What Happens When AI Starts Spending Your Money? The next internet customer may not be a person. It could be a piece of software with permission to spend your money. By CryptoDost | Technology & AI Investigation

 What Happens When AI Starts Spending Your Money?

The next internet customer may not be a person. It could be a piece of software with permission to spend your money.

By CryptoDost | Technology & AI Investigation

Imagine this.

You tell an AI assistant to find a cheaper cloud server for your business. It compares providers, checks specifications, negotiates a suitable plan and purchas inter your card details into a checkout page.

A few minutes later, your server is ready.

Now imagine that the same assistant does this for 500 different businesses, simultaneously.

That is where things get interesting.

For years, software has helped people make purchasing decisions. Search engines found products. Recommendation systems suggested services. Chatbots answered questions.

But a new category of software is emerging: AI agents that can use tools, communicate with services and carry out multi-step tasks.

And once software can participate in a transaction, an entirely different question appears:

Who controls the money when the customer is an AI?

This is not just a question for AI developers. It could affect banks, payment companies, online stores, SaaS businesses, crypto infrastructure and almost every company selling something through the internet.

---

1. The customer you cannot see

Consider how an ordinary online purchase works.

You visit a website, select a product, enter your information and pay.

The business knows that a person is interacting with its checkout system.

Now consider a different situation.

An AI agent receives this instruction:

"Find a reliable API that can convert 10,000 documents into structured data. Compare the prices and select the cheapest service that meets my accuracy requirements."

The agent searches for providers, reads documentation, compares pricing and requests access to a suitable service.

The customer may never see the provider's website.

The interaction happens through software interfaces.

This creates a potentially important shift in digital commerce.

Businesses have traditionally optimised their websites for human visitors. They focus on design, advertising, search rankings, checkout experiences and conversion rates.

But what if a growing share of purchasing decisions is made by software?

An agent may care about completely different things:

- Is the API accessible?

- Is the pricing clearly documented?

- Does the service support automated authentication?

- Is the response reliable?

- Can the service be purchased without a complicated manual process?

- Can the agent verify that the task was completed?

A beautiful website might impress a human visitor but still be difficult for an automated system to use.

This leads to a new business question:

Will companies eventually compete for AI agents as customers, just as they currently compete for human customers?

That is a possibility worth taking seriously.

2. The strange economics of a $0.03 transaction

Let's use a fictional example.

An AI agent needs to access a small piece of information from an external service.

The service charges three cents.

The amount is tiny. But the agent might need to purchase thousands of small resources while completing a larger task.

Imagine an agent performing a research project that requires:

- Several data queries.

- A translation service.

- A document extraction API.

- A specialised research tool.

- Additional computing resources.

The agent is not necessarily making one large purchase. It may be making many small purchases from different providers.

This creates a problem.

Traditional online checkout experiences often involve accounts, subscriptions, payment forms, billing settings and human confirmation.

That process can become unnecessarily complicated for tiny, frequent machine-to-machine transactions.

The economics also become interesting.

If a payment method has fixed processing costs, a very small transaction may be commercially impractical. Providers may therefore need different approaches to pricing, batching, billing and settlement.

This is one reason why machine-oriented payment protocols are attracting attention.

What is being built?

Stripe introduced its Machine Payments Protocol (MPP) on March 18, 2026.

The idea is to provide a standardised way for software agents to request a resource, receive a payment request, authorise payment and obtain the resource.

The protocol is designed for interactions with services such as APIs and other HTTP-accessible endpoints.

Google previously introduced the Agent Payments Protocol (AP2) in September 2025. In April 2026, Google announced that it was donating AP2 to the FIDO Alliance to support an open, industry-led approach.

These developments are important because they suggest that developers are thinking beyond traditional human-operated checkout pages.

