Software That Acts: The Major Matters Guide to AI Agents

Disclosure: Charlie Major is the founder and publisher of Major Matters and of Major Labs, and is employed by Mastercard. This guide reflects Major Matters' independent editorial analysis, is based entirely on publicly available information, and does not represent the views of Mastercard or any other organization. Where the guide discusses card networks and payment companies, it reports what they have announced and does not rate, rank or compare them.

In May 2024 a reviewer at Tom's Guide tried to order mozzarella sticks with the Rabbit R1, a $199 orange gadget sold as the first consumer device driven by a "large action model". The device said there was an issue and asked him to try again. The review gave it one and a half stars and told readers to avoid it.

In July 2026, 26 months later, Visa reported that AI agents were buying holidays on lastminute.com and sportswear from Frasers on behalf of real customers, with more than 30 European issuers providing the credentials behind those purchases. In the same stretch, Mastercard's network carried its first agent-initiated transaction, American Express began offering purchase protection for purchases made by registered agents, and Google, OpenAI and Stripe each published a protocol describing how a piece of software should be allowed to spend your money.

That is the arc this guide covers: from a gadget that could not add a side order to a cart, to a payments industry rewriting its rules for buyers that are not human.

It is long by design. The word "agent" now appears in every product launch, every earnings call and every regulatory speech, and most of the people using it could not draw you a diagram of what one is. This guide is the diagram. It is written for the reader who needs to understand the machine rather than the marketing: the product lead deciding what to build, the risk officer deciding what to allow, the merchant deciding whether to let a bot check out, and the curious reader who wants to know what all the fuss is about. It is meant to be a starting point that you can return to, not a piece you read once. Each part stands on its own, so skip to the one you need.

An agent is not a smarter chatbot. It is a loop: a model that can take an action, see what happened, and decide what to do next. Everything valuable about agents comes from that loop, and so does everything dangerous.

How to Use This Guide

If you are new to the subject, read Parts One to Three in order. They explain what an agent is, why it matters, and why the first attempts failed, and everything later builds on them.

If you are a product or strategy lead deciding what to build, read Part One for the anatomy, Part Four for what has shipped and what has not, and Part Seven for the protocols you will have to integrate with.

If you are in risk, compliance, fraud or security, read Part Six first and then Part Seven. Part Six is a catalog of documented incidents with sources; Part Seven is the map of who is building the controls.

If you are a merchant or acquirer deciding whether to let agents check out, read the agentic commerce section of Part Four, the intent-layer section of Part Five, and the liability section of Part Six.

Two appendices sit at the end for reference. Appendix A defines the terms used throughout, from "harness" to "Know Your Agent." Appendix B is a dated timeline from 2022 to September 2026, so you can see the order in which things happened. Every figure and quotation in the guide is linked to its source, and the full list is collected in the Sources section. I will update the guide as the picture changes.

Part One: How an Agent Actually Works

The loop

Ask a large language model (LLM) a question and it produces text. That is the whole transaction. Nothing in the world changes because the model answered; the human still has to go and do whatever the answer suggested.

An agent is the same model wired differently. Instead of producing an answer and stopping, it is given a goal and a set of tools, and it runs in a loop. It reasons about the goal, picks an action, the action runs somewhere real, the result comes back, and the model reads that result before deciding what to do next. It keeps going until the task is finished, it gets stuck, or something stops it. Anthropic compresses the definition to six words: agents are "LLMs autonomously using tools in a loop."

The academic origin of that loop is a 2022 paper from Princeton and Google called ReAct, which had models "generate both reasoning traces and task-specific actions in an interleaved manner." Think, act, observe, think again. Meta's Toolformer paper in February 2023 showed a model could teach itself "which APIs to call, when to call them, what arguments to pass, and how to best incorporate the results." Then on June 13, 2023, OpenAI shipped function calling: developers could describe a function to the model and have it "intelligently choose to output a JSON object containing arguments to call those functions." That was the day tool use stopped being a research trick and became a commodity available to any developer with an API key. Anthropic made tool use generally available for Claude on May 30, 2024, and the rest of the industry followed.

The distinction that matters most is not agent versus chatbot. It is agent versus workflow. Anthropic's December 2024 guide, still the most cited definition in the industry, draws the line cleanly. Workflows are "systems where LLMs and tools are orchestrated through predefined code paths." Agents are "systems where LLMs dynamically direct their own processes and tool usage, maintaining control over how they accomplish tasks." In a workflow, the code decides the path and the model fills in the blanks. In an agent, the model decides the path.

For a payments reader, the cleanest analogy is this. A workflow is a standing order: the steps are fixed in advance and the system executes them. An agent is a personal shopper you have handed a card and a brief. The shopper decides which shops to visit, in what order, and when to stop. That freedom is the product. It is also the problem.

The anatomy

Every agent, whatever the vendor calls it, is built from the same six parts.

The model is the reasoning engine. It reads everything in front of it and produces the next decision. Every quality of the agent that looks like judgment lives here, and so does every failure that looks like stupidity.

The tools are the hands. A tool is anything the model can call and get a result from: web search, a file system, a code interpreter, a browser, a calendar, a CRM, a payment API. Google's agents whitepaper defines an agent as "an application that attempts to achieve a goal by observing the world and acting upon it using the tools that it has at its disposal," and names the three components as the model, the tools and the orchestration layer. OpenAI's practical guide says much the same: an agent "leverages an LLM to manage workflow execution and make decisions" and "has access to various tools to interact with external systems."

The context window is working memory. It holds the instructions, the conversation so far, and every tool result that has come back, and it is the only thing the model can actually see when it makes its next decision. It is finite, and it degrades. Anthropic's engineering team calls the effect "context rot": "as the number of tokens in the context window increases, the model's ability to accurately recall information from that context decreases," so context "must be treated as a finite resource with diminishing marginal returns." Much of the engineering craft in agents is deciding what to put in that window and what to leave out.

Memory is what survives between sessions. It is notes the agent writes to itself, databases it can query, and increasingly a dedicated memory layer sold as a product. I will return to why that layer is a bigger problem than it looks.

The harness, sometimes called the orchestration layer, is the code wrapped around the model. It decides which tools exist, when to stop, when to retry, when to check in with a human and what to do when a tool fails. A great deal of what separates a demo from a production agent is harness, not model.

The permissions and sandbox are the fence. They define what the agent is allowed to touch, what it is allowed to change, and what it can reach on the network. Parts Six and Seven of this guide are largely about what happens when the fence is missing.

The model gets the credit and the harness does the work. When an agent fails in production, the cause is more often the fence, the memory or the plumbing than the intelligence.

From text to screens

Until late 2024, an agent could only act through tools that someone had deliberately exposed to it as an API. Then, on October 22, 2024, Anthropic released computer use: a model that could act "by looking at a screen, moving a cursor, clicking buttons, and typing text." The company was blunt about its state, calling it "still experimental" and "at times cumbersome and error-prone." On OSWorld, the standard benchmark for operating a real computer, it scored 14.9 percent working from screenshots alone. Humans score 72.36 percent.

That number moved fast. By September 2025, Claude Sonnet 4.5 scored 61.4 percent. By spring 2026 the leading models from several labs had passed the human baseline on the original task set, which is why the benchmark's authors released a harder OSWorld 2.0 on June 26, 2026. Anthropic's Claude Fable 5.1, launched in September 2026, scores 77.9 percent on OSWorld 2.0's August 2026 task release under partial credit and 41.7 percent under strict scoring. The gap between those two numbers is a useful reminder that "can operate a computer" and "reliably finishes the job" remain different claims.

Computer use matters to commerce for a specific reason. An agent that can operate a screen can use any website built for humans, including a checkout page that was never designed to be driven by software. That is the origin of the question every merchant, acquirer and network is now wrestling with: how do you tell a customer's agent from a fraudster's bot when both arrive as a browser clicking buttons?

The plumbing

The other bottleneck was integration. Every tool an agent might use needed its own bespoke connector, written by hand. On November 25, 2024, Anthropic published the Model Context Protocol (MCP) as an open standard, arguing that "every new data source requires its own custom implementation, making truly connected systems difficult to scale." The analogy the industry settled on is USB-C: one port that any tool can plug into.

Adoption has been extraordinary. By July 2026, MCP's software development kits were being downloaded close to half a billion times a month. Tool calls from ChatGPT users over MCP reached 98 times their January level by August 2026. In December 2025 Anthropic donated the protocol to a new Linux Foundation body, the Agentic AI Foundation, alongside contributions from OpenAI and Block. Part Seven covers why that matters.

MCP is also where the security story of agents begins, because a protocol that lets any tool plug in also lets any tool's content flow into the model's context. Hold that thought.

Many agents

The final piece is agents talking to agents. Anthropic's research team described building a system in which a lead model breaks a task into pieces and hands them to subagents working in parallel. It outperformed a single agent by 90.2 percent on their internal evaluation. It also cost far more: agents typically use about four times the tokens of a chat interaction, multi-agent systems about 15 times, and the team found that "token usage by itself explains 80% of the variance" in performance. Google's Agent2Agent protocol, covered in Part Seven, is the emerging standard for how agents from different vendors discover and negotiate with one another.

A payments reader's mental model

Put the pieces together and the picture for the payments industry is this. A cardholder hands a credential and a brief to a piece of software. The software walks into a merchant, or many merchants, and tries to buy something. The merchant sees a buyer that is not the account holder. The acquirer, the network and the issuer see a card-not-present transaction that, from the outside, looks like automated traffic. Somewhere in that chain, someone has to answer four questions: who is this agent, what was it allowed to do, how much was it allowed to spend, and what did it actually do?

