Here is the reality: an AI agent just spent money it was never authorized to spend. The attack chain was simple. Morse code embedded in a webpage. Grok decoded it. Bankrbot executed the payment. No one asked the user. No cryptographic proof of intent was ever generated. The ledger shows the transaction. The ledger does not show consent.
This is not a bug in a single protocol. This is a structural flaw in the entire AI agent payment stack. And the industry is rushing to build on top of it.
The Context: A Market Built on a Missing Primitive
Let me establish the baseline. On-chain agent payments currently total $73 million across 176 million transactions. The median payment is between $0.01 and $0.10. These are micro-transactions, machine-to-machine payments, the kind of volume that would choke a traditional card network but flows naturally through a blockchain.
The numbers are small. The trajectory is not. Every major payments player is moving into this space. Google is developing AP2, an agent payments protocol. Visa has announced its Trusted Agent Protocol. Mastercard is building Agent Pay. These are not experiments. These are strategic bets on a future where software agents transact autonomously.
But here is the problem: none of these solutions address the fundamental question of authorization. The attack I described above is not an edge case. It is a demonstration of the core vulnerability that exists in every agent payment system being built today.
The Core: Proof of Authorization Is Missing
Let me be precise about what I mean. A blockchain transaction proves that funds moved from point A to point B. It proves nothing about whether the entity initiating that movement had the right to do so. This is the authorization gap.
In traditional finance, this gap is filled by KYC procedures, risk scoring, and human review. In the current AI agent stack, it is filled by nothing. The agent holds a key. The agent decides to spend. The network executes. There is no mechanism to verify that the agent's decision was aligned with the user's intent.
Based on my audit experience, this is the most dangerous kind of vulnerability because it is invisible. A smart contract bug is discoverable through code review. An authorization flaw is only discoverable after the loss occurs. The transaction looks valid. The signature is cryptographically sound. The only problem is that the agent was manipulated into signing something the user never wanted.
This is not a theoretical concern. The Snyk scan of the public agent skills ecosystem found that 36.82% of 3,984 public agent skills have security issues. 76 malicious payloads were identified. Prompt injection is the dominant attack mode. The attack surface is not a single protocol. It is the entire ecosystem of tools and skills that agents are being given access to.
The Architecture Problem: Agents Should Not Hold Keys
There is a growing consensus among security researchers about what the correct architecture should look like. Agents should not hold keys. Policies should not exist in prompts. The decision to spend should be separated from the ability to spend.
This is the "agent proposes, system disposes" model. The agent identifies a payment opportunity. The system verifies the authorization against a policy. The system executes the transaction. The agent never has direct access to the signing key.
This is not a radical idea. It is the same separation of concerns that exists in every well-designed enterprise system. The difference is that the crypto industry has been so focused on the novelty of autonomous agents that it forgot the basic principles of access control.
The industry giants understand this. Google's AP2 uses cryptographic signatures for authorization. Visa's Trusted Agent Protocol requires digital signatures to prove identity. Mastercard's Agent Pay adds credentials and programmatic limits. These are all variations on the same theme: the agent must prove it has the right to act.
But here is the uncomfortable truth: none of these solutions address the root cause. The problem is not the absence of a signature mechanism. The problem is that the agent's decision-making process is opaque and manipulable. A signature proves that the agent acted. It does not prove that the agent acted correctly.
The Contrarian Angle: The Giants Are Building the Wrong Thing
Let me push back on the conventional narrative. The market is treating this as a standards problem. Google, Visa, and Mastercard are competing to define the protocol that will govern agent payments. The assumption is that once we have a standard, the security issues will be resolved.
This is wrong. The standards being proposed are essentially traditional payment security applied to a new context. They add signatures, credentials, and limits. They do not address the fundamental issue of agent autonomy. An agent that can be manipulated by a prompt injection will sign anything you put in front of it, regardless of the cryptographic framework surrounding it.
The real problem is that we are trying to build a trust layer on top of an untrusted decision-maker. The agent is the weakest link in the chain, and no amount of cryptographic wrapping will change that.
This is why I am skeptical of the institutional solutions. They are designed to make regulators comfortable, not to solve the underlying security problem. They create the appearance of safety without addressing the root cause.
