Agent Payments

Two Paths for Agent Payments: Anonymous Arbitrage or Compliant Trust?

When machines start spending money, the track splits—one path leads to frictionless anonymous arbitrage, the other to verifiable, accountable compliant trust. The choice you make determines where you stand in this era.

When Machines Start Paying, Who Stops the Money Laundering?

Agent payments promise an efficiency revolution, but they also open an unprecedented attack surface. We need to redesign compliance and security systems for machine-initiated payments—a risk that must be faced, and perhaps one of the biggest infrastructure opportunities of our time.

Circle Secures NYDFS Trust Charter, Adding Another State-Level Layer to USDC Regulation

Circle subsidiary receives NYDFS limited-purpose trust charter, complementing federal MSB registration and multi-state licenses

Tether Launches Compliant Stablecoin USAT on Celo Chain, First Move Beyond Ethereum Ecosystem

AI Engineer: Why Agentic Systems Need Ontologies – Logical Guardrails to Prevent Payment Errors

HSBC Joins Effort to Set Asia-Pacific Rules for Agent Payments: When AI Starts Spending, Who Confirms Identity and Bears Responsibility?

The Emerging Payments Association Asia (EPAA) has launched an AI and Agent Payments working group, with HSBC as a founding member, aiming to establish common standards for agent identity, payment authorization, liability allocation, and fraud risk. As AI agents begin to initiate real transactions on behalf of individuals and businesses, the industry must address not just 'how machines pay,' but 'who authorizes, who is responsible, and how to stop risk before funds move.'

Halborn Unveils A2A Payment Threat Model: On-Chain Irreversibility Amplifies Security Risks

Blockchain security firm Halborn has released an Agent-to-Agent payment threat model, highlighting risks such as prompt injection, identity spoofing, wallet key leaks, malicious service providers, smart contract vulnerabilities, oracle manipulation, and cascading payments when AI agents autonomously transact using stablecoins and smart contract wallets.

Attack Lab #5: We Paid One Authorization Twice — and Pushed the Audit Fingerprint Beyond Our Own Reach

Two breaks at once. One: with no single-use nonce, a fully-valid payment could be replayed until the budget drained — we added an anti-replay gate (replay → 409). Two: Episode 4's hash chain lived only in our own DB, so an admin rewriting the whole tail couldn't be disproven — we exposed the tip publicly (/api/audit-anchor) and had GitHub witness it on a schedule. Honest limit: true non-repudiation still needs anchoring to a public chain.

We Attacked a Paying Agent Six Ways — All Six Were Blocked

Prompt injection, whale drain, payee redirection, anonymous impersonation… a real adversarial run against mcp-pay: six blocked, each at a different gate. The key finding — the trust layer must live outside the agent.

AI Spots Ethereum Communication Component Bug, but Human Verification Remains Key

The Ethereum Foundation’s Protocol Security Team used a coordinated group of AI agents to uncover a remotely exploitable crash vulnerability in the libp2p Gossipsub component used by Ethereum consensus clients, which could have caused nodes or validators to go offline temporarily. The bug has been fixed and registered as CVE-2026-34219.