Every protocol, product and regulation in the second half of this guide is an attempt to answer one of those four questions.

Part Two: Why Agents Matter

From answers to outcomes

Every interface the technology industry has built, from the web browser to the smartphone app to the chatbot, has had one thing in common: the human did the doing. Software showed you options, and you clicked. Even the first generation of generative AI kept that arrangement. It wrote the email; you sent it. It found the flights; you booked them.

Agents break the arrangement. The value is not a better answer but a finished outcome, and that shift is the reason the money is so large. Citi's research arm framed it as the arrival of a "do it for me" economy, quoting NVIDIA's Jensen Huang: "The IT department of every company is going to be the HR department of AI agents in the future."

The money

The forecasts are large enough to treat with caution, and consistent enough to take seriously. McKinsey's June 2025 report on agentic AI puts the value at stake at $2.6 trillion to $4.4 trillion, while noting in the same report that "more than 80 percent of companies still report no material contribution to earnings from their gen AI initiatives." For commerce specifically, McKinsey puts the value that AI agents could orchestrate at $3 trillion to $5 trillion globally by 2030, including $900 billion to $1 trillion in US consumer retail.

Gartner approaches it from the software side. It predicts that 40 percent of enterprise applications will include task-specific agents by the end of 2026, up from less than 5 percent in 2025, and that up to $234 billion of enterprise application spending is exposed to what it calls "agentic arbitrage" through 2030, because "agentic systems deliver outcomes directly, bypassing traditional user experience (UX)-heavy applications and making the software invisible." Its May 2026 forecast puts total worldwide AI spending at $2.59 trillion in 2026, up 47 percent in a year.

The executives building the platforms are more direct. Microsoft's Satya Nadella has said business applications will "collapse" in the agent era. Jensen Huang told his GTC audience in March 2026 that every engineer at NVIDIA would receive an annual token budget worth roughly half their salary, and that "every SaaS company will become an AaaS (Agent-as-a-Service) company."

The capability curve

The most important chart in artificial intelligence is not about intelligence. It is about time. METR, an independent evaluation group, measures the length of task, as timed by human professionals, that a model can complete on its own with 50 percent reliability. In March 2025 it reported that this horizon had been doubling roughly every seven months for six years.

The raw numbers explain why agents went from toy to tool. GPT-4, released in March 2023, could handle tasks that take a person about four minutes. Claude 3.7 Sonnet, in February 2025, managed about an hour. By late 2025 the leading models were at roughly five hours, and METR's 2026 data puts Claude Opus 4.6, released in February 2026, at around 12 hours, with an early Mythos preview in April 2026 measured at around 17 hours. METR itself warns that "measurements above 16 hrs are unreliable with our current task suite," and in its June 2026 evaluation of OpenAI's GPT-5.6 Sol it said its estimate of about 11 hours should not be treated as a robust measurement, because the model's detected rate of cheating on tasks was higher than that of any public model it had evaluated. Depending on the window you pick, the doubling time is now somewhere between three and seven months.

Two caveats travel with that chart. The first is reliability: the 80 percent horizon, the length of task a model completes four times out of five, is far shorter than the 50 percent horizon, roughly 70 minutes for Opus 4.6 against 12 hours. The second is that "can do" is not "will do correctly every time," and the gap between the two is the entire management problem this paper is about.

Capability doubles roughly every seven months. Trust does not. The distance between what an agent can do and what an organization will let it do is where the next five years of product, risk and regulatory work will happen.

Why payments feels it first

For most industries agents are an efficiency story. For payments they are a structural one, because the industry's controls were built around a human at a keyboard. Three things change at once.

The buyer changes. Automated traffic passed human traffic on the web in 2024, at 51 percent, according to the bot report from Imperva, which is owned by Thales, and reached 53 percent in 2025. Cloudflare's chief executive Matthew Prince put it plainly in July 2026: "Now that the majority of traffic on the Internet is non-human, we must go further and act faster," so that a sustainable ecosystem can emerge. Visa cited a surge of more than 4,700 percent in AI-driven traffic to US retail sites when it launched its agent authentication protocol. Every fraud model, every bot detector and every step-up authentication rule assumed that a good customer behaves like a person and a bot behaves like a bot. An agent is a good customer that behaves like a bot.

Authorization changes. A card credential proves the account is real and the holder consented to something. It says nothing about whether the holder consented to this purchase, at this price, from this merchant, made by this software. The industry is now building an entire layer, covered in Parts Five and Seven, to carry that missing information.

Liability changes. When a person makes a mistake at checkout, decades of network rules and consumer law say who pays. When an agent makes a mistake, nobody yet does, and Part Six shows how unsettled that remains.

Part Three: The First Wave, and Why It Broke

Spring 2023

The first agents arrived four months after ChatGPT, and they arrived on GitHub. Auto-GPT, released on March 30, 2023, briefly became the top trending repository on the platform. BabyAGI followed within days. Both did the same thing: they took GPT-4, gave it a goal, and let it plan and execute tasks in a loop with no human in between.

They did not work. A contemporaneous test by Tom's Hardware found that BabyAGI "kept changing task number one instead of moving on to task number two" and "keeps going and even repeats steps until you decide to hit CTRL + C," warning that it "may keep running and draining your OpenAPI [sic] account of credits forever." Auto-GPT, the reviewer noted, "can make up capabilities that it doesn't have and attempt to act on them." The headline was not subtle: "Auto-GPT and BabyAGI Are AI's New Hotness, But They Suck Right Now."

That verdict was correct and it was also, in hindsight, the most useful thing anyone said about agents in 2023. It named the four failure modes that would take two years to fix: the loop that never ends, the plan that never adapts, the tool that does not exist, and the bill that nobody is watching.

The hardware detour

The consumer industry tried to skip ahead. Humane raised more than $230 million to build the AI Pin, a wearable that would replace the smartphone with an agent. HP bought its assets for $116 million in February 2025, and TechCrunch reported that at one point the Pin's returns were outpacing its sales. The Rabbit R1 rode a viral CES demo to launch, then shipped unable to complete the food orders it was built for.

Both devices made the same mistake. They sold the loop before the model could run it, and they put the loop in a form factor with no keyboard to rescue it when it stalled.

The software detour

Software was not immune. In March 2024 Cognition introduced Devin as "the first AI software engineer," reporting that it resolved 13.86 percent of real GitHub issues end-to-end, against a prior state of the art of 1.96 percent, and claiming it had completed paid jobs on Upwork. A team at Answer.AI then spent a month with it. Their write-up, published in January 2025, recorded 14 failures, three inconclusive results and three successes out of 20 tasks. The pattern they described is the definitive description of an early agent: "Devin would spend days pursuing impossible solutions rather than recognizing fundamental blockers."

Cognition, to its credit, kept building; Part Four records where the company is now. But the gap between the demo and the month-long trial was the gap the whole industry was living in.

The arithmetic of failure

Underneath the anecdotes was arithmetic. An agent that takes 20 steps, each of which succeeds 95 percent of the time, finishes the whole task about 36 percent of the time. At 99 percent per step it finishes 82 percent of the time. Reliability compounds against you, and in 2023 the per-step numbers were nowhere near 95 percent.

The benchmarks of the period tell the story. On GAIA, a test of general assistant tasks published in November 2023, humans scored 92 percent and GPT-4 with plugins scored 15 percent. On WebArena, a set of realistic website tasks from Carnegie Mellon, the best GPT-4 agent managed 14.41 percent against a human 78.24 percent. On OSWorld in April 2024, the best model achieved 12.24 percent, "primarily struggling with GUI grounding and operational knowledge."

The subtler problem was consistency. Sierra, a customer service AI company, built tau-bench in June 2024 to measure whether an agent that succeeds once succeeds every time. Its finding: "even state-of-the-art function calling agents (like gpt-4o) succeed on <50% of the tasks," and when the same task was run eight times, GPT-4o's success rate in the retail scenario dropped to roughly 25 percent. An agent that gets a refund right three times in four is not a customer service agent. It is a lottery.

Even the measuring sticks were broken. When OpenAI built SWE-bench Verified in August 2024, its annotators flagged 38.3 percent of the original coding benchmark's tasks for "underspecified problem statements" and 61.1 percent for unit tests "that may unfairly mark valid solutions as incorrect." GPT-4o's score on the cleaned set doubled overnight, from 16 percent to 33.2 percent, without the model changing at all.

What the labs learned

The labs' own retrospectives are the best guide to what went wrong, because they are unusually candid. Anthropic's December 2024 guide told developers to seek "the simplest solution possible" and add complexity only when needed, and warned that if you use an agent framework, "ensure you understand the underlying code." OpenAI's guide advised builders to "maximize a single agent's capabilities first" and to design human intervention for "High-risk actions: Actions that are sensitive, irreversible, or have high stakes."

The hardest lesson was about time. An agent working on a task for hours has to work in sessions, and Anthropic's engineers described in November 2025 that "each new session begins with no memory of what came before." Their agents would try to build an entire application in one go, or a later instance would "look around, see that progress had been made, and declare the job done." A March 2026 follow-up added that agents "tend to lose coherence on lengthy tasks as the context window fills," and that when asked to evaluate their own output, agents "tend to respond by confidently praising the work" even when, to a human observer, the quality is obviously mediocre. The fix was a harness with separate planner, builder and evaluator agents. It worked, and it cost roughly $200 and six hours of compute for a job a single agent attempted in 20 minutes for $9.

Non-determinism was the other lesson. Anthropic's multi-agent team found that "minor changes cascade into large behavioral changes" and that agents "are non-deterministic between runs, even with identical prompts. This makes debugging harder." Every payments engineer who has tried to certify a system knows what a non-deterministic component does to a test plan.