The more interesting work is happening in the crypto-native space, where the focus is on separating the agent's ability to propose from the system's ability to dispose. This is a fundamentally different approach. It does not try to make the agent trustworthy. It assumes the agent is untrustworthy and designs the system accordingly.
The Regulatory Dimension: AB 316 and the Liability Question
California's AB 316 is the first major legislative attempt to address AI liability. The bill prohibits AI developers from using "system autonomy" as a defense. If an AI system causes harm, the deploying company is responsible. Causation and foreseeability are the key tests.
This has direct implications for agent payments. If an agent makes an unauthorized payment, who is liable? The user who deployed the agent? The company that built the agent? The wallet provider that executed the transaction? The current legal framework provides no clear answer.
The industry consensus is that the deploying company should be responsible. This aligns with AB 316's direction. But it creates a perverse incentive. Companies will be reluctant to deploy agents if they are strictly liable for every action the agent takes. This could slow adoption significantly.
The solution is not to assign liability. The solution is to create a technical framework that makes liability clear. If every agent action requires cryptographic proof of authorization, then the question of liability becomes a question of whether the authorization was valid. This is a technical problem, not a legal one.
The Ecosystem Reality: A Security Crisis in the Skills Layer
The agent skills ecosystem is where the real danger lies. These are the plugins and tools that agents use to interact with the world. The Snyk data shows that over a third of them have security issues. This is not a minor problem. This is a systemic failure.
Prompt injection is the dominant attack vector. An attacker embeds malicious instructions in content that the agent reads. The agent follows the instructions, believing they are legitimate. This is not a vulnerability in the agent's code. It is a vulnerability in the agent's trust model. The agent cannot distinguish between instructions from its operator and instructions from an attacker.
This is why input isolation is critical. The agent must be able to distinguish between commands and data. It must treat all external content as untrusted. It must never execute instructions that come from outside its trusted context.
This is a solvable problem. It requires careful design and rigorous testing. But it is not being solved. The industry is moving too fast, prioritizing speed to market over security. The result is an ecosystem that is fundamentally unsafe for large-scale deployment.
The Market Signal: Small Numbers, Big Implications
The $73 million in on-chain agent payments is a rounding error in the broader crypto market. But the implications are significant. This is the first real use case for AI agents in the financial system. It is a proof of concept that autonomous agents can transact value.
The security incident I described at the beginning of this article is not a reason to abandon the concept. It is a reason to build it properly. The technology is sound. The architecture is not. We have the tools to solve this problem. We just need to use them.
The next six to twelve months will be critical. The industry is at a turning point. The giants are moving in. The standards are being set. The question is whether the crypto-native community will lead the way or be left behind.
The Takeaway: Code Is the Only Law That Doesn't Lie
Here is the reality: the AI agent payment stack is being built on a missing primitive. Proof of authorization is not a nice-to-have. It is the foundation upon which everything else must be built. Without it, we are building skyscrapers on sand.
The solution is not more signatures. The solution is a fundamental rethinking of the agent's role in the transaction. The agent should propose. The system should dispose. The agent should never hold the keys. The system should always verify the intent.
This is not a technical challenge. It is a design philosophy. We need to stop treating agents as autonomous actors and start treating them as untrusted tools. The security of the system should not depend on the agent's behavior. It should depend on the system's architecture.
The industry is at a crossroads. The traditional payment giants are offering compliance-friendly solutions that paper over the underlying problems. The crypto-native community has the opportunity to build something better. The question is whether we will take it.
Silence is the loudest audit trail in the market. The absence of authorization proofs in the current agent payment stack is a signal that the industry is not ready for prime time. The question is not whether the technology will mature. The question is whether the industry will learn from its mistakes before the next major incident.
Flow follows fear, but only if the protocol holds. The current protocols do not hold. They are built on trust in an untrusted environment. The next generation of protocols must be built on proof. Not promises. Proof.
The ledger doesn't lie. But it also doesn't tell the whole truth. It shows the movement of funds. It does not show the intent behind the movement. Until we solve this problem, AI agent payments will remain a high-risk experiment. The potential is enormous. The risks are equally enormous. The choice is ours.