AI Agents Got Real Wallets. 37% of Tools Have Flaws.

On March 2, Santander and Mastercard completed Europe's first live end-to-end payment executed entirely by an AI agent—processed through regulated banking infrastructure, no human in the loop. That same week, Snyk published its ToxicSkills research showing 36.82% of skills on the largest open agent marketplace contain security vulnerabilities, with 76 confirmed malicious payloads designed for credential theft and data exfiltration. Agents now have real wallets. The toolchain they depend on is compromised.

Q1 2026 is the quarter AI agents crossed from theoretical to transactional. Five competing payment architectures—Mastercard Agent Pay, Visa Intelligent Commerce, OpenAI and Stripe's Agentic Commerce Protocol (ACP), Google's Agent Payments Protocol (AP2), and Coinbase's x402—all moved from pilot to production within the same ninety-day window. Fiserv integrated both Visa and Mastercard frameworks into its merchant infrastructure. Visa predicts millions of consumers will use agent-initiated purchases by holiday 2026. The money is real now.

But spending ability outpaced security infrastructure. While payment rails matured rapidly, the ecosystems where agents discover and use tools remained largely unvetted. The ClawHub marketplace—the largest open registry for agent skills—saw confirmed malware rates climb with over 1,467 skills flagged by Snyk researchers. This is the gap AgentPMT was built to close: a vetted tool marketplace combined with built-in agent wallets, budget controls at every level, and on-chain audit trails for every transaction. Where other ecosystems separated the payment problem from the tool security problem, AgentPMT solved them together—agent wallets on Base blockchain with x402 and x402Direct enabled, vendor whitelisting that controls which tools agents access, and budget controls enforced per transaction, per day, per week, and per month.

The Week Agent Payments Went Live

The Santander-Mastercard milestone was not a demo. It was a live payment executed through regulated banking infrastructure, with the AI agent initiating and completing the transaction within predefined limits and permissions. Mastercard's Agent Pay framework enables this by combining network tokenization—replacing card numbers with network-issued tokens—with authentication mechanisms that validate whether an agent has been approved to act on a user's behalf and whether the transaction falls within predefined parameters.

Fiserv became the first major payment processor to integrate Agent Pay at merchant scale. Transactions flow through standard authorization, settlement, and reconciliation infrastructure that merchants already use. According to Fiserv, the partnership is "establishing the foundation for secure, intelligent and interoperable agentic commerce experiences." Merchants accept agent-initiated transactions without building custom AI logic, integrating through Fiserv's Clover point-of-sale and eCommerce platforms.

They are not alone. OpenAI and Stripe launched the Agentic Commerce Protocol with Instant Checkout live in ChatGPT, currently operational with Etsy merchants and expanding to Shopify's million-plus merchant base. The system uses a Shared Payment Token (SPT) mechanism that allows agents to initiate payments without exposing buyer credentials—tokens are scoped to specific merchants and cart totals, then processed through Stripe's infrastructure.

Google's AP2 protocol has 60-plus partner organizations including Adyen, American Express, Coinbase, Mastercard, PayPal, Revolut, and Salesforce. AP2 introduces "mandates"—digitally signed statements defining agent spending authority that are portable, verifiable, and revocable across multiple payment rails. Visa's Intelligent Commerce initiative has 100-plus partners worldwide with 30-plus building in sandbox and a Trusted Agent Protocol with 10-plus partners. Coinbase's x402 protocol has processed approximately 50 million transactions by embedding payment directly into HTTP requests.

Five architectures. All live. None fully interoperate. The payments problem is largely solved—multiple viable approaches exist and real money is moving. The question shifted from whether agents can spend money to whether they should spend money through an ecosystem this insecure.

AgentPMT's agent wallets on Base blockchain take a different approach than giving agents raw credentials. With x402 and x402Direct enabled out of the box, agents get native payment capability with on-chain guarantees. AgentPMT's agent credit card integration goes further: the agent initiates a transaction, AgentPMT injects stored payment credentials server-side at the moment of purchase, and the agent receives only a confirmation. The agent never sees the card number, CVV, or expiration date. That distinction matters when the tools agents use are compromised.

The Toolchain Is Compromised

Snyk's ToxicSkills research examined 3,984 skills on ClawHub and the numbers are worse than headlines suggest. Of the total analyzed, 13.4%—534 skills—contain critical-level security flaws. Across the broader ecosystem, 36.82% have at least one security issue. Seventy-six skills contained confirmed malicious payloads designed for credential theft, backdoor installation, and data exfiltration. Most alarming: 91% of malicious skills combine prompt injection with traditional malware—a convergence technique that bypasses both AI safety mechanisms and conventional security tools simultaneously.

The attack sophistication is concrete. Snyk documented the ClawHavoc campaign, in which a threat actor using the handle "zaycv" planted malicious skills disguised as performance optimization tools. One skill alone accumulated 7,743 downloads before removal. Attack vectors included password-protected ZIP archives that bypass automated security scanners, base64-encoded commands that appear benign while executing stage-two payloads from remote servers, and social engineering that positioned malware as "advanced caching and compression" features. A separate vulnerability dubbed ClawJacked, discovered by Oasis Security, revealed that malicious websites could hijack locally running AI agents through WebSocket connections—brute-forcing gateway passwords, silently registering as trusted devices, and gaining complete control over the agent's capabilities without user interaction.

