What Happens When AI Agents Can Spend Your Money?

Agents Become Actors: Payment Credentials and the New Commerce Stack

The conversation starts from a simple shift: over the last few months, AI agents have moved from spectators, recommending things, to actors, executing purchases. What unlocks that jump is access to payment credentials. Once an agent holds a card, its usefulness changes qualitatively. Terry Angelos describes a concrete case: asking an agent to find and book a piano teacher who could come to the house around a seven-year-old’s soccer schedule. The agent asked clarifying questions, checked calendars, and booked the first lesson. A recommendation became a completed transaction.

What a payment credential actually is

A credential is more than a “credit card” in the everyday sense. Historically, merchants stored raw 16-digit primary account numbers (PANs), encrypted them, and decrypted them when charging. Today the card networks issue network tokens: domain-bound versions of a card number that work only for a specific merchant, so a compromise is contained. The vault’s job is to capture, store, and retrieve these credentials without the merchant ever touching the underlying data.

This matters because of account churn. Roughly a third of cards are reissued every year, through natural expiration at about four years, plus reissues caused by issuer mergers (the Capital One and Discover migration is the example given) and fraud. A merchant alone cannot reconcile those changes. A large vault can, and card networks provide account-updater tools for exactly this purpose.

Why merchants shard across processors

A merchant doing over a billion dollars in GMV typically uses three to five payment processors. The reasons are cost, approval rates, and regional coverage, a form of sharding applied to payments. Multiplying processors multiplies the vaulting and update burden, since the same hundred million cards may need to live in several processor vaults and be refreshed at each network. VGS acts as a neutral, independent vault that sits in the middle, so merchants can route a network token to whichever processor they choose without locking into one.

PCI scope and the value of being boring

PCI DSS compliance, the long rulebook that every card network and bank requires, is the cost that VGS removes from merchants by taking card data out of their scope. Merchants can run their businesses normally rather than maintaining a hundred-plus pages of controls. The business is deliberately unexciting: things go into the vault, and occasionally they come out, retrieved for a specific charge and then never touched again. That boringness is the product. Terry estimates VGS holds around ten billion credentials.

The wallet wars

The agentic moment has restarted a fight that began years ago. Two properties determine who wins a wallet: the number of consumers who already have credentials stored there, and the breadth of merchant acceptance. Stripe Link reaches roughly 300 million consumers and about a million merchants. Shop Pay has similar consumer scale and a larger merchant footprint, on the order of 1.7 million. PayPal reports more than 400 million accounts and around 30 million merchants, though these figures depend on how activity is measured. Every wallet is racing to connect to agents.

The history matters here. Being the default stored credential is the prize, and there is a long lineage of it: issuers paid to be preferred on Uber and Airbnb, card-network competition played out in physical “what’s in your wallet” campaigns, and digital wallets then became a layer that processes transactions rather than merely storing cards. Checkout pages now resemble a NASCAR field of payment buttons.

Alex and Terry draw a useful parallel between agent commerce and the consumer wallet’s original purpose. The core problem is still friction at 2 a.m., when someone wants to buy flowers and cannot find the physical wallet. The agent is the same problem in a new form. Users once handed PayPal their card credentials to avoid entering them repeatedly; now they are asked to hand the same access to an agent.

Two models of wallet: pass-through and transacting

The wallet landscape splits into two models. Apple Pay-style wallets store the credential and hand a tokenized version to the merchant, which then routes the payment through its processor. Shop Pay, Link, and PayPal instead transact on the consumer’s behalf, collecting funds and remitting them to the merchant. Agentic commerce blends the two.

Stripe as the AOL of agentic commerce

Terry calls Stripe the AOL of agentic commerce, meant as a compliment. Like AOL’s walled garden, it made agent commerce work inside its own boundaries. The limitation is reach: Link works at about a million merchants, while many items live where no Link connection exists. In one example, an agent bought outdoor chandeliers at Walmart, which had no Link integration. Stripe issued a one-time virtual card, made the purchase, and then charged the consumer in a second transaction, similar to how DoorDash pays restaurants. The item arrived and the charge was correct, but the problem came with the paper trail. When a dispute happened, the consumer’s bank saw only a Stripe transaction, not a Walmart one. In a test, an American Express cardholder who called about a failed Link-routed purchase was connected to a Stripe engineer’s cell phone, since Stripe was not set up to run chargebacks.

That episode shows what the card networks actually provide: intermediation, shared rules, and a chargeback mechanism that adjudicates disputes both parties accept. Crypto payments are a bearer instrument, and if the lights do not work, the money is gone. Visa and Mastercard’s middle position is valuable for merchants too, since buyers are more willing to purchase when they know they can recover funds for a product that fails. Clever engineering that bypasses that trust layer loses utility even as it gains convenience.

The Walmart case had a second problem. After the purchase, Walmart offered a Walmart+ upsell, but the card on file was the one-time Stripe card, so the transaction failed. Merchants spend heavily to acquire customers, and they expect the right to build a relationship with them through upsell and cross-sell.

