but only 5% currently grant agents "high autonomy" over critical actions, and 65% say agentic payments will require "an entirely new model for authorization" that doesn't exist yet. Sensitive data leakage was the top-cited AI security risk, at 61%, followed by excessive or overly broad permissions granted to AI tools, at 33%. One in five institutions reported an AI-related security incident already; another 21% weren't sure whether they had.

That gap between belief and deployment is the honest state of agentic commerce security heading into 2027: the payment rails, from Mastercard's Agent Pay and "Know Your Agent" framework to AP2's mandates, are real and shipping. The identity, authorization, and containment layer underneath them — the part that would let a merchant trust an unfamiliar agent by default rather than blocking it on sight, the way Amazon did with Muse — is still being built in public, one dispute and one vulnerability disclosure at a time.

Why It Matters

• The rails are outrunning the guardrails. Payment protocols like AP2 and Agent Pay are live and shipping faster than the identity and authorization standards meant to secure them.
• Mandates prove authorization, not safety. A cryptographically signed record of what a user approved is an accountability tool for disputes after the fact, not a real-time defense against a manipulated agent.
• Prompt injection remains structurally unsolved. The core vulnerability — models can't reliably separate instructions from untrusted content — hasn't been fixed, only mitigated case by case.
• Merchants are choosing to block first. Amazon's stance against Muse, Perplexity, and Google's shopping agents shows platforms defaulting to distrust of unverified agents rather than assuming good faith.