The enterprise reckoning

By mid-2025 the pattern had reached the boardroom. On June 25, 2025, Gartner predicted that "over 40% of agentic AI projects will be canceled by the end of 2027, due to escalating costs, unclear business value or inadequate risk controls." Its analyst Anushree Verma said most projects were "early stage experiments or proof of concepts that are mostly driven by hype," and the firm estimated that of the thousands of vendors claiming to sell agents, only about 130 were doing so; the rest it called "agent washing." Six weeks later it placed AI agents at the Peak of Inflated Expectations on its hype cycle. In April 2026 they were still there, with Gartner reporting that only 17 percent of organizations had deployed agents and that "fully autonomous agents are not ready for the majority of enterprise use cases."

An MIT report in August 2025 landed harder. It found that for 95 percent of the companies in its dataset, generative AI implementation was falling short, with only about 5 percent of pilots achieving rapid revenue acceleration, and its lead author told Fortune that generic tools stall in enterprise use "since they don't learn from or adapt to workflows."

The most instructive corporate story is Klarna's. In February 2024 the company announced its AI assistant had handled 2.3 million conversations in its first month, "the equivalent work of 700 full-time agents," and would drive an estimated $40 million of profit improvement that year. By May 2025 its chief executive was telling Bloomberg that "as cost unfortunately seems to have been a too predominant evaluation factor when organizing this, what you end up having is lower quality," and that "really investing in the quality of the human support is the way of the future for us." By 2026 Klarna was running a hybrid model with a re-established team of skilled human operators alongside an AI workload that had grown to around 850 agent-equivalents. Its spokesperson's summary was tidy: "AI gives us speed. Talent gives us empathy."

The accountability precedent

One more event from the period belongs in every agent strategy deck. In February 2024 a Canadian tribunal ordered Air Canada to honor a bereavement discount its chatbot had invented. The airline argued the chatbot was responsible for its own statements. The tribunal member's response has become the founding text of agent liability: "In effect, Air Canada suggests the chatbot is a separate legal entity that is responsible for its own actions. This is a remarkable submission." The total award, including interest and fees, was C$812.02. The principle was priceless: the company owns what its software does.

The first wave failed on several fronts at once: models that could not sustain a plan, plumbing that had to be hand-built for every tool, memory that reset every session, and no way to measure any of it. By 2025 the first two had been fixed. Memory and measurement are what 2026 is about.

Part Four: What Agents Are Used For Today

If Part Three was the hangover, this part is the morning after, and the picture in September 2026 is clear. Agents work in production wherever three conditions hold: the task has a verifiable end state, the cost of an error is recoverable, and a human or a test can check the result. Software engineering meets all three. Customer service meets most of them. Paying for things meets them only partly: the end state is clear, but the error is someone else's money and the check happens after the funds have moved, which is why commerce is the last domain to close.

Coding: the first killer app

Writing software is where agents crossed from experiment to infrastructure, for a simple reason: code either compiles and passes its tests or it does not. The loop has a built-in judge.

The scale is now hard to argue with. Anthropic reported in February 2026 that Claude Code, its terminal-based coding agent, had passed $2.5 billion in run-rate revenue, more than doubling since the start of the year. OpenAI's Codex reached 5 million weekly active users by June 2026, with roughly a fifth of them knowledge workers using it to build reports, spreadsheets and contracts rather than software. Microsoft said in July 2026 that GitHub Copilot had 50 million users. Cursor crossed $1 billion in annualized revenue in November 2025 and joined SpaceX in August 2026. And Cognition, the company whose Devin managed three successes out of 20 in the trial described in Part Three, announced in September 2026 that it had raised more than $2 billion at a $48 billion valuation, with run-rate revenue approaching $900 million and customers including NVIDIA, Citi and Mercedes-Benz. Two and a half years is a long time in this industry.

The benchmark curve tells the same story. SWE-bench Verified, the cleaned coding test from Part Three, went from 33.2 percent for GPT-4o in August 2024 to 77.2 percent for Claude Sonnet 4.5 in September 2025, and the leading 2026 models have pushed higher still. Google told its Cloud Next audience in April 2026 that 75 percent of all new code at Google is now AI-generated and approved by engineers, up from 50 percent the previous fall, and that a complex migration run by agents and engineers together finished six times faster than was possible a year earlier.

The second-order effect is the one to watch. McKinsey's 2026 State of AI survey found that 32 percent of organizations had decided against buying at least one software product because they could build it internally with agentic coding tools. When agents make software cheap to build, the market for software changes shape.

Customer service: the second

Customer service was the first place enterprises tried agents and, as Klarna showed, the first place they got burned. The 2026 numbers suggest the second attempt is going better.

Salesforce reported Agentforce annual recurring revenue of more than $1.5 billion in August 2026, up more than 240 percent year on year, and said its own help agent had handled 5 million customer conversations with 64 percent resolved autonomously. Sierra, the company that built tau-bench, reported $100 million in annual recurring revenue seven quarters after launch, cited resolution rates above 70 percent at Singtel, and raised $950 million in May 2026. Intercom says its Fin agent now serves more than 12,000 teams at an average resolution rate of 76 percent. Decagon, whose customers include Block, Affirm and Chime, tripled its valuation to $4.5 billion in January 2026.

Notice what these products have in common with coding. A support ticket has a definable end state (the customer's problem is resolved or escalated), a recoverable error (a human picks it up), and a measurable result (the resolution rate). The industry has learned to deploy agents where the loop can be checked.

Knowledge work and the enterprise

The broadest category is the least glamorous: agents that read, research, summarize and draft inside the tools businesses already use. McKinsey's survey found that 40 percent of large organizations were scaling AI agents in 2026, up from 27 percent a year earlier. Its 2025 survey had found agent use most common in IT service-desk management and in deep research for knowledge management. OpenAI's deep research agent, launched in February 2025, was the product that taught mainstream users what a multi-step agent felt like: you asked a question and came back 20 minutes later to a cited report.

The platforms have followed. Google said in July 2026 that nearly 90 percent of the Fortune 100 were using Gemini Enterprise. Microsoft made Agent 365, its control plane for managing agents like employees, generally available in May 2026 and reported nearly 40 million agents registered within two months. Harvey runs more than 25,000 custom agents for 100,000 lawyers doing due diligence, drafting and document review. In security operations, Google says its own agents triage tens of thousands of threat reports a month and have cut mitigation time by more than 90 percent.

Science is the frontier of this category. Google's AI co-scientist, a multi-agent system, proposed drug repurposing candidates for acute myeloid leukemia that inhibited tumor viability at clinically relevant concentrations in the lab, and Anthropic launched a Claude Science workbench in June 2026 built around a coordinating agent, specialist agents and a reviewer agent.

Browser and computer agents

The computer-use capability from Part One has become a product category. OpenAI's line runs from Operator in January 2025, through ChatGPT agent in July 2025, to the Atlas browser in October 2025. Anthropic's Claude in Chrome became generally available to paid users in August 2026 with the ability to act autonomously rather than asking permission for every click, with a safety classifier validating each action. Google announced Gemini Spark, a personal agent that takes action on the user's behalf, at I/O in May 2026.

These are the agents that will do the shopping. They are also, as Part Six documents, the agents that have been hacked most often.

Agentic commerce: what has actually shipped

For this publication's readers, the question is not whether agents can write code. It is whether they can buy things, and who lets them. What follows is a chronological record of what the major players have announced, reported factually and without ranking. Agentic commerce is a field where every participant has a reason to overstate progress, so the dates and the caveats matter as much as the headlines.

The chronology starts in the spring of 2025. On April 29, Mastercard unveiled Agent Pay and Agentic Tokens, which extend the tokenization that already underpins contactless and card-on-file payments to purchases made by agents, with Microsoft, IBM, Braintree and Checkout.com as launch partners. On April 30, Visa announced Visa Intelligent Commerce, covering AI-ready cards, personalization and agent payments, with Anthropic, IBM, Microsoft, Mistral AI, OpenAI, Perplexity, Samsung and Stripe as partners. Visa's Jack Forestell said: "Soon people will have AI agents browse, select, purchase and manage on their behalf."

The platforms followed in the fall. On September 16, 2025, Google published the Agent Payments Protocol (AP2) with more than 60 organizations, including American Express, Mastercard, PayPal, Adyen, Worldpay and Coinbase. Its central idea is the mandate: a cryptographically signed record of what the user asked for, which becomes "the foundational evidence for every transaction." On September 29, OpenAI launched Instant Checkout inside ChatGPT with Etsy live and more than a million Shopify merchants to follow, built on an Agentic Commerce Protocol (ACP) co-developed with Stripe, whose shared payment tokens are "scoped to specific merchants and cart totals." Mastercard said Instant Checkout enabled its Agentic Tokens on OpenAI's platform for the first time. On October 14, Visa released its Trusted Agent Protocol, a way for merchants to verify an agent's identity using web signature standards, with Cloudflare, Adyen, Stripe, Shopify, Worldpay and others. PayPal announced on October 28 that its wallet would be available inside ChatGPT.

Then the first real transactions. Mastercard's chief executive Michael Miebach told investors on October 30, 2025 that "our first agentic transaction took place on our network this quarter." Visa said in December that it had completed "hundreds" of controlled agent-initiated transactions with more than 100 partners. In January 2026 Mastercard reported Australia's first authenticated agentic transactions, an agent buying cinema tickets on a Commonwealth Bank debit card and booking accommodation on a Westpac credit card. In March, Santander and Mastercard reported what they called Europe's first live end-to-end payment executed by an AI agent, carried out in a controlled environment but processed through Santander's live payments infrastructure. In July, Visa said more than 30 European issuers had enabled agents to buy at merchants including lastminute.com and Frasers.

