Agentic commerce (aCommerce) is the rapidly emerging paradigm in which AI agents — autonomous software systems capable of reasoning, planning, and acting on behalf of an individual — conduct commercial transactions with little to no real-time human involvement. Rather than a person browsing, selecting a product to purchase, and checking out, an AI agent receives a set of instructions (preferences, budget, inventory needs, schedules), makes decisions, and executes purchases end-to-end. This is your trusted assistant helping to execute your to-do list.
But even the most trusted assistants can make mistakes or be misled. In the case of AI agents, these assistants are uniquely vulnerable to a range of security risks that are not typically found in traditional payments. Traditional payments are deterministic, meaning that a set of inputs produces a set of known and predictable outputs. Agentic systems, on the other hand, are probabilistic, which means that an agent’s interpretation of context is determinative of the outcomes.
This distinction between traditional payments and agentic systems matters because payment security has historically been built around predictable user actions and tightly bounded execution paths. In agentic commerce, by contrast, models interpret context, select tools, and act under delegated authority, which introduces new risks such as prompt injection, intent drift, fabricated authorization, and cascading failures across multi-agent workflows.
Any security framework for agentic payments must therefore do more than authenticate a transaction; it must also verify that the transaction reflects the original human instruction given to the agent.
AI agent systems present unique security risks
AI agent systems exhibit unique characteristics which include their autonomy, authority to act delegated by a human user, and dynamic behavior based on a prompt. Due to these differentiating factors, these systems are uniquely susceptible to certain security risks, such as:
- Prompt injection. A hidden instruction placed in a webpage, API response, or document can cause an agent to change its behavior in the middle of a task, without setting off any typical security or authentication alarms. The agent is not hacked in the usual sense; it is tricked and misdirected. Standard input checks may not catch this because the instruction can appear valid to the model, even though it leads the agent in the wrong direction.
- Intent drift under adversarial composition. Multi-step agentic tasks involve an agent accumulating context across many inputs. Inputs that are individually benign can combine to produce an instruction that the agent misinterprets or an ‘adversary’ could layer in an undetected request. In this event, no single input is detectable as malicious but cumulatively, the outcome may be that the agent is tricked into overriding its original instructions to perform an unauthorized — and potentially malicious — task such as overriding budget limits or changing the destination wallet.
- Authorization ambiguity. When an agent takes a consequential action, the verifying party (merchant, API endpoint, payment processor) typically has no cryptographic proof of what the human principal authorized. This creates a structural accountability gap: who authorized this action, to what scope, and when?
- Temporal authorization decoupling. In traditional e-commerce, a human’s authorization of a transaction is contemporaneous with the transaction itself. In agentic commerce, authorization is granted when the human is giving the agent instructions, which may be hours or days before the actual purchase happens. The context in which the agent is then attempting to execute the transaction instructions may differ materially from the context in which the mandate was granted, and this ‘decoupling’ is what creates the risks that the agent will misinterpret the scope.
Assessments of agent misconfiguration and prompt-based exploits have highlighted how hidden instructions or granting excessive permissions can lead agents to take alternative or unauthorized actions, with potential for material negative outcomes for individuals or organizations.
Moreover, the concentration of sensitive identity, agentic trust (i.e., the confidence that an autonomous AI agent is authorized to act, is acting with legitimate intent, and can be held accountable on behalf of a real human within defined guardrails) and payment workflows within autonomous agents creates elevated exposure to agent hijacking and privilege escalation. As a result, securing agent payment systems requires dedicated controls including strict permissions, continuous monitoring, deterministic fallback mechanisms, and robust guardrails to ensure agent behavior remains aligned.
Trust is the foundational layer of modern payment systems. Trust is foundational to the safe and effective deployment of agentic systems. The payment industry has invested decades in building trust infrastructure for human-initiated commerce, including network tokens, cryptographic authentication, and dispute resolution frameworks. As AI agents increasingly participate in commercial transactions, Mastercard believes that adapting, extending, and complementing the existing trust infrastructure that supports payments today is essential for the safe and scalable adoption of agentic payments.
Mastercard’s Agent Pay and the Verifiable Intent framework provide the missing security layer for delegated commerce.
In agentic payments, the core challenge is not simply whether an agent can complete a payment, but whether every participant in the transaction can verify what was authorized, by whom, under what conditions, and within what limits. Mastercard has sought to address the core challenges of agentic payments by extending our existing tokenization framework to agentic transactions and establishing a tamper-resistant cryptographically verifiable record of what the user intended to authorize. These two interlocking mechanisms of Agentic Tokens and the Verifiable Intent framework work to address the security challenges of probabilistic payments.
Rather than granting an AI agent access to a raw card credential that can be misused in a variety of ways, Agentic Tokens bind a tokenized card to a specific agent, a specific merchant scope, and a specific consent policy — so a model like ChatGPT or Microsoft Copilot can complete a checkout without ever holding the underlying card number. The token is scoped and time-bound, meaning the agent can only do what the consumer has explicitly permitted, and only within the parameters they have defined. This approach makes the agent a governed participant in the payment flow rather than an opaque intermediary, and it extends to agentic commerce the same tokenization logic that has substantially reduced fraud rates on card-not-present (eCommerce) transactions.
