205 Million Agent Payments Just Landed. Every Protocol Signs the Mandate. Nobody Records What the Agent Actually Bought.

This week, the agent economy got a wallet.

In Shanghai, the Bund Conference (September 9–12) opened with agentic payments as its centerpiece — Ant's assistant "Abao" now handles ordering, ride-hailing, booking and payment end to end across phones, car systems and AI glasses. Coinbase disclosed that x402, the HTTP-native machine-payment protocol it incubated with Cloudflare, has passed 205 million transactions settling roughly $53 million across 200,000 sellers, with the overwhelming majority of on-chain agent commerce running on it. Google's AP2 protocol — 60+ payment partners from Mastercard and PayPal to Ant International, now governed by the FIDO Alliance — turned "human not present" spending into a shipping standard. Alipay's ACT, Visa's TAP, Mastercard's Agent Pay, Stripe's MPP, Amazon's AgentCore: the rails are being laid, fast.

And in two days — September 11, 2026 — the EU's Cyber Resilience Act flips on mandatory 24-hour reporting of actively exploited vulnerabilities, with AI agents, MCP servers and inference endpoints explicitly inside scope.

Here's the tension nobody at either event is talking about: every payment protocol answers one question beautifully — "was this purchase permitted?" None of them answers "what did the agent actually do?" And the second question is the one regulators, courts and chargeback departments are about to ask.