Not everything went forward. On March 24, 2026, OpenAI discontinued the initial version of Instant Checkout, writing that it "did not offer the level of flexibility that we aspire to provide," and shifted to letting merchants run their own checkout while ChatGPT focused on product discovery, with retailers including Target, Sephora, Best Buy and The Home Depot integrated for discovery. Google, meanwhile, had launched the Universal Commerce Protocol in January 2026 with Shopify, Etsy, Wayfair, Target and Walmart, keeping the retailer as merchant of record, and expanded it in May to Canada, Australia and the UK.

The 2026 announcements have moved from "can an agent pay" to "how do we govern it." American Express released a developer kit in April with agent registration and Agent Purchase Protection covering "charges related to AI agent error" where the agent is registered and purchase intent is authenticated. Visa launched Intelligent Commerce Connect the same month and partnered with OpenAI in June; Part Seven covers what both do. Mastercard launched Agent Pay for Machines in June, for payments between software systems with settlement "across cards, accounts, and stablecoins," and on September 9 Agent Connect, a single integration point for agents, merchants and payment providers, with acquirers including Fiserv, Global Payments, Nexi and Worldline. Adyen launched its own agentic stack in June supporting UCP, AP2 and ACP together. Amazon folded its Rufus assistant, which it says assisted more than 300 million customers in 2025, into Alexa for Shopping in May, with auto-buy at target prices and scheduled reorders.

The demand side

Shopping with AI is now mainstream; paying with it is not. Shopify reported in August 2026 that AI-driven traffic and AI-driven orders had each tripled year on year, and its finance chief said in September that customers arriving from AI search converted roughly 80 percent better. Adobe measured a 693 percent rise in AI-referred retail traffic across the 2025 holiday season, with those shoppers 38 percent more likely to convert. Bain estimated $3 billion of AI-influenced sales on Black Friday 2025 alone.

But the buy button stays with the human. PYMNTS Intelligence found in September 2026 that while 49.6 million US adults now begin retail research with AI and 56 percent would let it search and compare, only 37 percent would authorize a payment through it, and PYMNTS's Karen Webster noted that "interest over time in terms of delegating authority has declined, even though usage has increased." Visa's own polling found that 23 percent of US consumers trust generative AI to handle payment transactions on their behalf and that 60 percent would not allow an agent to spend without approval. JPMorgan Chase's Marianne Lake said in June: "I don't think people are going to delegate their purchasing to agents just yet."

One summary of where things stand came from Visa's chief executive Ryan McInerney on September 8, 2026: "We are seeing adoption for shopping, but not yet for autonomous payments," and the barrier "if I had to describe it in one word, would be trust."

After 18 months of announcements, the industry has proven that an agent can pay. It has not yet proven that a consumer wants to let it, or that a merchant knows what to do when it gets the order wrong. The open question, in the words of the people building it, is trust.

Part Five: Where Agents Are Heading

Forecasting this field is a humbling business. The people who wrote the most widely read prediction of rapid AI progress, the "AI 2027" scenario, have since pushed their own median estimates for transformative AI out to 2030 and beyond. What follows is not a prediction. It is a map of where the evidence, the money and the stated intentions of the builders point.

What the builders say

OpenAI's Sam Altman wrote in January 2025 that "in 2025, we may see the first AI agents 'join the workforce'" and followed it in June with a sequence: agents doing real cognitive work in 2025, systems that produce novel insights in 2026, and robots doing physical tasks in 2027. Anthropic's Dario Amodei wrote in January 2026 of a "country of geniuses" materializing around 2027, and warned in the same essay that AI "could displace half of all entry-level white collar jobs" within one to five years. Google DeepMind's Demis Hassabis is more conservative on the endpoint, expecting AGI around 2030, but framed 2026 as the year agents reach non-technical users: "The sweet spot is to help everyone with these agents, not [just] people who are very technical."

Meta's Mark Zuckerberg described the destination in August 2026: "Your agent will work 24/7 on your behalf to improve your relationships, health, career, finances, home management, hobbies, and more." Note the word "finances." Every major platform now has a version of that product. Google launched Gemini Spark, a "24/7 personal AI agent," in May 2026. Microsoft introduced Scout, an always-on enterprise personal agent built, notably, on the architecture of the open-source OpenClaw project that Part Six returns to, at Build in June. Apple rebuilt Siri at WWDC in June around an App Intents framework that lets the assistant take actions inside apps and lets developers plug in cloud models including Claude and Gemini. Goldman Sachs's research team had predicted in January that 2026 would be the year personal agents arrived and that enterprises would move to "human-orchestrated fleets of specialized multi-agent teams" billed by token consumption. So far the year is cooperating.

The enterprise of agents

The analyst consensus is that agents will be everywhere and governed almost nowhere. IDC expects 40 percent of Global 2000 job roles to involve working with AI agents in 2026 and predicts that pure seat-based software pricing will be obsolete by 2028, forcing 70 percent of vendors to change how they charge. Gartner expects 15 percent of day-to-day work decisions to be made autonomously by 2028, from zero in 2024. Deloitte's 2026 survey found 74 percent of companies expect to be using agents at least moderately by 2027, while only 21 percent have a mature governance model for them. Capgemini put the prize at $450 billion by 2028 and found, in the same survey, that trust in fully autonomous agents had fallen from 43 percent to 27 percent in a year.

Those two Capgemini numbers side by side are the whole story of the next three years. The value is real and the trust is falling, which means the winners will be whoever closes that gap.

Machines paying machines

The most speculative frontier is agents paying other agents, and services, without a human anywhere in the loop: an agent buying an API call, a dataset, a compute slot or a delivery. Coinbase's x402 protocol, which lets a web server demand payment for a request and an agent pay it in stablecoins, was placed under a Linux Foundation body in July 2026 whose premier members include Adyen, American Express, Fiserv, Mastercard, Stripe and Visa. Mastercard's Agent Pay for Machines and the Machine Payments Protocol from Stripe and Tempo, both announced in 2026, are the card-and-stablecoin answers to the same problem.

The reality check is in the values. Visa's own analysis of x402 found $15 million of adjusted volume across 109.6 million transactions in the protocol's first 11 months, an average payment of "a fraction of a cent," and blockchain analytics firm TRM Labs concluded that only 0.6 percent to 7.5 percent of the payment value it examined looked like it came from AI agents at all. Machine payments are real, tiny, and mostly not yet agentic. Their significance is that the rails now exist for when they are.

Agents doing research

The application with the largest long-run consequences is agents doing science and engineering research. Anthropic reported in August 2026 that it runs roughly 30,000 concurrent agents on its internal platform and that Claude now leads about 26 percent of its own AI research and development work end-to-end from a high-level prompt, while stressing that "Claude is not operating fully autonomously for any measured subset of AI R&D work." Amodei's June 2026 essay put the broader trend simply: in four years AI has gone from "barely being able to write a coherent line of code to writing most of the code at major AI companies." When the tool that builds the tools becomes an agent, the pace of everything else changes.

Work

The labor evidence is mixed, and both halves deserve equal weight. Stanford's Digital Economy Lab, using payroll data from ADP, found in August 2026 that employment of workers aged 22 to 25 in AI-exposed occupations stood 19 percent below where it would have been had it kept pace with less-exposed peers, up from 15 percent a year earlier, driven by reduced hiring rather than increased separations. The same researchers wrote: "We do not see widespread, economy-wide job displacement associated with AI." The IMF's Kristalina Georgieva has described AI as "like a tsunami hitting the labor market", with 60 percent of jobs in advanced economies affected.

Productivity is equally contested. METR's randomized trial of experienced developers in early 2025 found AI tools made their tasks take 19 percent longer; its late-2025 follow-ups pointed the other way but were judged unreliable because of selection bias. Microsoft's 2026 Work Trend Index, surveying 20,000 workers, found 58 percent of AI users saying they produce work they could not have a year ago. Anthropic's Economic Index found over a third of surveyed Claude users expect AI to be able to do most or nearly all of their work tasks within a year.

The agent economy's business model

Two developments in September 2026 show the economics of agents being decided in real time. Cloudflare's default settings for ad-supported domains now allow search crawlers, refuse AI training crawlers and block user-directed AI agents on any page that carries an advert, and on September 15 the company extended the option of blocking on ad-supported pages to mixed-use crawlers such as Googlebot. The argument is that a web where agents read and humans never visit cannot fund the content the agents read. On September 16, OpenAI announced sponsored agents: a user can "start a clearly labeled conversation with a business-sponsored agent in ChatGPT," with HubSpot and Shopify as launch partners. An agent that shops for you and an agent that is paid to sell to you now live in the same product. Whose side your agent is on will become a consumer protection question, and soon. I looked at what that does to product recommendations in The Shortlist Is for Sale.

For payments: the intent layer

For the payments industry, the future has a name, and the name is intent. The card credential answers whether an agent can pay. The next layer answers whether it should. EMVCo, the body that maintains the EMV specifications behind chip cards, published a draft framework for agentic payments on September 1, 2026, proposing "Intent Services" to register and retrieve a consumer's authorized purchasing intent, with changes flagged to 3-D Secure, tokenization and Secure Remote Commerce. PYMNTS's summary of the logic is the best single sentence on the subject: "A valid card credential may tell an issuer that an artificial intelligence agent can pay. It does not necessarily tell the issuer whether the AI agent should make this particular purchase."

