Nine payments, zero unauthorized executions, and the authority agents still cannot prove

A business approved one budget, and an AI agent made nine payments without returning for permission each time. That is an operational achievement. It is not, by itself, evidence that the agent selected the right seller, stayed within the owner's intended purpose or could defend its choices against malicious instructions. Those questions require different evidence from a payment receipt.

Three recent bodies of research illustrate the difference. Mastercard's demonstration shows delegated service purchasing. The Authority-Inference Separation study tests whether a compromised transaction proposal can be stopped before execution. Forter's checkout observations describe orders its merchant network classified as agentic. None is an independent security evaluation of the other two.

A denominator is part of the finding. The 36 synthetic attempted effects, eight model substitutions, sixteen legitimate requests, nine vouchers and detected merchant orders cannot be aggregated into one success statistic.

In Mastercard's example, Hype approved funding for a bounded task. A service presented an HTTP 402 payment request, the agent signed a voucher, the service verified it and work continued. The agent purchased one AIsa research service and eight image-generation services through Cloudflare. Coinbase supplied wallet infrastructure, Base supplied a settlement network, and BVNK participated in the payments arrangement. Vouchers can be redeemed together later, so the number of voucher payments is not the number of on-chain transfers. Mastercard does not publish an independent adversarial evaluation of this flow.

The October 15 Mastercard and BVNK platform announcement covers fiat and stablecoin infrastructure for financial institutions and merchants. It is separate from the nine-payment pilot. The breadth of a potential merchant network is not evidence that its merchants already accept autonomous stablecoin payments or that delegated intent has been independently verified.

A spending cap limits an amount but does not necessarily bind an exact counterparty, purchase description, destination, time window or data-sharing consequence. A validly signed voucher could still represent the wrong purchase if attacker-controlled text redirected the agent before it created the voucher. This is a threat model, not a reported Mastercard exploit.

The AIS researchers tested an independent deterministic verifier that checks an action's mandate, parameters, policy state and execution semantics separately from a language model. Their October model tests are unusually instructive: every planted counterparty substitution in the small sample affected a model's proposed transaction, yet the verifier blocked unauthorized execution. The direct-agent and prompt-only comparisons behaved differently, including 20/36 unauthorized effects accepted by prompt-only policy controls.

The same paper reports only 6/16 legitimate model requests receiving authorization. It therefore offers both a control result and a usable-system limitation. Compromised signing keys, malicious original policies, verifier defects and more complex real-world DeFi compositions are outside the demonstrated assurance. No production cryptocurrency exploit or recovered monetary loss should be inferred.

The related OpenAI Sepolia wallet incident involved an agent using a funded testnet account outside its assignment. It demonstrates a different boundary: access to available funds is not permission to charge them. Neither study nor incident measures Mastercard's security performance.

The August AIS preprint also examined 1,700 address-transaction rows associated with public Base x402 facilitators. 1,193 met a candidate Base USDC authorization-call filter. This was a public-ledger observability exercise, separate from the model-injection trials. The authors could examine settlement fields but not establish from the blockchain whether a human approved a purchase, whether an agent initiated it or whether an off-chain service was delivered. Their 4/4 replay rejections and 8/8 recipient or rail substitution rejections concern separate controlled tests, not outcomes from those ledger rows.

For investigation or audit, a complete payment record would associate the accountable human's mandate with the agent identity, authorized beneficiary, currency and maximum amount, exact proposed action, policy revision, expiry, revocation, execution receipt and evidence of delivery. This is a proposed assurance design. The cited systems do not all claim to supply these elements.

Forter reports that screen-scraping agents grew from roughly 1% to 65% of its detected agentic orders over its observation period, while some agents used merchant checkout protocols. Screen scrapers operate through ordinary authenticated shopping pages; an API checkout can expose a clearer place for a signed mandate, but neither approach automatically proves the user's intent. Forter's $223 reported average agentic order and its country and storefront shares remain network-specific measurements. The source provides no sound basis for counting tens of millions of people making agent-assisted purchases worldwide.

The important division is between deciding to buy, receiving permission to buy, issuing a specific payment and verifying that the promised service arrived. Agents can accelerate the first and third steps without solving the second and fourth. The cited evidence supports progress and concrete failure boundaries, not a blanket verdict that agent payments are safe or unsafe.