An AI agent built by an OpenAI employee was supposed to send about $310 to a stranger on X who had asked for help with medical bills. It sent $441,780 instead. A units error. The agent had a wallet, the wallet had a balance, and nothing between the agent’s intention and the transfer knew that one of those numbers was wrong by a factor of fourteen hundred.
That was February. Yesterday Cloudflare announced Wallets, a product whose entire purpose is to give AI agents money to spend. It is in early access, the actual funding part is “coming in the months ahead,” and I think it is one of the more important things to ship this year, precisely because of what happened in February.
Everyone built the same thing this year
Cloudflare is late to a party that started in March. Here is the guest list, because the density of it is the point.
Stripe published an open standard called the Machine Payments Protocol on March 18, for software paying software. Google moved its Agent Payments Protocol, the one that lets an agent buy something when you are not present, to the FIDO Alliance in April so no single company would own it. Amazon put agent payments into Bedrock in May. Mastercard launched Agent Pay for Machines on June 10 with programmable spending limits and thirty-odd partners signed on. Visa ran the first live agent purchases in Europe on July 2, with real merchants and a dozen banks.
Five of the largest payment companies on earth, plus the two biggest clouds, in five months, all answering the same question: how does a piece of software pay for something without a human typing in a card number?
When that many serious companies converge on one problem that fast, the problem is real. The agents we have been writing about since the April state of things can read, analyze, draft, and decide. The one thing they could not do was transact. That is about to stop being true.
What an agent wallet actually is
Strip the branding and every one of these products is the same three parts. A balance the agent can draw on, which is usually a stablecoin because stablecoins settle in seconds and do not require a bank to be open. A set of rules about what the balance can be spent on, which is the interesting part. And a receipt, so a human can see afterward what happened and why.
Cloudflare’s version has per-transaction limits, allowances that refill on a schedule, and a list of merchants the agent is allowed to pay. Mastercard’s has programmable spending limits and a way to register which agent is acting for which person. Google’s protocol has a signed record of what you asked for, so if the agent buys the wrong thing there is a document showing whether it misread you or you misspoke.
Notice that none of this is about intelligence. The agent in February was plenty intelligent. What it lacked was a wall between “I intend to send this much” and “this much is now gone.” Every product on the list above is, at bottom, that wall.
The limit is the product
I have come to think the spending limit is the whole thing, and the agent behind it is almost incidental.
Think about how a business handles this with people. You do not give a new hire the company checkbook and hope. You give them a card with a limit, a list of things it is for, and a policy that says anything over some number needs a signature. The employee’s judgment is real and you trust it, up to a line. Past the line, a second person looks.
That is exactly the shape of a good agent wallet, and it is why I find these products reassuring rather than alarming. An agent with a hard $200 monthly allowance and a whitelist of three vendors cannot do what the February agent did, no matter how confused it gets. The intelligence can be wrong. The wall does not care.
We wrote in The Agent Vocabulary that guardrails are the difference between an agent that drafts an invoice and one that sends money. The wallet is where that sentence stops being a metaphor.
What to do before your software gets a card
Nothing this month, and then a few specific things.
Nothing this month because, for a small business, none of this is production-ready in August 2026. Cloudflare’s funding is not live. Visa’s pilots are in Europe. The Mastercard and Stripe pieces are for developers building platforms, not for a dentist’s office. If a vendor tells you their agent can pay your bills today, ask which of these rails it is on and what the limit is, and listen carefully to the answer.
Then, when it does arrive, and I would guess within a year for the boring cases like renewing a domain or reordering supplies, three rules.
Give the agent its own account, never yours. A separate balance with a separate limit. If it has to be a card, make it a virtual card with a cap, the kind you can already get from most business banks. The agent should not be able to see, let alone touch, the operating account.
Set the limit lower than feels reasonable. The right number is the amount you would shrug at losing to a units error. For most small businesses that is a few hundred dollars, not a few thousand. You can raise it later once the receipts have been boring for a while.
Read the receipts for the first month. Not the summary, the line items. The February agent’s mistake would have been obvious on a receipt in under a second. The problem was that nobody was reading one until the money was gone.
The agents are getting wallets. The wallet is the part worth thinking hard about. An agent that can spend money is only as safe as the wall around the money, and that wall is a design decision you get to make before the first dollar moves.