The wallet wars: AI agents get payment credentials and everyone wants to issue them

Agents get wallets

In the last three months, AI agents have gone from spectators to actors in commerce, according to a16z general partner Alex Rampell and VGS chief strategy officer Terry Angelos, because they effectively have arms and legs now: payment credentials. The card networks have responded by introducing agentic tokens that let wallets securely hand credentials to agents for merchant transactions, and the networks now require AI agents to be registered to validate the legitimacy of payment requests. VGS says it is already processing a few million agentic tokens a week, up from zero three months ago. m:…1593

The fight that follows is over who becomes the default credential provider. Rampell and Angelos call it the wallet wars. The combatants are not small: PayPal has more than 400 million accounts and about 30 million merchants; Link has roughly 300 million consumers and a million merchants; Shopify's Shop Pay has a similar consumer base with about 1.7 million merchants. Stripe demonstrated the agent pattern by issuing a one-time-use Visa virtual card to complete a purchase at Walmart on a user's behalf, though the episode notes that one-time cards make follow-on services like subscriptions hard to manage. m:…1593

The vault underneath

Underneath sits the vault. Modern payment infrastructure is shifting from single-player vaults, one merchant and one processor, to multi-player architectures that distribute network tokens across processors like Chase, Stripe, Adyen, Braintree, and Razorpay. VGS describes itself as an independent, neutral vaulting infrastructure that takes PCI DSS compliance out of scope for merchants, and says it secures credentials for about a third of all e-commerce by gross merchandise value. It stores roughly 10 billion credentials, covering about 80% of cards in America. Large merchants typically use three to five different payment processors, which is why a single vault has to serve them all. m:…1593

Not everyone wants agents at the table. Amazon blocked the AI agent Muse, a move the episode attributes to Amazon's reliance on advertising revenue from user eyeballs on its own site. The conflict, the guests argue, mirrors the evolution of open banking, where access was eventually mediated through restricted, tokenized APIs. Liability for agent errors, from hallucinations to wrong transaction details, remains an unresolved issue in current payment standards. m:…1593

The wallet as bank branch

While Silicon Valley debates agent credentials, the wallet-as-bank-branch is already reality elsewhere. DriveWealth is providing the brokerage infrastructure, custody, clearing, settlement, and regulatory reporting, to put U.S. stock investing inside TrueMoney's digital wallet for more than 30 million users. Investors can start with as little as 30 baht, buy fractional shares, and earn optional stock rewards on everyday purchases. The service runs through Webull Securities Thailand, a Thai SEC-licensed broker. m:…5536

Security and plumbing

The custody stakes are rising with the wallet's importance. Ledger disclosed that criminals intercepted genuine hardware wallets and installed hidden components designed to capture recovery phrases during setup. The company says the attack was a localized distribution breach rather than a systemic supply-chain compromise, affecting devices sold through specific resellers in Southeast Asia and Hong Kong, and that its chip, operating system, and servers were not compromised. Ledger is now requiring authorized resellers to stop displaying devices on shelves and hand stock directly to customers at purchase, and it asked resellers in Southeast Asia and Hong Kong to suspend sales while it works with law enforcement and the SEAL_911 security group to track the attackers' infrastructure and funds. m:…1410

And beneath the merchants, the data layer is being rebuilt. Stripe launched real-time sync from its Data Pipeline to Postgres, covering Supabase, AWS, Neon, and Databricks Lakebase, streaming payment, customer, and subscription data with no code and handling the sync end to end, including backfills. Support for Snowflake, Google BigQuery, Amazon Redshift, Databricks, and cloud storage is coming. m:…5732