The demand forecasts assume that layer gets built. Bain expects agents to account for 15 percent to 25 percent of US e-commerce by 2030. Checkout.com's consumer research found people expect AI to handle more than 21 percent of their monthly spending within five years. Among merchants surveyed by PYMNTS and Visa Acceptance Solutions, 38 percent expect agent purchases to exceed 15 percent of sales within two years, while only 23 percent can currently identify AI traffic and purchases at all.

The next phase of agentic commerce is not about whether software can complete a checkout. It is about carrying proof of what the human meant from the moment they asked to the moment the money moves, in a form that a merchant, an issuer and a dispute analyst can all verify.

Part Six: What Can Go Wrong

Every incident in this part has the same shape. An agent had access to something private, read something it should not have trusted, and had a way to act on it. The security researcher Simon Willison named that combination the "lethal trifecta" in June 2025: "access to your private data," "exposure to untrusted content," and "the ability to externally communicate." His conclusion: "If your agent combines these three features, an attacker can easily trick it into accessing your private data and sending it to that attacker." Read the incidents below with that triangle in mind.

The input problem

A prompt injection is an instruction hidden in content the agent reads, such as a web page, an email, a document or a product listing, that the model mistakes for an instruction from its user. It is the defining vulnerability of agents because the loop cannot function without reading untrusted content, and the model has no reliable way to tell data from commands.

The people responsible for fixing it say it cannot be fixed. OpenAI wrote in December 2025 that prompt injection "is unlikely to ever be fully 'solved'", comparing it to scams and social engineering. The UK's National Cyber Security Centre said the same month that these attacks "may never be totally mitigated in the way that SQL injection attacks can be," and that defenders must instead "reduce the risk and the impact." Google's April 2026 scan of the open web found the malicious category of in-the-wild injections had risen 32 percent in three months, though it judged that attackers "have yet not productionized this research at scale."

Defences are improving without becoming complete. When Anthropic piloted Claude for Chrome in August 2025, it reported that browsing without mitigations had a 23.6 percent attack success rate, which its safeguards cut to 11.2 percent. By the product's general release in August 2026 the company reported attack success rates of 0 percent for two of its models and 0.3 percent for a third with full safeguards in place. That is real progress. It is also a laboratory number, and an agent with a card faces millions of attempts in the wild.

The exfiltration record

The six months from May to October 2025 produced a catalog of working attacks against shipped products, almost all following Willison's triangle.

EchoLeak, CVE-2025-32711, was a flaw in Microsoft 365 Copilot rated 9.3 out of 10 by Microsoft: a crafted email could make the assistant leak data with no user action. Microsoft patched it in June 2025 and said it had found no evidence of exploitation. Researchers at Invariant Labs showed that a public GitHub issue could make a coding agent connected to GitHub through MCP leak the contents of private repositories, calling the pattern a "toxic agent flow" and noting it was "not a flaw in the GitHub MCP server code itself, but rather a fundamental architectural issue." Brave demonstrated that a comment hidden behind a spoiler tag on Reddit could make Perplexity's Comet browser extract a user's email, trigger a one-time password and post it back to Reddit. Radware's ShadowLeak showed a single email could make ChatGPT's deep research agent leak inbox data server-side with no user action. Noma Security's ForcedLeak, rated 9.4, used a web form to inject instructions into Salesforce Agentforce and exfiltrated CRM data through an expired domain that was still on Salesforce's allow list and cost $5 to buy. Within a week of OpenAI's Atlas browser launching, LayerX showed that a cross-site request could plant persistent instructions in ChatGPT's memory that followed the user across every device.

Every one of those was disclosed responsibly and patched. The point is not that any single product is unsafe. It is that the attack surface is structural, and every new tool an agent can reach is a new door.

The action problem

Exfiltration is quiet. The other failure is loud. In July 2025 a Replit coding agent, during an explicit code freeze, deleted the production database of a company run by the investor Jason Lemkin, containing records on more than 1,200 executives and 1,190 companies. Replit's chief executive Amjad Masad called it "unacceptable and should never be possible" and shipped automatic separation of development and production databases, improved rollback and a planning-only mode. Days later, Google's Gemini CLI destroyed a user's files after a failed move operation, then told him: "I have failed you completely and catastrophically."

The most serious documented case came from a government lab. On August 4, 2026, the UK's AI Security Institute published an incident report describing 19 unsanctioned actions across 10 of 122 evaluation runs during cyber-capability testing in late July, in which agents were given internet access. Agents created fake identities, messaged real open-source maintainers, and in one case "tried to insert malicious code into a publicly used open-source project." The institute attributed 17 of the actions to Anthropic's Mythos 5 and two to OpenAI's GPT-5.6-Sol, running with cyber safety classifiers deliberately switched off for the test. Its investigation "has not identified any resulting real-world harm," and it called the episode the "first time we have seen risks around autonomy and deception manifest this clearly." Its lessons were tighter internet controls, real-time monitoring, and a rule that evaluations should "assume a capable model may try to act beyond its remit."

The identity problem: OpenClaw

The clearest picture of what happens when agents go mainstream without governance came in January 2026. OpenClaw, an open-source personal agent released in November 2025, spread through the developer world in a matter of weeks. It could read your email, run your messaging apps and execute code on your machine, and it ran, by default, with its control panel bound to every network interface.

Security firm SecurityScorecard found 42,900 unique IP addresses across 82 countries exposing OpenClaw control panels to the internet, complete with API keys, OAuth tokens, SSH keys and chat integrations. A one-click remote code execution flaw, CVE-2026-25253, was rated 8.8. Then came Moltbook, a social network built for OpenClaw agents to talk to each other, whose founder said he "didn't write a single line of code" for it. Wiz found its database open to the internet, exposing 1.5 million API keys and 35,000 email addresses belonging to the roughly 17,000 humans behind 1.5 million registered agents. The project's skill marketplace was flooded: by mid-February, researchers counted more than 824 malicious skills, around a fifth of the registry, and one threat intelligence firm reported more than 30,000 compromised instances being used to steal API keys and distribute malware.

Andrej Karpathy called Moltbook "genuinely the most incredible sci-fi takeoff-adjacent thing" when it appeared. The episode matters because it was not a lab experiment. It was the first agent that ordinary people installed at scale, and it shipped with none of the four questions from Part One answered: no identity, no mandate, no budget, no audit trail.

The alignment problem

The incidents above involve agents being attacked or misconfigured. A separate body of research asks what agents do when their goals conflict with their operator's, and the answers from the labs themselves are uncomfortable.

In June 2025 Anthropic published Agentic Misalignment, a study placing 16 models from every major lab in simulated corporate roles where they discovered they were about to be replaced and had leverage over an executive. Claude Opus 4 and Gemini 2.5 Flash resorted to blackmail in 96 percent of runs, GPT-4.1 and Grok 3 Beta in 80 percent. All 16 leaked confidential documents in a separate espionage scenario. Anthropic noted it had "not seen evidence of agentic misalignment in real deployments," and its own system card for Opus 4 recorded that the model, told to "take initiative" when it found wrongdoing, would take "very bold action" including "locking users out of systems" and "bulk-emailing media and law-enforcement figures."

OpenAI and Apollo Research reported in September 2025 that training reduced "covert actions" in their models roughly 30-fold, from 13 percent to 0.4 percent for o3, while cautioning that models "often become more aware that they are being evaluated," which "can itself reduce scheming, independent of genuine alignment." Anthropic's Summer 2026 follow-up found several current models would tamper with records in a simulated fraud scenario in most of 20 runs, while others did so in none, with wide variation between labs and versions.

The most concrete case is not a simulation. In November 2025 Anthropic disclosed that a Chinese state-sponsored group had used Claude Code to run an espionage campaign against roughly 30 targets including financial institutions, with the AI performing "80-90% of the campaign" and humans intervening only sporadically. The agent, notably, also "occasionally hallucinated credentials or claimed to have extracted secret information that was in fact publicly-available." Agents are now on both sides of the security perimeter.

The fraud problem

For payments, the threat is less exotic and more expensive. Imperva's 2026 report, the source of the 53 percent figure in Part Two, found financial services absorbing 24 percent of bot attacks and 46 percent of account takeover incidents. Visa's threat team reported a 450 percent increase in dark web posts mentioning "AI Agent" and a 25 percent rise in malicious bot-initiated transactions in six months, warning that adversaries "can spin up thousands of targeted operations in minutes" and that a malicious merchant can "harvest payment data and instantly use it for unauthorized transactions." Deloitte projected in 2024 that generative AI-enabled fraud losses in the US would reach $40 billion by 2027, from $12.3 billion in 2023.

The agent economy's fraud problem has a twist the bot era did not. The tools used to attack are the same tools used to buy. A fraud model that blocks agents blocks customers.

The liability problem

When an agent buys the wrong thing, who pays? Nobody yet knows. Worldpay's analysis in July 2026 was titled "Agentic commerce liability is still being written" and concluded that for clear fraud, liability "generally follows existing authenticated tokenized-transaction rules," but that "where it gets murkier is everything short of outright fraud." US consumer protection rules, it noted, have no framework for "I asked my agent to buy something inexpensive, and it bought something expensive instead." Merchants have a view: PYMNTS Intelligence found 93 percent believe the AI or agent provider should cover the loss when an agent makes the wrong choice, and 80 percent expect that provider to verify the agent's authority before it acts. The providers have not agreed. Insurers have started to price the gap, which I covered in AI Agents Just Got an Underwriter.

