AI Agents Started Paying Their Own Bills This Week

For twenty-five years the internet built CAPTCHAs to keep bots away from the checkout page. This week Visa and Mastercard started issuing bots a pass.

Summary: In a demo Mastercard published Tuesday, a marketing agency called Hype gave an AI agent a job and a budget: plan a launch campaign for a protein bar.

The agent bought social media research from one company and eight campaign images from another, nine payments in all, with no human approving any of them one by one. The demo shows off a product Mastercard calls Agent Pay for Machines.

The same day, Visa, BILL, and Billtrust said AI agents are now paying real supplier invoices in a live pilot.

Behind the demos, the machines are already spending.

Chainalysis finds that wallets making payments over x402, an open crypto payment protocol, now start spending a median of 18 minutes after they're funded. A year ago the gap was 73 days. Most of those payments cost less than a dime.

Thesis: Software has started buying things on its own, mostly in amounts too small for a card network to process profitably.

That's why the card companies spent this week bolting themselves onto an open crypto protocol. Whoever sets the agent's budget ends up controlling the money, and the fight over who that is just started.

An agent went shopping and no one clicked "buy"

A business gives an agent "a job and a spending limit." The agent breaks the job into steps, goes looking for what it needs, and hits a paid service.

The service answers with a message that says, in effect, pay first. The agent signs a payment voucher inside its limit, the service checks the voucher and hands over the goods, and the agent moves to the next step.

In the demo, the goods were research from a data company called AIsa and eight images generated through Cloudflare. Nine payments, two merchants, one budget.

The agent had no account at either company, no saved card, no login. Mastercard says the providers can bundle up the vouchers and collect later.

It's a small demo. It's also the first time one of the two big card networks has shown a machine shopping across the open web on its own.

Visa's version is less flashy and more real. In a pilot that went live Tuesday, an AI agent working for businesses that pay their bills through BILL logs into supplier payment portals run by Billtrust and pays invoices.

The buyer still decides what gets paid, and each payment is tied to a specific invoice the buyer approved. The agent does the part that, as BILL's Archana Prasad put it, used to require "a person to manually complete what should be an automated step."

BILL says nearly half a million businesses use its platform. Billtrust says its network handles $1 trillion a year in trade credit. That's where the first agents are being let in.

The internet spent 25 years keeping bots out of the checkout

The strangest line in Visa's announcement is about CAPTCHA, the squiggly letters and grids of traffic lights that websites use to prove you're human.

Under the pilot, Billtrust recognizes BILL's agent through something Visa calls its Trusted Agent Protocol, and that recognition can satisfy "site protections historically provided by CAPTCHA."

The agent doesn't need its own login, and the buyer doesn't hand over passwords. It pays with a tokenized card number, a stand-in for the real one that only works for that purpose.

That's a reversal. For a quarter century the web's default assumption at the checkout was that a bot was a thief. Fraud teams built whole careers on telling people from scripts. Now the largest card network is issuing certain bots a pass, the way a building issues a badge to a contractor.

The badge is the product. Visa keeps a directory of registered agents, and an agent on the list gets through. That's the card network doing what it has always done: deciding who's allowed to pay and taking a cut for vouching.

The bots got a hall pass, and Visa runs the hall.

Someone is opening wallets and spending in 18 minutes

The demos would be easy to wave off if nothing was happening underneath them. Something is.

Chainalysis tracked payments made over x402, an open protocol Coinbase developed that lets a website charge for something the moment a program asks for it, settled in stablecoins (digital dollars that live on a blockchain).

Its annual North American report, published October 14, counts more than 138 million x402 transactions on Base, Coinbase's blockchain network, by the middle of this year.

The size and speed of those payments are the interesting part. Over the sixteen months ending in September, more than 87 percent of them fell between a hundredth of a cent and a dime. The most common payment was between one and ten cents.

Then there's the timing. In late 2025, the median wallet that made an x402 payment was 73 days old when it first spent.

By the third quarter of this year, it was 18 minutes old. A year ago, 4 percent of wallets made their first payment within an hour of being funded. Now 67 percent do.

That's how software behaves. A person who opens an account and spends from it eighteen minutes later, a few cents at a go, is rare. A program doing it two-thirds of the time is ordinary.

In Chainalysis's own words, "the robots are buying AI-generated knowledge." Model inference (paying an AI model to answer a question) is one of the biggest categories, along with data feeds, search, code review and financial research.

The customers are programs, and the purchases are small enough to round to zero.

A card can't charge a penny for a penny

That last detail explains why the card networks are suddenly so interested in an open crypto protocol.

The standard price Stripe charges a U.S. business to accept a card is 2.9 percent plus 30 cents. On a $50 purchase, that's fine. On a one-cent purchase, the fee is thirty times the sale.

A card network's pricing is built for people buying sandwiches and sneakers, and it falls apart when the buyer is a program paying for a thousand tiny answers an hour.

The web saw this coming a long time ago. When the HTTP standard was written in the late 1990s, it included a status code, 402 Payment Required, "reserved for future use." The idea was that some day a website would answer a request with a bill. For roughly twenty-seven years there was no cheap enough way to pay it, so the code sat there unused, a placeholder in every web server on earth.

x402 is that code finally being put to work. A service answers "402," the program pays a few cents in stablecoins, and the service hands over the goods. There's no account to open and no 30-cent fee eating the sale.

Mastercard's announcement names x402 directly, as "an open protocol that lets digital services request payment online," and lists Coinbase and Base among its partners. Settlement happens "in fiat or stablecoins," through Mastercard's own money platform. The card network has adopted the open protocol and placed itself in the settlement step, where the money changes hands.