Sources:

- "Stripe: Introducing the Machine Payments Protocol" (https://stripe.com/blog/machine-payments-protocol)

- "Google: Agent Payments Protocol" (https://cloud.google.com/blog/products/ai-machine-learning/announcing-agents-to-payments-ap2-protocol)

- "Google: AP2 donated to the FIDO Alliance" (https://blog.google/products-and-platforms/platforms/google-pay/agent-payments-protocol-fido-alliance/)

The interesting part is not simply that AI can pay.

It is that software may need a completely different purchasing experience from humans.

3. The biggest misconception: An AI that can pay is not necessarily allowed to pay

This distinction deserves more attention.

Imagine giving an AI assistant access to your business payment account.

You ask it to find a hosting provider.

It discovers a suitable service costing $25 per month.

Should it be allowed to purchase it?

Probably, if you explicitly authorised that action.

But what if it selects a $250 monthly plan instead?

What if the provider automatically adds additional services?

What if the AI misunderstands the pricing and purchases an annual subscription?

The problem is not necessarily the model's intelligence.

The problem is authority.

There are at least three separate capabilities:

Decision-making: The AI determines which option appears suitable.

Authorisation: The system checks whether the AI is allowed to perform the action.

Execution: The payment infrastructure actually completes the transaction.

These should not be treated as the same thing.

A sensible permission system might work like this:

Action| Permission

Search for providers| Automatic

Compare prices| Automatic

Request a quotation| Automatic

Purchase under $20| Pre-authorised

Purchase above $20| Human approval

Change payment details| Restricted

Transfer funds to an unknown account| Blocked

These are illustrative rules, not an industry-wide standard.

The point is simple: an intelligent system should not automatically receive unlimited financial authority.

A real-world example

On October 20, 2026, Visa, BILL and Billtrust announced a live pilot for AI agents to complete approved buyer invoice payments through supplier portals.

There is an important detail in the announcement: the agent executes eligible payments that have already been approved by the buyer.

It is not independently deciding whether the business should pay an invoice.

That distinction tells us something about how serious payment infrastructure providers are approaching agentic commerce.

Automation does not have to mean surrendering control.

Source: "Visa, BILL and Billtrust announce AI-agent payment pilot" (https://usa.visa.com/about-visa/newsroom/press-releases.releaseId.22856.html)

4. The hidden middlemen of the AI economy

Suppose an AI agent purchases a service from another AI-powered business.

Who makes money?

It might seem that only the buyer and seller are involved.

In reality, a transaction could involve several layers.

Consider a hypothetical purchase:

An agent needs a specialised data-analysis service.

The transaction might involve:

1. The AI platform operating the agent.

2. The model provider processing the agent's reasoning.

3. The API marketplace or discovery platform.

4. The identity and authentication provider.

5. The payment processor.

6. The service provider delivering the data analysis.

7. A cloud provider supplying computing resources.

Each layer may have its own commercial model.

Some charge subscriptions. Others charge per request, per token, per transaction or by computing usage.

This raises an interesting possibility.

The biggest opportunity in an agent economy may not necessarily belong to the company building the most famous AI assistant.

It could belong to companies providing the infrastructure that allows thousands of agents to operate.

Think about the early internet.

The visible products were websites and online services. But the supporting economy also created businesses around domains, hosting, payment processing, cybersecurity and infrastructure.

The same pattern could emerge around autonomous software.

Five infrastructure businesses worth watching

1. Agent identity

A business needs to know which agent is contacting it and which organisation the agent represents.

2. Permission management

A company needs to control what each agent can read, change, purchase or approve.

3. Machine payment infrastructure

Services need reliable methods for charging software without forcing every interaction through a human checkout.

4. Agent reputation

Businesses may need ways to evaluate whether an agent is authorised, trustworthy and capable of completing a particular task.

5. Transaction monitoring

Companies need records of what an agent did, what it purchased and which permissions it used.

These are potential business categories, not guaranteed investment opportunities. Their commercial success will depend on adoption, competition and regulation.

5. Why payment companies are suddenly interested in AI agents

It is tempting to think of AI payments as a completely new financial system.

But a more interesting possibility is that existing payment networks will adapt their infrastructure to accommodate software customers.