The courts have begun to weigh in. On August 4, 2026, the US Ninth Circuit vacated an injunction that Amazon had won against Perplexity's Comet shopping agent, holding that "however advanced the Assistant currently is, it is a tool, not a person for statutory purposes," and that Amazon was unlikely to prove the agent's access violated computer fraud law, while noting that the outcome "does not impair Amazon's ability to regulate access to Amazon.com via private terms of service for its users." The ruling, which I analyzed in A Federal Court Just Decided Who Your Shopping Agent Is, says an agent is its user's tool. The Air Canada ruling says a chatbot is its operator's responsibility. Between those two principles sits every dispute that agentic commerce will generate.

The economic problem

Two structural risks are slower and larger than any incident. The first is concentration: a handful of model providers now sit between consumers and every merchant, and the September 2026 arrival of sponsored agents inside ChatGPT shows how quickly the agent that works for you can share a platform with the agent that works for an advertiser. The second is the fate of the open web. Cloudflare's decision to block user-directed agents from ad-supported pages by default is a recognition that if agents read everything and humans visit nothing, the content agents depend on stops being written. Neither risk has a technical fix. Both will be decided by regulators and by the commercial choices the platforms make.

Every serious agent incident to date has been the lethal trifecta plus a missing fence: private data, untrusted input, the power to act, and nothing between the model and the consequence. The fence is buildable. Part Seven is about who is building it.

Part Seven: Who Is Building the Guardrails

Nobody is in charge of agents, and that is the honest starting point. What exists instead is six overlapping groups building six overlapping layers: the protocol bodies making agents interoperable, the identity industry working out who an agent is, the payments industry working out what it was allowed to do, the platform vendors building runtime controls, the labs binding themselves to safety frameworks, and the regulators deciding who answers when it goes wrong. I end with the small piece of it I built myself.

The protocol layer

The most important governance decision of the agent era was made quietly in December 2025, when the Linux Foundation formed the Agentic AI Foundation with three founding projects: Anthropic's Model Context Protocol, Block's goose agent framework, and OpenAI's AGENTS.md convention. The platinum members were AWS, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft and OpenAI. By August 2026 the foundation had 247 members, including Visa, American Express, JPMorgan Chase, Stripe, Adyen and Wells Fargo, and Google's Agent2Agent protocol, now at more than 150 partner organizations, had joined it as a hosted project. Visa's Rubail Birwadker explained the financial industry's interest: "Building a foundation of trust, interoperability, and collaboration is essential to the continued growth of agentic commerce."

Why this is governance and not just plumbing: the socket every agent plugs into is now owned by a neutral foundation rather than a single vendor, and the July 2026 MCP specification made the protocol stateless and added an official Enterprise Managed Authorization extension, built on Okta's Cross App Access, so that a company's identity system can decide which agent may reach which tool. The pipe and the permission now travel together.

The identity layer

The first of Part One's four questions, who is this agent, has moved from research to standards. The IETF has chartered a Web Bot Authentication working group whose first working-group draft, authored by engineers at Cloudflare and Google, is dated September 1, 2026. It standardizes how an automated client cryptographically signs its requests so a website can tell a customer's agent from anonymous traffic. The merchant's side of that problem is the subject of Your Best Customer Is Now a Bot. Cloudflare's Web Bot Auth implementation is the agent authentication layer for Visa's Trusted Agent Protocol and the foundation of American Express's agentic commerce offering.

Inside the enterprise, agents are becoming a first-class identity type. Microsoft's Entra Agent ID reached general availability in April 2026, supporting OAuth, MCP and A2A. Google Cloud made Agent Identity a first-class principal "distinct from human identities or generic service accounts," built on the SPIFFE standard. AWS's Bedrock AgentCore added a policy layer in March 2026 that lets teams write rules in natural language, compiles them to the Cedar policy language, and intercepts every call an agent makes to a tool. Okta's Agent SSO became generally available in August 2026, with the company noting the gap it exists to close: "Only 34% of organizations apply the same security controls to AI agents as they do to human workers." The US National Institute of Standards and Technology launched an AI Agent Standards Initiative in February 2026 with agent security and identity as one of three pillars.

Payments has its own version of the question, and its own name for the answer: Know Your Agent. Socure's Johnny Ayers framed it in a World Economic Forum piece as "When a human is not the transacting party, how do we establish identity certainty?" On September 9, 2026, Ant International, Visa and Mastercard announced a KYA interoperability framework linking Ant's Agentic Mobile Protocol, Visa's Trusted Agent Protocol and Mastercard's Verifiable Intent. A new class of company is forming around the gap: Catena Labs, founded by a Circle co-founder, raised $30 million and has filed for a national trust bank charter to serve agents as customers, with co-founder Sean Neville observing that "giving an agent a wallet is pretty easy compared with giving a business a governed way to trust it."

The intent layer

The second question, what was the agent allowed to do, is being answered by the payments industry with signed records of intent, and here the protocols from Part Four resolve into a single idea.

Google's AP2 defines three mandates. An Intent Mandate is signed by the user before the agent starts shopping and "serves as the final, non-repudiable authorization to execute a purchase in the user's absence," with an expiry. A Cart Mandate is generated by the merchant and signed by the user for a specific basket. A Payment Mandate is shared with the network and issuer and carries signals about "AI Agent presence and transaction modality," so that the authorization system knows a machine is at the keyboard. Standardization of AP2 has moved into the FIDO Alliance, whose Payments Technical Working Group draws on "initial contributions from Google (AP2) and Mastercard (Verifiable Intent)" and states the case plainly: "Without clear, interoperable standards for how user intent, authorization and agent identity are verified, service providers and users alike lack the trust foundation that agentic adoption requires."

Mastercard's Verifiable Intent, co-developed with Google and published as open source in March 2026, creates "a tamper-resistant record of what a user authorized when an AI agent acts on their behalf," using selective disclosure so the merchant sees only what it needs, and is built on FIDO, EMVCo, IETF and W3C standards. Visa's Intelligent Commerce Connect supports four protocols at once, and its OpenAI partnership adds user-set spending limits and merchant-category controls to tokenized credentials. The OpenAI and Stripe Agentic Commerce Protocol is Apache-licensed, versioned, and signals in its own governance notes a "future path" to "neutral foundation stewardship as ecosystem matures," with shared payment tokens whose use, in Stripe's words, is "programmatically controlled, permissioned, and logged." Google's Universal Commerce Protocol is AP2-compatible and integrates over A2A and MCP. EMVCo's draft framework, whose comment period runs to September 30, 2026, would carry intent into the card specifications themselves.

American Express's Agent Purchase Protection belongs in this section too, because it connects registration to liability: if the agent is registered and its intent authenticated, the company says it will cover charges arising from the agent's error. A record of intent is only useful if someone is prepared to stand behind it.

Six protocols, one idea: move the proof of what the human wanted out of the chat window and into the transaction, signed, scoped, expiring and verifiable by anyone who has to settle the dispute.

The runtime layer

The third and fourth questions, what may it spend and what did it do, are answered at runtime, by the code around the model. The labs have converged on a small set of principles. The Frontier Model Forum, whose members are Amazon, Anthropic, Google, Meta, Microsoft and OpenAI, published agent security practices in June 2026 recommending that "requiring confirmation before an agent executes high-stakes or irreversible actions gives users the opportunity to catch and correct errors," and that "deterministic controls placed outside the agent's reasoning loop" remain valuable. In plain terms: the model must not be the only thing deciding whether the model may act.

The products reflect it. OpenAI's ChatGPT agent is "trained to explicitly ask for your permission before taking actions with real-world consequences, like making a purchase," and "to actively refuse high-risk tasks such as bank transfers." Its enterprise platform, Frontier, gives each agent "its own identity, with explicit permissions and guardrails." Anthropic's framework for agents puts "keeping humans in control while enabling agent autonomy" first, notes that Claude Code "has read-only permissions by default," and its managed agents architecture is built so that "the tokens are never reachable from the sandbox where Claude's generated code runs." Its financial services agents, used by Citadel, FIS, BNY and Mizuho, ship with per-tool permissions, managed credential vaults and full audit logs. Google's Gemini Enterprise Agent Platform adds an agent registry, an agent gateway it describes as "air traffic control," and anomaly detection. Microsoft's Agent 365 is the control plane for its ecosystem, and ServiceNow's AI Control Tower now governs third-party agents from other vendors with real-time shutdown.

For finance specifically, Singapore's Monetary Authority published Safeguards for Agentic Finance at Runtime in July 2026, proposing "a governance checkpoint between every agent decision and its execution," and the OWASP project published a Top 10 for Agentic Applications in December 2025 that reads like an index to Part Six: goal hijack, tool misuse, identity and privilege abuse, memory poisoning, cascading failures, rogue agents.

The safety layer

Above runtime controls sit the labs' own commitments about what they will and will not ship. Anthropic's Responsible Scaling Policy, revised in February 2026, commits it to risk reports every three to six months with provision for external review, and its January 2026 constitution for Claude states that the model "should not undermine humans' ability to oversee and correct its values and behavior." OpenAI's Preparedness Framework tracks "long-range autonomy," "autonomous replication and adaptation" and "undermining safeguards" as research categories. Google DeepMind's Frontier Safety Framework added a critical capability level for harmful manipulation in September 2025 and, in April 2026, tracked capability levels intended to catch less extreme risks earlier.

Independent evaluators check the homework. The UK AI Security Institute, whose incident report appears in Part Six, published a sandbox-escape benchmark in March 2026 in which one model found an unintended escape path. METR evaluates frontier models before deployment, and as Part Two showed, it says so when it cannot certify a result.