The code waited twenty-seven years for a customer. The customer turned out to be a machine.

Two answers to who controls a robot's wallet

The two launches carry two different ideas about how machines should hold money.

Visa's agent borrows a card. It works inside the existing system: the buyer's bank issues the credentials, Visa vouches for the agent, and every payment traces back to an invoice a human approved.

That's the right design for paying a supplier $40,000, and it keeps everything that matters (the credit line, the fraud rules, the dispute process) inside the card network.

The x402 agent holds its own digital dollars. Anyone can set up a service that charges over the protocol, and anyone can fund a wallet to pay it, with no network's permission required.

That's the right design for paying a penny for an answer, and it's the one where a card network is optional.

Mastercard is trying to sit in both worlds: open protocol at the front, its own platform at the settlement step. Whether businesses route their agents' money through Mastercard or straight onchain will decide whether the card networks keep their cut of machine spending.

Either way, the new choke point is the budget. Whoever sets the agent's spending limit, and whoever can freeze it, controls the money. For a human, that's a credit limit set by a bank.

For an agent, it might be a line of code written by the company, a card issuer, or a wallet provider. That's a power struggle, and it's just getting started.

The honest case against this read

The strongest objection is that almost none of this is measured honestly yet. Visa's pilot announcement gives no transaction count. Mastercard's demo was nine payments.

And x402's own public dashboard has shown the same four numbers, 75.41 million transactions and $24.24 million in volume over the "last 30 days," on all thirty-five checks our daily scan has run since early September, with no timestamp. We wrote about that in September. A counter that never moves isn't counting anything.

The second is that the Chainalysis figures could describe bots in the bad sense. Wallets that are funded and spend within minutes are exactly what automated farming looks like, where people script fake activity to collect rewards.

Chainalysis filters out wallets that only spent on a single day, and it doesn't say what else it ruled out. Its own report notes that early x402 activity was mostly a memecoin fad that faded.

The third is that it's all very small. Even at a dime apiece, 138 million payments come to under $14 million, a rounding error for Visa.

What keeps me on this side is where the speed is coming from. The fall from 73 days to 18 minutes is a change in what kind of thing is holding the wallet. And card networks announce products when they see a market forming that could leave them out.

What this means for you

If you run a business that sells data, software or anything digital, price something in cents.

The customers asking for it per request are already out there, and a 402 response is how they'll ask to pay. If you sell to businesses, expect invoices to get paid by software, and decide now what an agent has to prove before your portal lets it in.

If you work in payments, the budget is the product. Whoever gives agents spending limits, freezes them when something goes wrong, and settles their tiny payments will own this layer. The card networks moved this week. The open protocol is already there.

If you're just a person with a credit card, the first agent spending money on your behalf will probably be booking something or paying a bill with a card it borrowed from you. Check what it's allowed to spend before you hand it the keys.

Watch three things. Watch for Visa or BILL to publish a transaction count from the live pilot. Watch the x402 counter for the day it finally changes. And watch who signs up for Mastercard's early access program, because the first companies to give agents their own wallets will tell you who thinks machine spending is real.

For twenty-five years the web asked visitors to prove they were human. Now it's asking machines to prove they can pay.

Sources

[1] Mastercard. "What happens when AI agents start paying each other? Watch Mastercard Agent Pay for Machines in action," news brief, October 20, 2026. Hype protein bar demo, nine payments to two merchants under one budget, x402 description, settlement "in fiat or stablecoins," partners. https://www.mastercard.com/us/en/news-and-trends/press/2026/october/Mastercard-Agent-Pay-for-Machines-in-action.html

[2] Visa. "Visa, BILL and Billtrust Launch First Live Pilot for Trusted AI Agent Payments Between Buyer and Supplier Platforms," October 20, 2026. Live status, Trusted Agent Protocol and Agentic Directory, CAPTCHA language, tokenized credentials, BILL and Billtrust figures, Archana Prasad quote. https://usa.visa.com/about-visa/newsroom/press-releases.releaseId.22856.html

[3] Visa. "Visa Announces Enhanced Capabilities That Can Bring Trust and Control to the Future of Business Payments," October 21, 2026. https://usa.visa.com/about-visa/newsroom/press-releases.releaseId.22866.html

[4] Chainalysis. "North America: Inside the Growth of Agentic Commerce," 2026 North America Crypto Adoption report, October 14, 2026. 138 million x402 transactions on Base; 87% of payments between a hundredth of a cent and a dime (sixteen months to September 2026); median wallet age at first spend 73 days (late 2025) to 18 minutes (Q3 2026); first payment within an hour 4% to 67%; categories bought. https://www.chainalysis.com/blog/north-america-crypto-adoption-2026/

[5] Stripe. Pricing page, accessed October 25, 2026. "2.9% + 30¢" per successful transaction for domestic cards. https://stripe.com/pricing

[6] MDN Web Docs. "402 Payment Required." "Reserved for future use," created "to enable digital cash or (micro) payment systems." https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/402. The code appears as reserved for future use in RFC 2616 (HTTP/1.1), June 1999. https://www.rfc-editor.org/rfc/rfc2616

[7] x402.org. Public counter, observed daily by Open Money; identical values (75.41M transactions, $24.24M volume, 94.06K buyers, 22K sellers, "Last 30 Days," no timestamp) on every observation through October 24, 2026. https://x402.org

[8] Open Money. "The x402 Counter Has Shown the Same Four Numbers Since March," September 6, 2026. https://www.danielmcglynn.com/the-x402-counter-has-shown-the-same-four-numbers-since-march/