Today I came across a BeInCrypto report on a panel about AI agent payments. Daniel Ishag, chief commercial officer at Bakkt, used an example I have used many times myself. Your autonomous agent books you a business-class ticket to Korea. You look forward to a few days in Seoul, and you land in Pyongyang.
Of course that is exaggerated. Visa rules would stop the trip long before boarding, and I would probably spot the destination on my ticket in time. The question of who pays for the ticket, or unwinds the booking, remains. It comes up with every agent that holds a budget. A spending limit tells the payment provider how much may leave the account, while product, recipient and terms stay in my head, unwritten.
Limits cover the amount
BeInCrypto Research reviewed 19 AI products and workflows for The State of AI Agent Payments 2026. Fourteen of them could act within limits a person or business set in advance. The same report documents two incidents in which $281,200 ended up in attacker-controlled wallets before recoveries; in one of them, a public message triggered a $175,000 transfer from an AI-linked wallet. The blockchain worked as designed in both cases. The instructions came in as text, and the wallets paid.
The user carries the loss
Stripe's terms for the Link agent wallet keep the user liable for payments a connected agent initiates, including purchases that follow from a misread instruction or a hallucination. Stripe excludes failures of its own technology. According to the same terms, disconnecting an agent does not necessarily end recurring payments the user approved earlier.
On 19 October 2026 the UK Financial Conduct Authority published examples of good and poor practice for AI in financial services. Firms stay responsible for the outcomes, including where a third party supplies the model. The FCA also lists human review that drifts into box-ticking as a weakness to fix.
In the US, Michael Selig, chairman of the Commodity Futures Trading Commission (CFTC), put the liability question to an AI forum on 28 October 2026. If an agent trades on a user's behalf and malfunctions, he asked, who is liable, and does its developer need to register? He floated know-your-agent rules alongside know-your-customer. No rules or guidance were announced.
Some providers answer with insurance. Sailo Technologies offers an insurer-backed money-back guarantee for breaches that occur while all three of its products are active.
A signed record shows consent
Google's Agent Payments Protocol (AP2) uses two signed mandates, one for the checkout and one for the payment, each first open and then closed. When a chargeback arrives, the merchant can show what was signed. Deciding whether one particular payment sat inside that agreement is a separate step. Today it runs after the money has moved, in dispute processes that assume a person reads the statement and notices the error.
Check the mandate before the payment
I built MolTrust around a check that runs before each payment. The mandate names the destination country, the counterparty, the product class, the amount and the validity window. For every payment the check returns permit, pending or deny, each with a reason, and anything the mandate leaves unnamed is refused. A mandate for a flight to the Republic of Korea forbids a ticket to Pyongyang before a single cent moves.
Pending sends the payment to a person together with the reason and the mandate clause it touches. The reviewer sees one specific question and the evidence for it.
NIST has proposed ten design tenets for agent identity management systems. Three of them ask for access that is bound to a task and expires with it, and for data and instructions to be kept apart by the architecture, since a language model takes both in through one stream. The mandate check runs outside the agent. Injected text can change what the agent wants to buy, and each payment is still compared against the mandate the user signed.
The verdict travels with its evidence. An issuer, merchant, insurer or supervisor can recompute it offline from the same inputs and reach the same result. Funds and refund decisions stay with the payment provider and the merchant. MolTrust supplies the verdict, and the parties settle a dispute on the same facts.
Before you fund an agent
BeInCrypto closes with the questions anyone funding an agent should ask: which purchases it may make, who records the instructions, whether further spending can be stopped, and who handles a disputed payment. The permitted purchases go into the mandate as named constraints. The instructions are on record in the signed mandate and its evidence bundle. A disputed payment comes with a verdict that user, issuer and merchant can recompute for themselves.
The enforcement SDK is on PyPI as moltrust-enforce. Integration notes are at moltrust.ch/developers.html.
Sources
- BeInCrypto, Was passiert, wenn KI-Agenten Ihnen den falschen Flug buchen? (Mohammad Shahid, 31 October 2026, in German)
- BeInCrypto Research, The State of AI Agent Payments 2026 (7 October 2026)
- BeInCrypto, Are Businesses Ignoring a Big Risk With AI Agentic Payments? (28 October 2026)
- Stripe, Link Consumer Terms
- Financial Conduct Authority, AI in financial services: good practice and areas for improvement (19 October 2026)
- CFTC AI forum, Michael Selig on liability and know-your-agent (28 October 2026), report
- NIST, Design Tenets for Agent Identity Management Systems
- Sailo Technologies, Money Back Guarantee
- CoinDesk, What happens when an AI agent pays for the wrong thing (28 October 2026)