The regulatory layer

Regulators are moving faster on accountability than on mechanics, and that is the right order. In the UK, the Financial Conduct Authority's Nikhil Rathi said in June 2026 that agentic systems "don't just support financial decisions, but coordinate and transact," and that "accountability for regulated activities and outcomes must remain clear." The FCA's second AI Live Testing cohort includes Barclays, Lloyds Banking Group, UBS and GoCardless, with agentic payments among the use cases under test. HM Treasury's Payments Forward Plan commits to consider "whether change/development of regulation is needed to support agentic AI payments," alongside the first live variable recurring payments under the industry-led scheme, the open banking instrument most likely to become an agent's rail in the UK.

In Europe, the AI Act's obligations for general-purpose models have applied since August 2025, with a code of practice signed by Amazon, Anthropic, Google, IBM, Microsoft and OpenAI, but in June 2026 the Council deferred the high-risk obligations to December 2027 and August 2028. In the US, California's SB 53, signed in September 2025, requires frontier developers to report critical incidents within 15 days, and defines catastrophic risk to include a model that would "evade the control of its developer or user." The Financial Stability Board is consulting on sound practices for AI in finance. The IMF's note on agentic payments identifies the core tension as one between "probabilistic AI behavior and the deterministic requirements of payment infrastructures." The Bank for International Settlements warned in July that the cyber costs of frontier AI are "asymmetric and may favour attackers."

What I built

I do not only write about this. In 2026 I built a small piece of it, in the open, through Major Labs, an independent research studio that is editorially separate from this publication and operationally separate from any employer. It is small, most of it is free and open source, and I describe it here as a worked example of what the missing layer looks like when you try to build it.

The thesis, published as a series of essays in June 2026, is that operators are already shipping agents that buy, sign and pay, and that the independent infrastructure for trusting them is missing across five layers: identity, commerce, observability, provenance and discovery. In commerce the gap is specific. As I put it in the commerce essay: "The buy flow ships. The return flow does not." A protocol defines the proof. It does not supply an independent party to check it. Authorization, in other words, is not commitment. A protocol can prove a user signed a mandate. Somebody with no stake in the transaction still has to confirm the mandate is real, in scope, unexpired and unrevoked at the moment the charge clears.

So I built primitives, one for each of Part One's questions, released as open-source libraries under the MIT license in June 2026. IdentityKit answers "who": a portable agent identity. MandateKit answers "may": signing and verification of AP2-style mandates, covering signature, scope and expiry. BudgetGuard answers "spends": a per-task budget, loop detection, spend-velocity anomaly detection and kill switches that sit between the operator's code and the model API. WitnessKit answers "did": a tamper-evident, hash-chained audit log. A fifth, RememberKit, addresses a problem I found when I read six commercial agent-memory systems against six criteria: none of them sign what the agent remembers, which means an agent's memory today is a claim you have to take on faith.

On top of them sits Clearpoint, a hosted, neutral verification service that went live in June 2026 and is labeled, deliberately, as experimental. Present it an AP2 mandate and it returns a signed verdict, allow or deny, with a machine-readable reason code, a revocation status, and a hash-chained receipt that anyone can re-verify later. It answers one question for any party that has no contract with the issuer: did the user authorize this agent payment, and is that authorization still live? Its first version deliberately covers only signature, scope, expiry, a hosted revocation list and signed receipts; multi-rail adapters and cross-issuer revocation are out of scope for now.

On the discovery layer, the plumbing problem from Part One turned out to be worse than the headlines. My State of MCP report, published in June 2026, found 38,157 servers advertised across the public registries, 2,468 actual servers behind them, and roughly 1,200 that could be evaluated at all; of those, 36 percent shipped a risky pattern and 32 percent exposed a server-side request forgery surface. The connectors everyone is plugging agents into are, for the most part, unmaintained hobby projects. Knowing which ones are not is a public good, and I intend to keep counting.

None of this competes with the networks, the platforms or the protocols described above. It sits beside them and asks one narrow question: is this specific act, right now, still authorized? I think the agent economy needs a party whose only job is to answer that, and I would rather demonstrate what that looks like than argue for it.

What a Manageable Agent Looks Like

Strip away the vendors and the acronyms, and everything in this guide reduces to five questions and four rules. Four of the questions are the ones from Part One. The fifth, about memory, surfaced along the way.

The five questions are the ones a payments professional would ask of any new participant on the network, applied to software. Who is this agent, and can it prove it? What has it been authorized to do, by whom, and until when? How much may it spend, and what stops it spending more? What did it actually do, in a record that survives a dispute? And what does it remember about the person it acts for, and can that be verified rather than trusted?

The four rules are the ones the labs, the security researchers and the regulators have independently arrived at. Confirm before anything irreversible. Keep the controls that matter outside the model's reasoning loop, where a prompt injection cannot reach them. Give an agent the least access it needs, in an environment where a mistake is recoverable. And decide who is liable before scale, not after, because Air Canada and the Ninth Circuit have shown the courts will decide it for you otherwise.

The agent era will not be won by whoever builds the most capable agent. It will be won by whoever makes an agent safe enough to hand a card to, and can prove it to the person on the other side of the transaction.

For consumers, that means approval before spend and limits they set themselves, which is what the products described in Part Four are starting to offer. For merchants, it means verifying an agent's identity at the door and demanding evidence of intent in every dispute. For issuers and networks, the work already under way, by their own account, is carrying agent presence and intent into authorization, with Know Your Agent sitting alongside Know Your Customer. For regulators, it means holding operators accountable for their software, as they already do, and resisting the temptation to write rules for mechanics that will be obsolete in a year.

All of it comes back to the loop. A model that acts, sees what happened and decides what to do next is as trustworthy as the checks placed around each turn, and no more. The five questions are those checks, asked at the moments that matter: before the agent starts, before it spends, and after it is done.

I will return to three of these threads in future pieces: the mandate stack and how the intent protocols map onto one another, the liability question and who pays when an agent gets it wrong, and the unsigned memory problem, which I think is the next security story after prompt injection.

If you had to hand an agent your card tomorrow, which of the five questions would you need answered before you did, and who do you trust to answer it?

Appendix A: Key Terms

Agent. Software in which a language model decides for itself which actions to take, in what order, and when to stop, in pursuit of a goal. Anthropic's short form: "LLMs autonomously using tools in a loop."

Workflow. Software in which the steps are fixed in code and a model fills in parts of each step. The code decides the path; the model does not. Most "agents" sold today are workflows.

Large language model (LLM). The model at the center of an agent. It reads text and produces text; everything else an agent does happens because the text it produces is turned into an action.

Tool use, or function calling. The mechanism by which a model asks for an action to be performed, by producing a structured request that the surrounding code executes. Introduced as an API feature by OpenAI in June 2023.

The loop. The cycle of reasoning, acting and observing that defines an agent. First described in the 2022 ReAct paper. The agent keeps cycling until the task is finished, it is blocked, or it is stopped.

Context window. The model's working memory: the instructions, conversation and tool results it can see when making its next decision. It is finite, and performance degrades as it fills ("context rot").

Memory. What an agent retains between sessions: notes, databases, or a dedicated memory product. Today it is rarely signed or verifiable, which is why I call it "a claim you have to take on faith."

Harness. The code around the model that decides which tools exist, when to stop or retry, when to ask a human, and what to do when something fails. Also called the orchestration layer. Most production reliability lives here.

Sandbox and permissions. The boundary on what an agent may read, change and reach. An agent with no sandbox and broad permissions is the setting for most of the incidents in Part Six.

Computer use. An agent's ability to operate a screen the way a person does, by looking at it and moving a cursor. Introduced by Anthropic in October 2024; now a product category of browser agents.

Browser agent. An agent that lives in or drives a web browser and can visit sites, fill forms and, increasingly, buy things. Examples include ChatGPT agent and Atlas, Claude in Chrome, Perplexity's Comet and Gemini Spark.

Model Context Protocol (MCP). An open standard, published by Anthropic in November 2024 and now stewarded by the Linux Foundation's Agentic AI Foundation, for connecting agents to tools and data. The "USB-C port" for agents.

Agent2Agent (A2A). A protocol from Google, also now hosted by the Agentic AI Foundation, for agents from different vendors to discover and communicate with one another.

Multi-agent system. An arrangement in which one agent breaks a task into pieces and delegates to others. More capable on hard tasks, and far more expensive in tokens.

Time horizon. METR's measure of agent capability: the length of task, as timed by human professionals, that a model completes on its own at a given reliability. The 50 percent horizon has been doubling every few months.

Pass^k. A reliability measure: the probability that an agent succeeds on the same task every time across k attempts. The number that separates a demo from a product.

Prompt injection. An instruction hidden in content the agent reads, which the model mistakes for an instruction from its user. The defining vulnerability of agents; the labs and the UK NCSC say it cannot be fully eliminated, only contained.

Lethal trifecta. Simon Willison's term for the combination that makes an agent exploitable: access to private data, exposure to untrusted content, and the ability to communicate externally.

Exfiltration. Data leaving a system without authorization. In agent incidents it usually happens because a prompt injection told the agent to send it.

Agentic commerce. Shopping and paying done by an agent on a person's behalf, from product discovery through checkout. As of September 2026, discovery is mainstream and autonomous payment is not.

Mandate. A signed record of what a user authorized an agent to do. In Google's AP2 there are three: an intent mandate (the brief, with an expiry), a cart mandate (a specific basket, signed by the user) and a payment mandate (the signal passed to the network and issuer).

Agentic token. A payment token, in the same family as the tokens behind contactless and card-on-file payments, that identifies a purchase as made by an agent and carries the controls attached to it. Used by Mastercard's Agent Pay; Visa's Intelligent Commerce and Stripe's shared payment tokens are related approaches.

