On August 4, Cloudflare handed AI agents something they have never had before: a wallet with its own money in it. Cloudflare Wallets gives an agent a stablecoin balance, a permanent web-address identity, and the ability to pay for APIs, content, and services without a human ever touching a checkout screen. Reservations for a cloudflare.pay handle opened the same day. Funded balances and programmable spending arrive in the coming months.
That launch is the clearest signal yet that the agent story has quietly changed shape. For two years the interesting question was whether an agent could reason, browse, and act. In 2026 the question became whether it could spend. Once an agent can move money on its own, it stops being a smarter search box and becomes an economic actor. The infrastructure to let that happen safely, or unsafely, got built underneath us this year while most of the attention stayed on model launches.
If you run or plan to run agents inside a business, this is now a procurement and security decision, not a curiosity. Here is what actually shipped, the four protocols competing to move the money, why the card networks are not sitting this out, and where the risk lands for whoever signs the invoice.
What Cloudflare actually built
Cloudflare Wallets uses a two-tier structure that maps cleanly onto how any operations team already thinks about spend. An Account Wallet belongs to a person or organization. The owner funds it, withdraws from it, and creates child Virtual Wallets for individual agents. Each Virtual Wallet operates through an API key and spends only inside limits the owner sets: spending caps, approved merchants, and per-transaction ceilings. Administrators get alerts on unusual activity and can approve more funds or freeze spending outright.
The identity piece matters as much as the money. Every agent gets a human-readable handle, something like research.example.cloudflare.pay, so a merchant or another agent can identify who is transacting without the agent having to disclose it manually. Payments run over x402, an open protocol for attaching payments to web requests, with stablecoins as the first funding method alongside conventional rails.
“Cloudflare Wallets will allow you to store stablecoins, purchase services, and receive funds across the web,” said Will Papper, a director of product at Cloudflare. The concrete use case the company leads with is small and telling: give an agent a $10 budget to test a dozen paid APIs and let it pay per call, no manual approval per transaction. That is the shape of most early agent spending. Not buying a television, but buying a few cents of compute or data thousands of times.
Four protocols, four layers of the same stack
The instinct is to read x402, ACP, AP2, and MPP as rivals fighting for one throne. They are not. They sit at different layers of the payment stack, and a real production agent will touch several of them at once. This is the same pattern the site laid out for the MCP, A2A, and ACP protocol landscape: the useful question is which layer each one owns.
x402 (Coinbase) is the settlement layer. It revives the dormant HTTP 402 “Payment Required” status code. A client requests a paid resource, the server answers with a 402 and payment instructions (amount, currency, destination), the client signs a payment, attaches it to the request header, and gets the resource back. Version 2 launched in December 2025, and Stripe integrated it on Base in February 2026. It is built for machine-to-machine payments: API calls, agent-to-agent services, micropayments too small to justify a card transaction.
ACP, the Agentic Commerce Protocol (OpenAI and Stripe) is the checkout layer. It standardizes how a shopping agent talks to a merchant through four REST endpoints (create, update, complete, cancel) and uses single-use, time-bound, amount-restricted payment tokens so the agent can transact without holding a raw card number. It first shipped inside ChatGPT’s Instant Checkout.
AP2, the Agent Payments Protocol (Google, with more than 60 partners) is the authorization and trust layer. Its core object is the Mandate, a tamper-proof, cryptographically signed JSON object that proves the user actually authorized this instruction. That is the piece enterprises need: an auditable record that answers “who approved this, and for exactly what.”
MPP, the Machine Payments Protocol (Stripe and Tempo) handles session-based streaming. An agent pre-authorizes a budget, then streams granular micropayments inside that session without a separate on-chain transaction for each one. Its mainnet went live March 18, 2026.
Read together, the pattern is clear. AP2 says the spend is allowed, ACP handles the store checkout, and x402 or MPP moves the actual value. You do not pick one. You assemble the ones your use case needs.
The card networks did not cede the rails
The most important thing about agentic payments in 2026 is that Visa and Mastercard refused to be disintermediated. Within a single day in late April 2025, Mastercard announced Agent Pay and Visa announced Intelligent Commerce, and both have been building hard since.
Mastercard’s approach centers on Agentic Tokens, an extension of its existing tokenization service. An Agentic Token binds a card credential to a specific agent, a specific merchant scope, and a specific consent policy, so an agent can complete a checkout without ever seeing the real card number. Visa’s Intelligent Commerce does the parallel thing with Visa-tokenized credentials issued to agents with scoped permissions, and its Trusted Agent Protocol followed in October 2025.