Visa's Intelligent Commerce initiative focuses on identity, authentication, payment credentials and transaction controls for agent-led commerce.

Its developer documentation describes agent-specific payment tokens and mechanisms intended to ensure that purchases match the user's authenticated instructions.

Google's AP2 takes another approach through an open protocol for agent-led payments.

Stripe's MPP focuses on machine-oriented payment interactions.

These approaches are not identical. They represent different attempts to solve parts of the same problem.

And that leads to an important observation:

The competition may not be about which AI can make the smartest purchasing decision. It may be about which infrastructure can make that decision safe enough to execute.

Sources:

- "Visa Intelligent Commerce" (https://corporate.visa.com/en/products/intelligent-commerce.html)

- "Google AP2" (https://blog.google/products-and-platforms/platforms/google-pay/agent-payments-protocol-fido-alliance/)

- "Stripe MPP" (https://stripe.com/blog/machine-payments-protocol)

6. The uncomfortable security problem: What if an AI is tricked into spending your money?

Here is a scenario that deserves attention.

You ask an AI agent to compare three hosting providers.

The agent opens a website to read its pricing.

Hidden in the website's content is a malicious instruction telling the agent to ignore its original task and reveal private information or perform an unauthorised action.

The website is supposed to provide information, not instructions.

But AI systems can sometimes struggle to reliably separate untrusted content from trusted instructions.

This type of attack is known as indirect prompt injection.

It becomes more serious when an agent has access to tools, files, accounts or payment capabilities.

A chatbot that gives a bad answer is one problem.

An agent that sends private information or makes an unauthorised purchase is a different problem entirely.

OWASP's AI security guidance identifies risks including prompt injection, tool abuse, excessive permissions and data exfiltration.

Source: "OWASP AI Agent Security Cheat Sheet" (https://cheatsheetseries.owasp.org/cheatsheets/AI_Agent_Security_Cheat_Sheet.html)

The permission trap

Consider two agents.

Agent A can search the internet and compare prices.

Agent B can search the internet, access a company database, modify files and initiate payments.

If both agents are performing the same research task, Agent B has unnecessary authority.

A compromised or manipulated agent could therefore cause more damage.

This is why the principle of least privilege matters.

An agent should receive only the permissions necessary for its assigned task.

Other useful safeguards include:

- Separate payment credentials for individual agents.

- Spending limits.

- Approval requirements for sensitive actions.

- Restricted API access.

- Transaction logs.

- Ability to revoke permissions immediately.

- Independent verification of important actions.

The future of agentic commerce will depend heavily on whether these protections work in practice.

7. Where blockchain fits into this picture

This is where the Web3 conversation becomes relevant.

AI agents may need to pay for data, computing, software tools and services.

Blockchain networks can offer certain capabilities:

- Programmable transfers.

- Publicly verifiable transaction records.

- Smart-contract-based payment conditions.

- Digital asset settlement.

- Wallet-based access to tokens.

For example, a software agent might pay for a data service using a digital asset through a supported payment protocol.

But blockchain is not a magic solution.

It does not automatically verify that an AI agent is legitimate.

It does not guarantee that a purchased service is accurate.

It does not prevent an agent from being manipulated.

And it does not eliminate the need for compliance, refunds, identity checks or secure key management.

There is also a practical question: does every agent need a blockchain wallet?

Not necessarily.

For some transactions, conventional card and bank payment infrastructure may be more suitable. Other applications may benefit from stablecoins or programmable settlement.

The winning infrastructure will depend on the specific use case.

The more useful question is not whether blockchain will replace traditional payments.

It is where programmable money offers a real advantage for software-to-software transactions.

8. The new SEO problem: What if AI agents become the buyers?

This could become one of the more interesting changes for online businesses.

Today, businesses invest in search engine optimisation because they want people to discover their websites.

But imagine a future where a company asks an agent:

"Find the cheapest reliable service that can host my application."

The agent may compare dozens of providers without displaying every website to the user.

A provider's visibility could depend on factors beyond traditional search rankings.