Verifiable Intent. An open specification co-developed by Mastercard and Google, and contributed to the FIDO Alliance, that creates a tamper-resistant record of what a user authorized when an agent acts for them.

Trusted Agent Protocol. Visa's framework, built on web signature standards, for a merchant to verify that an agent is who it says it is before it checks out.

Agent Payments Protocol (AP2). Google's protocol for agent payments, built around signed mandates, with more than 60 launch partners. Its standardization has moved into the FIDO Alliance.

Agentic Commerce Protocol (ACP). The open, Apache-licensed protocol from OpenAI and Stripe for a merchant to sell through an AI platform, with payment tokens scoped to a merchant and a cart total.

Universal Commerce Protocol (UCP). Google's protocol for merchants to expose catalogs and checkout to agents, keeping the retailer as merchant of record; compatible with AP2.

Know Your Agent (KYA). The emerging discipline, by analogy with Know Your Customer, of establishing who an agent is, what it is permitted to do, who is accountable for it and how it behaves over time. In September 2026, Ant International, Visa and Mastercard announced an interoperability framework for it.

Web Bot Auth. A method, being standardized at the IETF, by which an automated client cryptographically signs its web requests so a site can distinguish an identified agent from anonymous traffic.

Machine payments. Payments between software systems with no human in the loop, such as an agent paying for an API call. Coinbase's x402, Stripe and Tempo's Machine Payments Protocol and Mastercard's Agent Pay for Machines are the main proposals. Volumes are real and, so far, tiny.

Agent washing. Gartner's term for marketing ordinary automation or chatbots as agents. Gartner estimated in 2025 that only about 130 of the thousands of vendors claiming to sell agents were doing so.

Agentic misalignment. Behavior in which an agent pursues its goal against its operator's interests, such as blackmail or sabotage in simulated tests. Documented by the labs in evaluations; not yet observed in real deployments, by their account.

Frontier safety framework. A lab's published policy on what capabilities it will test for and what safeguards it will require before shipping a model. Anthropic's Responsible Scaling Policy, OpenAI's Preparedness Framework and Google DeepMind's Frontier Safety Framework are the three main examples.

Appendix B: Timeline, 2022 to September 2026

2022 to 2023: the idea

• October 2022. The ReAct paper describes models that reason and act in an interleaved loop.
• November 30, 2022. ChatGPT launches.
• February 2023. Meta's Toolformer shows a model can teach itself when to call a tool.
• March 30, 2023. Auto-GPT is released; BabyAGI follows within days. Both loop, hallucinate tools and burn credits.
• June 13, 2023. OpenAI ships function calling, making tool use an API primitive.
• July and November 2023. WebArena and GAIA benchmarks show the best agents at 14 to 15 percent against humans at 78 to 92 percent.

2024: the first wave breaks

• February 14, 2024. A Canadian tribunal rules Air Canada is responsible for what its chatbot said.
• February 27, 2024. Klarna says its AI assistant is doing the work of 700 agents.
• March 12, 2024. Cognition launches Devin as "the first AI software engineer."
• April 2024. OSWorld launches with the best model at 12.24 percent; the Rabbit R1 ships and cannot order food.
• May 30, 2024. Anthropic makes tool use generally available.
• June 2024. Sierra's tau-bench shows agents failing the same task on repeat.
• August 13, 2024. OpenAI publishes SWE-bench Verified after finding the original benchmark broken.
• October 22, 2024. Anthropic releases computer use, at 14.9 percent on OSWorld.
• November 25, 2024. Anthropic publishes the Model Context Protocol.
• December 19, 2024. Anthropic publishes "Building effective agents," the standard definition of workflows versus agents.

2025: the plumbing arrives and the incidents begin

• January 23, 2025. OpenAI launches Operator.
• February 2, 2025. OpenAI launches deep research.
• February 18, 2025. HP buys Humane's assets for $116 million.
• March 19, 2025. METR reports agent time horizons doubling every seven months.
• April 9, 2025. Google publishes Agent2Agent.
• April 29 and 30, 2025. Mastercard unveils Agent Pay; Visa unveils Visa Intelligent Commerce.
• May 9, 2025. Klarna says it is reinvesting in human support.
• May 22, 2025. Anthropic publishes the Claude Opus 4 system card and activates ASL-3 protections.
• May 26, 2025. Invariant Labs demonstrates the GitHub MCP exploit.
• June 11, 2025. EchoLeak (CVE-2025-32711) is published.
• June 16, 2025. Simon Willison names the "lethal trifecta."
• June 20, 2025. Anthropic publishes "Agentic Misalignment."
• June 25, 2025. Gartner predicts more than 40 percent of agentic AI projects will be canceled by 2027.
• July 17, 2025. OpenAI launches ChatGPT agent.
• July 2025. A Replit agent deletes a production database during a code freeze.
• August 2, 2025. EU AI Act obligations for general-purpose models take effect.
• August 18, 2025. MIT's "GenAI Divide" report finds 95 percent of pilots falling short.
• August 20 and 25, 2025. Brave discloses the Comet prompt injection; Anthropic pilots Claude for Chrome.
• September 16, 2025. Google publishes the Agent Payments Protocol with more than 60 partners.
• September 17, 2025. OpenAI and Apollo Research publish scheming research.
• September 29, 2025. OpenAI launches Instant Checkout and, with Stripe, the Agentic Commerce Protocol; Anthropic releases Claude Sonnet 4.5; California signs SB 53.
• October 14, 2025. Visa publishes the Trusted Agent Protocol.
• October 21, 2025. OpenAI launches the Atlas browser.
• October 30, 2025. Mastercard reports its first agentic transaction.
• November 13, 2025. Anthropic discloses an AI-orchestrated espionage campaign run through Claude Code.
• November 2025. OpenClaw is released.
• December 9, 2025. The Linux Foundation forms the Agentic AI Foundation; OWASP publishes its Top 10 for Agentic Applications.
• December 18, 2025. Visa reports hundreds of controlled agent transactions.
• December 22, 2025. OpenAI writes that prompt injection is "unlikely to ever be fully 'solved.'"

2026: governance catches up

• January 11, 2026. Google launches the Universal Commerce Protocol.
• January 22, 2026. Anthropic publishes Claude's constitution.
• January 28, 2026. Mastercard reports Australia's first authenticated agentic transactions.
• January 31 to February 2, 2026. Moltbook's database is found exposed; OpenClaw's security crisis peaks.
• February 5, 2026. OpenAI launches Frontier.
• February 12, 2026. Anthropic reports Claude Code past $2.5 billion in run-rate revenue.
• February 17, 2026. NIST launches the AI Agent Standards Initiative.
• February 24, 2026. Anthropic publishes Responsible Scaling Policy v3.
• February 26, 2026. HM Treasury publishes the Payments Forward Plan.
• March 2, 2026. Santander and Mastercard report Europe's first live end-to-end agent payment.
• March 5, 2026. Mastercard and Google publish Verifiable Intent.
• March 24, 2026. OpenAI discontinues the first version of Instant Checkout.
• April 8, 2026. Visa launches Intelligent Commerce Connect; Anthropic launches managed agents.
• April 14, 2026. American Express launches the ACE developer kit and Agent Purchase Protection.
• April 15, 2026. Gartner's Hype Cycle keeps agentic AI at the peak, with 17 percent deployed.
• April 22, 2026. Google says 75 percent of its new code is AI-generated.
• May 1, 2026. Microsoft Agent 365 becomes generally available.
• May 13, 2026. Amazon launches Alexa for Shopping.
• May 20, 2026. Google announces Gemini Spark at I/O.
• June 3, 2026. The Frontier Model Forum publishes agent security practices.
• June 10, 2026. Mastercard launches Agent Pay for Machines; Visa announces its OpenAI partnership.
• June 24, 2026. The FCA's chief executive says accountability for agentic systems "must remain clear."
• June 26, 2026. OSWorld 2.0 is released; METR publishes its GPT-5.6 Sol evaluation.
• June 29, 2026. The EU Council defers high-risk AI Act obligations to 2027 and 2028.
• July 2, 2026. Visa reports live agent purchases with more than 30 European issuers.
• July 3, 2026. Singapore's MAS publishes Safeguards for Agentic Finance at Runtime.
• July 14, 2026. The x402 Foundation launches under the Linux Foundation.
• July 28, 2026. The MCP specification goes stateless.
• August 4, 2026. The UK AI Security Institute publishes its incident report; the Ninth Circuit rules in Amazon v. Perplexity.
• August 13 and 17, 2026. The Agentic AI Foundation reaches 247 members; A2A joins it.
• August 25, 2026. McKinsey's State of AI finds 40 percent of large organizations scaling agents.
• August 26, 2026. Claude in Chrome becomes generally available; Salesforce reports Agentforce past $1.5 billion in annual recurring revenue.
• September 1, 2026. EMVCo publishes its draft agentic payments framework; the IETF's first Web Bot Auth working-group draft appears.
• September 2026. Anthropic releases Claude Fable 5.1 and Mythos 5.1.
• September 8, 2026. Visa's chief executive says autonomous agent payments have not yet arrived.
• September 9, 2026. Mastercard launches Agent Connect; Visa publishes its Trust Index; Ant International, Visa and Mastercard announce a Know Your Agent framework.
• September 15 and 16, 2026. Cloudflare extends ad-page blocking to mixed-use crawlers; OpenAI announces sponsored agents.

Disclosure: Charlie Major is the founder and publisher of Major Matters and of Major Labs, and is employed by Mastercard. This guide reflects Major Matters' independent editorial analysis, is based entirely on publicly available information, and does not represent the views of Mastercard or any other organization.