Agentic payments are the rails, protocols and authorisation machinery that let software agents spend money on a user’s behalf; the infrastructure has been standardised at speed by every major payment network, while measured transaction volume remains in the low millions of dollars a month and the protocol layer has documented, model-independent payment-hijack vulnerabilities.
Summary
Agentic payments sit one layer beneath “agentic commerce”. An agent that shops for you eventually has to pay, and a card-present checkout flow designed for a human clicking a button does not survive contact with a machine that wants to make thousands of sub-cent calls, or with a merchant that needs to know whether the agent actually has authority to spend. The layer that has grown up to solve this has three parts: an authorisation and mandate layer (who delegated what spending authority to which agent, and can the merchant verify it), a settlement layer (cards and tokenised card rails, or stablecoins on public chains), and an evidence layer (what was agreed, when, and what proof survives a dispute).
Three parameters decide this. First, real demand: x402 settlement volume peaked at $5.15M in November 2025 and fell roughly 77% to $1.19M by May 2026, and CoinDesk reported around $28k/day of genuine commerce in March 2026 with Artemis estimating about half of activity as wash or self-dealing ref. Measurement itself is unresolved: x402.org’s panel reads 75.41M transactions and $24.24M over the 30 days to 21 July 2026 against roughly $1.1-1.2M on independent dashboards, a ~20x discrepancy ref. Second, security: a cross-platform study found 33 protocol-level vulnerabilities across three leading agentic commerce platforms, each succeeding deterministically at 100% attack-success rate regardless of which model the agent runs, with three chaining into an end-to-end payment hijack. Third, value capture: with the protocol layer free and the identity primitives donated to standards bodies, whatever surplus exists has to accrue somewhere other than the spec.
Evidence base
- x402 settlement volume peaked at $5.15M in November 2025 and fell roughly 77% to $1.19M by May 2026; x402.org reads 75.41M transactions / $24.24M over the 30 days to 21 July 2026 against $1.11-1.2M on independent dashboards ref
- The Linux Foundation took the x402 contribution on 2 April 2026 and launched operations with 40 members on 14 July 2026, including Visa, Mastercard, Amex, Stripe, Adyen, Fiserv, Google, AWS, Cloudflare, Circle and Shopify, with zero protocol fees and no native token ref
- A cross-platform study identified 33 protocol-level vulnerabilities across three leading agentic commerce platforms, deterministic and model-independent at 100% attack-success rate where live-measured, with three chaining into an end-to-end payment hijack
- Google donated AP2 to the FIDO Alliance on 28 April 2026 with Mastercard co-donating ‘Verifiable Intent’; a targeted search found no dated regulatory, liability or network mandate for agent identity, and Mastercard layered it onto existing EMV tokenisation so the issuer still carries fraud
- McKinsey (17 October 2025) forecast agentic commerce at $3-5T globally by 2030 and up to ~$1T of US B2C retail, against Bain’s $300-500B for US agentic commerce by 2030; all figures are forecast ranges ref
- CoinDesk (11 March 2026) reported x402 real commerce at about $28k/day with Artemis estimating ~50% wash or self-dealing; headline volume is over 80% wash by value
- Stablecoin float has stalled at roughly $290-305B, down 1.7% over 90 days, and only about 1% of the $35T headline volume (~$390B) is real payments
Open questions
- Which of the ~20x-divergent x402 volume measurements is right, and does any independent dataset show organic (de-washed) volume growing rather than falling after May 2026?
- Have any of the 33 disclosed protocol-level vulnerabilities been fixed in the deployed platforms, and does AIP-Bench become a gating requirement for agentic commerce integrations?
- Does a clearing or netting layer emerge as a chargeable service, given that neither Simon Taylor’s map nor Insignia’s analysis identifies one?
- Does any dated regulatory or liability mandate appear that forces merchants to verify agent authority, which is the missing forcing function for the identity and mandate layer?
Assessment drafted 2026-08-31 from up to 14 KB sources using the technology-scorecard framework; scores are a draft read pending review.