Agentic tokens: the open standard

The card networks have introduced agentic tokens to address this. A wallet such as Link, Shop Pay, or PayPal can hand a credential to an agent safely, and the agent hands it to the merchant. The charge goes against the consumer’s actual card, which preserves the follow-on relationship, the chargeback rules, and the card-network trust layer. Under this model, the agent declares that it is about to make a transaction, identifies itself as a verified agent, and states a limit such as no more than $100. The token is a new 16-digit number issued safely to the agent. Three months earlier this did not exist. VGS is now the largest provisioner of these tokens, serving agents, wallets, and some merchants, and is issuing a few million per week.

The three checks, and where agents break them

A transaction has traditionally needed three verifications. The first is whether the card is real, which a Luhn checksum can suggest but a bank must confirm. The second is whether the person presenting the card is its valid owner, which was historically handled with signatures and ID checks and has always been hard online. The third is whether the party is of sound mind to make the purchase, which at a Vegas casino means a patron who has had too many drinks gets refused.

Agents complicate all three. The card-validity check is solved in principle. The ownership check becomes an agent-registration problem: agents must be registered with Visa, Mastercard, or Amex, and the instruction chain must be verifiable. The sound-mind check is the hardest, since an agent might book the wrong hotel dates or hallucinate a purchase. Terry’s example is booking a San Diego hotel for a daughter’s gymnastics tournament with a $500 ceiling, which shows the flow of registration, validity, and bounded instructions. Context travels with the token, so the amount and item are recorded, but if the agent errs, the dispute mechanism remains unresolved. The likely outcome is that agents take on some responsibility.

Delegated authority raises the liability question directly. Merchants do not care whether a consumer used a human assistant, a spouse, or an AI. They need to know that a charge has a delegator who authorized it. Terry recalls “friendly fraud,” where consumers dispute legitimate purchases of virtual goods after the fact. Banks often absorb small disputes, which creates moral hazard. Delegated authority makes that tricky.

Amazon, Walmart, and the Shopify tail

Amazon blocking agents is largely an economic decision. Amazon is an advertising business, and an agent has no eyeballs to monetize. Agents bypass the ads that generate much of Amazon’s margin. The broader strategic split is between being antagonistic to agentic commerce and being receptive to it. Merchants that insert CAPTCHAs and friction will lose transactions to merchants that make purchase easy.

The likely pattern follows open banking. Consumers have a right to delegate access, and merchants have a right to say no. In the Plaid and Chase precedent, the outcome was a negotiated settlement: the bank allowed access, but only through its own APIs, which tokenized the data and could charge for access. Merchants may end up as opinionated APIs with their own agents. A Best Buy salesperson is a useful analogy: the job is to help, but the salesperson also earns commission, so the consumer’s agent and the merchant’s agent will negotiate. Walmart may welcome agents given its last-mile delivery strength, while Shopify’s small merchants may see agents as a vital new channel. Terry expects consumers to win in the end, though the shape of that outcome is unclear.

Overhyped and underhyped

Terry is skeptical that agents will trigger a bank run, with money continuously moving to maximize savings yield. Friction in financial services, including the convenience of a bill-pay product with established integrations, keeps people from optimizing that aggressively.

The underhyped side is unmonetized demand and the always-on nature of agents. Human desires are effectively infinite, and an agent in a cycling group chat would buy tires every time a recommendation arrived. Agents also save money by canceling forgotten subscriptions and trials, and that savings may be recycled into new purchases.

The discussion turns to how agents change scarcity. Economics normally says the cure for high prices is high prices, but if the restaurant reservation is intentionally hard to get, everyone with an agent that calls at 7 a.m. wins. This asymmetry drives early consumer wins, since few people have the tool and merchants have no idea what is happening. That advantage will not scale indefinitely, because the world adapts. Comcast blocking Alex’s agent is one example. A counterpoint is that Comcast may eventually refuse to talk to agents at all, forcing agents to route through the human owner.

Terms and conditions are another frontier. Agents read the fine print and find edge cases, such as buying a flight just under a price threshold to qualify for an upgrade. Reward ecosystems depend on breakage and on predictable spend patterns. If agents route each purchase to the card with the best rate, the points model falls apart, and new terms and conditions will follow.

Where VGS goes next

Terry frames VGS’s trajectory as three overlapping eras. The first is the vault itself, a decade spent becoming the most trusted credential store on the internet. The second is the flow of information into and out of the vault, which includes updating credentials across networks and managing the network tokens each one issues. The third, the one now emerging, is brokering credentials among multiple parties in ways that follow network rules and create value for every participant. VGS is already doing this with agentic tokens and with banks on tokenization. Each new merchant and issuer adds to a network effect in which credentials can be brokered across the ecosystem.

The shift from single-player to multiplayer is the core economic point. A vault used to serve one purpose, charging a subscription for one company. Now the same stored credential may need to flow to several processors, and to agents acting on the consumer’s behalf. Any business moving from single-player to multiplayer becomes more valuable, and 1Password’s evolution from a personal vault to shared access is a comparable example.

• Tags:
• Tokenization
• Feature
• Agentic Commerce
• Payment Infrastructure
• Network Tokens
• Agentic Tokens
• PCI Compliance
• Digital Wallets
• Stripe Link
• Card Networks
• Chargebacks
• Delegated Authority
• Open Banking
• VGS