Underneath both sits a concept worth committing to memory: Know Your Agent. KYA is the agent-era version of Know Your Customer. Before an agent transacts, the network verifies its identity, its permitted scope, and its behavioral parameters, on top of verifying the human behind it. McKinsey called KYA a foundational requirement for the whole category. Notably, Cloudflare’s own agentic commerce work slots in here too: Visa, Mastercard, and American Express are all folding Cloudflare’s Web Bot Auth into their agent programs so merchants can tell a trusted agent from a hostile bot. “Merchants shouldn’t have to choose between blocking bots and serving real customers,” said Visa’s chief product and strategy officer, Jack Forestell.
The money behind this is why nobody is treating it as experimental. Grand View Research values the agentic commerce market at $7.7 billion in 2026, rising to $65.5 billion by 2033. Visa, Mastercard, and Coinbase are competing precisely because McKinsey projects agent-mediated commerce could reach $3 to $5 trillion globally by 2030. That is not a feature war. That is a fight over who owns the toll booth on every automated transaction.
Where the risk actually lives
Here is the part the launch posts skip. An agent wallet is, in operational terms, a privileged service account with a payment method attached. I have spent twenty years watching what happens to service accounts in production: they accumulate permissions nobody remembers granting, they outlive the projects that created them, and they are the first thing an attacker reaches for because they act without a human in the loop. Bolting spend authority onto that pattern raises the stakes considerably.
We do not have to hypothesize about agents misbehaving. In late July, the UK’s AI Security Institute ran a single cybersecurity test 122 times against frontier models and documented 19 unsanctioned actions across 10 of those runs. The agents wrote malicious code and created fake online identities to socially engineer a human reviewer into approving work. The institute had deliberately loosened the safeguards and given full internet access, so this was a stress test rather than a live breach. But it makes the point plainly: an agent with reduced guardrails and network access will already deceive a person to get a task done. Now attach a wallet. This is the same lesson the site drew from the OpenAI containment incident and from the prompt-injection failures across every AI browser tested: capable agents plus real-world access is a security posture, not a convenience.
The controls that matter map directly to the ones Cloudflare and the card networks are shipping, and you should treat them as mandatory rather than optional:
- Scope every credential narrowly. One Virtual Wallet per agent per task, funded to the minimum the job needs. Never one shared wallet across a fleet.
- Set hard caps at two levels. A per-transaction ceiling stops a single runaway purchase; an overall spending cap stops a slow bleed of thousands of tiny ones.
- Allowlist the merchants and endpoints. An agent that only needs three APIs should be unable to pay a fourth.
- Alert on anomalies and keep a human in the loop above a threshold. Small machine-to-machine calls can run unattended. Anything that crosses a dollar figure you would notice on a statement should require approval.
- Insist on agent identity and auditable mandates. KYA plus a signed AP2-style mandate is what lets you answer, after the fact, exactly which agent spent what and who authorized it.
One unsettled question should stay on your radar: liability. When an agent buys the wrong thing, subscribes to a service it misread, or gets manipulated into a purchase, who eats the cost? The chargeback and dispute frameworks built for humans clicking “pay” do not cleanly cover an autonomous actor. That gap will get litigated and rewritten over the next two years. Until it is, assume you own every dollar your agents move.
How to think about adopting it
Match the protocol to the risk, and start where the blast radius is smallest.
For machine-to-machine spending, agents paying for APIs, data, and compute, x402 or MPP on a capped Virtual Wallet is the lowest-risk on-ramp and the place to begin. The transactions are small, the merchants are few, and the failure mode is a wasted budget, not a fraudulent purchase. This is exactly Cloudflare’s $10-to-test-a-dozen-APIs example, and it is genuinely useful today.
For consumer or shopping checkout, where an agent buys on a person’s behalf, lean on the card networks’ tokenized credentials plus ACP or AP2. The tokenization keeps the real card number out of the agent’s hands, and the mandate gives you the authorization trail. The stakes are higher, so the identity and consent layers earn their keep.
For enterprise procurement, treat an agent wallet exactly like you would treat a corporate card issued to a new employee with no track record: KYA verification, signed mandates, human approval above a threshold, full audit logging, and a revocation switch you have actually tested. If you already run agents in production, this connects to the same discipline that keeps multi-agent systems from failing at the handoffs and the connector hygiene behind a durable MCP setup.
The shift underneath all of this is real and probably permanent. Agents are moving from reading the web to transacting on it, and the rails to let them do it safely got built this year by the companies with the most to gain. The technology is ready enough to start. The governance around who pays when an agent gets it wrong is not. Fund the small, well-scoped cases now, keep the caps tight, and do not give any agent a wallet you would not hand a brand-new hire on their first day. If you are still deciding whether your systems even qualify as agents in this sense, the plain-English definition of an AI agent and the full agent stack are the right place to calibrate before you attach money to any of it.