The second mechanism is Verifiable Intent, co-developed with Google and introduced in March 2026. Verifiable Intent creates a tamper-resistant record of what a user authorized when an AI agent acts on their behalf, establishing a shared source of truth across the ecosystem. It provides cryptographic proof of authorization that consumers, merchants, and issuers can all rely on. These tokenized credentials encode a consumer’s spending mandate such as spending caps and authorized time windows and travel with the transaction through the network, enabling every party in the chain to verify that authorization exists. Crucially, Verifiable Intent adds an explicit proof layer on top of Agent Pay’s existing infrastructure, one that travels with the transaction and is intended to make dispute resolution faster and cleaner by providing verifiable proof of the original intent of the authorizing individual. In a world where payment finality is instantaneous and chargebacks are the primary consumer remedy, that audit trail is really the underlying mechanism that builds trust in agentic payments through accountability.
Verifiable Intent will support adoption of agentic commerce at scale. Without a robust and universally accepted set of global standards and frameworks for agent identity, behavior monitoring, and ongoing risk assessment, organizations are reluctant to deploy agentic systems at scale due to concerns about fraud, misuse, and operational integrity. Moreover, the ecosystem could fragment into siloed trust domains absent interoperable profiles for existing protocols. To address these concerns, Mastercard has actively contributed to global industry standard-setting initiatives through organizations such as the FIDO Alliance, EMVCo, the Internet Engineering Task Force (IETF), and the World Wide Web Consortium (W3C), which aim to establish interoperability across devices, wallets, operating systems, and platforms.
Verifiable Intent is designed to work across agentic protocols, devices, wallets, platforms, and even other payments networks — today and as the ecosystem evolves. The framework was codeveloped with Google and is aligned with Google’s Agent Payments Protocol (AP2), as well as the Universal Commerce Protocol (UCP), and is designed to be protocol-agnostic, meaning it is intended to function across different agentic platforms, devices, wallets, and payment networks. And we have gone a step further by making the Verifiable Intent specification open-source and contributing the Verifiable Intent framework to the FIDO Alliance for further development and adoption across the industry.
The FIDO Alliance has announced an Agentic Authentication Technical Working Group, which draws directly on AP2 and Verifiable Intent, with the goal of developing interoperable specifications for agent-initiated commerce. Where the question for traditional payment security was “is this card legitimate,” the question for agentic payment security becomes “did the user actually intend this” and that is a fundamentally different trust model, one that must be settled at the protocol level, not institution by institution. Mastercard’s decision to contribute Verifiable Intent to an open standards body reflects a recognition that agentic trust infrastructure, like the authentication standards that secured the web before it, will only work if it works across the ecosystem.
Agent quality needs to be considered alongside agentic security. As Mastercard partners with industry stakeholders and collaborates with technical standards bodies, the company recognizes an additional layer of complexity that must be addressed: agent quality, not just agent security. Agent quality refers to a set of properties (robustness, safety, explainability) possessed by agents or components in agentic systems. Unlike previous AI paradigms, agents possess levels of autonomy — they are empowered to perform a variety of general actions as opposed to one kind of action. This means that risks related to an agent’s ability to effectively plan and operate can contribute to or become security vulnerabilities. For example, if an agent fails to refuse inappropriate inputs, this may cause data leakage from that agent or permit the agent to be used in an adversarial manner against internal data or processes. This risk is heightened by the increasing complexity of agentic architecture, and a corresponding increase in the number of participants (developers) in any given agentic system relative to other kinds of AI systems. Agentic architecture can become complex, interdependent, and multi-sourced. As a result of this, it is essential to ensure that agent quality is sufficient to support the security of agentic architectures, and to support effective evaluation of third party-developed agentic components (such as agents, generative components, and more).
Unlocking the potential of aCommerce safely requires collaboration across industry and the public sector. Mastercard is committed to collaborating with industry stakeholders and technical standards bodies in the private and public sector to ensure that trust, security, and accountability remain at the heart of agentic AI systems. We believe that the responsible extension of existing trust infrastructure, combined with new standards for agent quality and authorization, will unlock the potential of agentic commerce while protecting consumers, merchants, and the broader digital economy.
About Mastercard
Mastercard powers economies and empowers people in 200+ countries and territories worldwide. Together with our customers, we’re building a sustainable economy where everyone can prosper. We support a wide range of digital payments choices, making transactions secure, simple, smart and accessible. Our technology and innovation, partnerships and networks combine to deliver a unique set of products and services that help people, businesses and governments realize their greatest potential.
Download your sample issue here!
No part of Central Bank Payments News may be reproduced, copied, republished, or distributed in any form or by any means, in whole or in part, without the express and prior written permission of the publisher, Currency Research Malta, Ltd.
