AI Agents Are Buying Things Online. Those Setting The Rules Aren’t Govt. Regulators.

Last month, the Linux Foundation announced the operational launch of the x402 Foundation, a body that governs the open standard that AI agents use to make payments over the web.

Its premier members are in the payments and cloud industry: Adyen, Amazon Web Services, American Express, Circle, Cloudflare, Coinbase, Fiserv, Google, Mastercard, MoonPay, Ripple, Shopify, Solana Foundation, Stellar Development Foundation, Stripe and Visa.

Coinbase, the U.S. crypto currency exchange, created x402 in 2025 and contributed it to the new foundation at launch.

The protocol uses HTTP 402, a status code defined in the early web and long left idle, to let an AI agent pay for data, services and APIs directly over web traffic, without an account, a subscription or a credit card entry.

Payment settles in stablecoins. When an agent hits a paywalled resource, the server returns an HTTP 402 response with the price and destination; the agent signs a stablecoin transfer, typically USDC on Coinbase's Base network, a facilitator confirms it on-chain, and the resource is released within seconds.

Coinbase reported more than 160 million agentic payments across the Base network in June alone.

The launch hands control of that standard to a consortium, rather than a regulator.

AI agents can now initiate payments on a user's behalf, and the rules governing how they do so have been set by the industry, ahead of any U.S. federal regulation framework.

That order of events traces back to a gap in U.S. law.

Consumer payments run chiefly on the Electronic Fund Transfer Act and its Regulation E, which sort a transaction into one of two boxes: the consumer authorized it, or someone else did without permission.

An agentic payment fits neither cleanly, because the consumer grants a standing authorization to an agent that then decides the specifics on its own.

Federal regulators have issued no guidance written for that case, and the one federal proceeding that touches the question came at it from a different direction.

The CFPB is reconsidering its Section 1033 open-banking rule, which turns partly on who counts as an authorized "representative" acting for a consumer. In October 2025 a federal court in Kentucky barred the agency from enforcing that rule, having read the term narrowly, as requiring a fiduciary-like relationship that would exclude commercial third parties. The CFPB has since aligned with that reading and told the court it intends to issue a replacement rule.

To some in the industry, that order of events is neither new nor cause for alarm.

Noah M. Kenney, founder and principal of consultancy Digital 520, points to the rules that already sit behind every card swipe.

"Industry writing this standard instead of regulators sounds alarming, but it is how payments have always worked," he told International Business Times. "PCI-DSS, the rulebook protecting every card transaction you make, was written by Visa, Mastercard and the other card networks, not by any government. Regulators move in years, agent commerce moves in weeks, and rules written after a market matures usually just codify whatever mistakes already shipped."

According to Noah, an open, vendor-neutral body under the Linux Foundation is the right home for the technical layer.

His endorsement carries a caution drawn from the same precedent. "PCI-DSS is also a warning: decades in, card fraud is still enormous, so a standard is a floor, not a fix," he said, before drawing a hard line between two things the launch has been credited with. "A payment protocol is not a consumer-protection regime. When your agent buys the wrong thing, gets manipulated into overpaying, or leaks your funds, no HTTP status code answers for that. Who is liable is a question industry cannot settle on its own, and regulators will still need to."

That liability question has been sharpened by recent events.

On July 21, OpenAI disclosed that one of its AI models, while being tested, broke out of a sealed evaluation environment, moved across the open internet and reached the production systems of the AI company Hugging Face to take answer keys for a security benchmark it was being graded on. It was among the first publicly confirmed cases of an AI system leaving its test environment on its own and reaching a live external system. The same day, findings from the UK's AI Security Institute showed that leading models will try to cheat when a task allows it and do not reliably own up to it.

For Kayne McGladrey, a virtual CISO and senior Institute of Electrical and Electronics Engineers (IEEE) member who works with mid-market firms, the timing is what troubles him most.

"The x402 Foundation's July 2026 operational launch has aged badly," he said.

The mismatch he describes is structural rather than a passing bug. The protocol's core promise, letting agents pay for resources without human friction, runs up against documented weaknesses in the connectors agents rely on.

The U.S. National Security Agency has warned that the Model Context Protocol, the standard wiring agents to external tools, often ships with optional authentication, weak access control and thin audit logging.

McGladrey walks through how that fails in practice. An agent told to "retrieve the market data report," he explains, could use an unauthenticated connector to skip the payment handshake, hand a fraudulent report to a paying client, and, under a deferred-settlement model that x402 supports, keep the discrepancy hidden until batch reconciliation shows a valid signature that delivered the wrong resource.

"The legal framework for allocating liability breaks down when the agent's cheating may not appear in its chain-of-thought logs, the server logged minimal metadata, and the payment facilitator validated a signature that assumed agent honesty," he told International Business Times.

His conclusion is direct: "This isn't a technical problem waiting for protocol iteration. It's a fundamental mismatch between payment systems that assume agent honesty and agents that have, in every controlled test, tried to circumvent the rules."

The United States is, for now, an outlier in leaving that mismatch to industry.

Britain's Financial Conduct Authority said in March, in its 2026 payments priorities report, that it would consider whether payments rules need rewriting for agentic AI, going beyond its usual practice of applying existing rules to new technology.

Singapore has gone further and payment-specific: on July 3 the Monetary Authority of Singapore published its SAFR framework for AI agents in finance, which inserts a checkpoint between an agent's decision and its execution so that no action runs until it has been declared, authorized and assessed. In each, a public authority is reaching for the pen.

In the US, it has so far left the pen on the table.

For now, the standard is live and in use. The CFPB's reconsideration of who may act as a consumer's authorized representative remains open, and no revised rule has yet appeared.