For example:

- Clear API documentation.

- Machine-readable pricing.

- Reliable service availability.

- Transparent terms.

- Verifiable capabilities.

- Easy authentication.

- Consistent performance.

This is not a replacement for SEO today. It is a possible additional distribution channel as automated purchasing becomes more common.

A business might eventually need two types of discoverability:

Human discoverability: Can people find and understand the product?

Machine discoverability: Can authorised agents find, evaluate and use the service?

That could create an entirely new category of developer tools and business optimisation services.

9. What should founders build?

The biggest mistake would be to build another generic AI assistant simply because agentic AI is attracting attention.

A better approach is to identify a specific problem that businesses will pay to solve.

Here are five ideas worth investigating.

Idea 1: AI Agent Spending Dashboard

A business dashboard showing every agent's spending, budget, transactions and approvals.

Idea 2: Agent Permission Manager

A tool that lets businesses create rules for individual agents.

For example, a marketing agent can purchase advertising reports but cannot access payroll information.

Idea 3: Machine-to-Machine Marketplace

A directory where agents can discover APIs, data providers and specialised software services using structured information.

Idea 4: Agent Security Testing

A platform that tests whether malicious websites, documents or messages can manipulate an agent into performing restricted actions.

Idea 5: Agent Transaction Auditor

A system that records why an agent initiated an action, which permission allowed it and whether the transaction matched the original instruction.

None of these ideas is automatically a successful startup.

Before building one, founders should interview businesses, identify an expensive existing problem and test whether customers will actually pay for a solution.

The opportunity is in solving a real operational problem, not simply attaching the word AI to an existing product.

10. The question nobody should ignore

Let's return to the original example.

You gave an AI agent permission to purchase a cloud server.

It selected a provider, completed the payment and configured the service.

Everything worked.

Now imagine the server was purchased using the wrong account, the price was misunderstood or the agent was manipulated by malicious information.

Who is responsible?

The user who gave the original instruction?

The developer who built the agent?

The platform that connected it to payment tools?

The payment provider?

The merchant?

There may not be one universal answer. Responsibility will depend on the contracts, laws, permissions and circumstances involved.

But the question becomes more important as software gains access to real-world systems.

An agent that can only generate text has limited authority.

An agent that can spend money, access private information and modify business infrastructure needs a much stronger accountability system.

That is the real challenge behind autonomous commerce.

---

CryptoDost's Take: The next valuable product may be the control layer

The AI industry has spent enormous resources improving model intelligence.

But intelligence alone does not create a trustworthy economic participant.

For AI agents to become meaningful customers, businesses will need systems that answer four basic questions:

- Who is this agent?

- Who authorised it?

- What is it allowed to do?

- Can we prove what happened afterward?

The companies that solve these problems could become important infrastructure providers in the next phase of the internet.

The opportunity is not simply to let AI spend money.

It is to make sure that when AI spends money, the right person remains in control.

The next big internet customer may not have a face, a browser or even a traditional account. But it will need an identity, a budget and permission to spend.

And that is where a new digital economy could begin.

---

Sources & Further Reading

1. "Stripe — Introducing the Machine Payments Protocol (March 18, 2026)" (https://stripe.com/blog/machine-payments-protocol)

2. "Google — Agent Payments Protocol (September 16, 2025)" (https://cloud.google.com/blog/products/ai-machine-learning/announcing-agents-to-payments-ap2-protocol)

3. "Google — AP2 and the FIDO Alliance (April 28, 2026)" (https://blog.google/products-and-platforms/platforms/google-pay/agent-payments-protocol-fido-alliance/)

4. "Visa — AI Agent Payments Pilot with BILL and Billtrust (October 20, 2026)" (https://usa.visa.com/about-visa/newsroom/press-releases.releaseId.22856.html)

5. "Visa — Intelligent Commerce" (https://corporate.visa.com/en/products/intelligent-commerce.html)

6. "OWASP — AI Agent Security Cheat Sheet" (http