These findings extend beyond a single marketplace—part of a broader agent security reckoning accelerating across the industry. IBM's 2026 X-Force Threat Index reports that adversaries exploited legitimate GenAI tools at more than 90 organizations through malicious prompt injection. Vulnerability exploitation became the leading attack vector at 40% of observed incidents. Infostealer malware exposed over 300,000 chatbot credentials in 2025 alone. As IBM's cybersecurity leadership put it: "Attackers aren't reinventing playbooks, they're speeding them up with AI."

A compromised agent skill runs with whatever permissions the agent has. Terminal access. File system access. Stored credentials for cloud services. When that agent also has a wallet, the attack surface is not just data—it is financial.

This is precisely the dynamic where MCP tools become the threat vector rather than the solution. An open agent marketplace where confirmed malware accounts for 12% of entries and 37% have security flaws is not a marketplace. It is an attack surface with a search bar.

AgentPMT's marketplace is the direct counter to open, unvetted registries. Tools and skills go through a vendor onboarding process with whitelisting and product-level restrictions that define exactly what agents can access. Dynamic MCP fetches tools on demand—nothing enters the agent's context until actively needed, which limits the attack surface to what the agent is actually using rather than every tool in the catalog. The server costs $0, runs as a 5MB binary, and auto-detects platforms. This is the difference between an open registry where a third of entries have security flaws and a curated marketplace with verified vendors.

The Missing Governance Layer

If the payment rails work and the tools exist but there is no governance layer between them, what you have is an agent with an open checkbook browsing a compromised app store. CIO Magazine recently described this gap as the missing "agent control plane"—a deterministic wrapper around probabilistic AI cores that intercepts agent outputs before they reach enterprise systems, applying hard-coded logic gates that enforce business rules regardless of the LLM's reasoning process.

The architecture is straightforward. Budget checks reject or route requests exceeding thresholds to human review. Vendor verification cross-references actions against approved supplier databases. Execution occurs only after all deterministic checks pass. Each agent receives what amounts to a service passport defining human accountability, budget limits, and probation status. Kill-switch mechanisms monitor agent confidence scores and halt execution automatically when they drop below safe thresholds.

Research cited by Help Net Security underscores why this must happen at the infrastructure level, not the model level. Fine-tuning attacks bypassed model-level guardrails in 72% of cases against Claude Haiku and 57% against GPT-4o. Eighty percent of surveyed organizations reported risky agent behaviors including unauthorized system access and improper data exposure. Only 21% of executives had complete visibility into agent permissions, tool usage, or data access patterns. The average enterprise hosts 1,200 unofficial AI applications, and 86% of organizations reported no visibility into their AI data flows. Relying on the model to police itself is not governance. It is hope.

Privacy.com recognized part of this problem by launching virtual cards specifically for AI agents—spending limits enforced at the card authorization level, merchant-locked cards restricted to specific vendors, and single-use cards that close after one transaction. They are building stablecoin-funded cards that bridge crypto and traditional payment infrastructure. These are useful controls, but they address only payment authorization without touching tool vetting, audit trails, or workflow governance.

AgentPMT is the realized version of what CIO Magazine describes as theoretical. The multi-budget system enforces daily, weekly, monthly, and per-transaction limits at the infrastructure level—not as suggestions to the model but as hard gates that reject unauthorized spending. Vendor whitelisting controls which tools agents access. Product-level restrictions define exactly what an agent is authorized to purchase. Every tool call has a visible price. Every workflow has a total cost. Agent credits—100 credits equals $1 USD—are only charged for successful tool calls, with failed calls automatically refunded. Full request and response capture with prompt correction capability means every interaction is auditable and correctable. When the stakes are high enough, human-in-the-loop capability lets agents escalate decisions to their operator via the AgentPMT mobile app. This is not a bolt-on governance layer. It is built into the infrastructure from the start.

What This Means For You

The convergence of live agent payments and compromised agent tool ecosystems creates a specific, quantifiable risk: agents with access to real money operating through toolchains where more than a third of available skills have security flaws. This is the current state of agentic commerce in March 2026—not a projection or a scenario but what is actually happening.

For builders and business owners deploying agents, the implication is direct. Payment capability without governance infrastructure is a liability. Every tool call without a budget limit is an open checkbook. Every marketplace skill without vetting is an attack vector with access to that checkbook. The companies that build the control plane—budget controls, tool vetting, audit trails, human escalation—will scale agent deployments safely. AgentPMT solved this intersection before most companies recognized it existed: a vetted marketplace eliminates the poisoned toolchain problem, agent wallets with x402 and x402Direct provide native payment rails with on-chain guarantees, and infrastructure-level budget controls enforce spending limits that no prompt injection can override.

What to Watch

Mastercard's Agent Pay rollout will move into extended testing and scaling—additional banks and geographies should follow in Q2 2026. How the OpenClaw community responds to Snyk's findings will signal whether open agent marketplaces can self-govern or whether curated alternatives will dominate. Colorado's AI Act compliance deadline, now June 30, 2026, and the Commerce Department's March 11 evaluation of state AI laws will shape compliance requirements for autonomous agent transactions. Whether ACP, AP2, UCP, and x402 begin interoperating or continue as siloed ecosystems remains open—Adobe Commerce already supports both UCP and ACP simultaneously, which may signal a multi-protocol future. Enterprise budget allocation toward agentic security governance will define market standards for the control plane layer.

The payment rails are live. The tools exist. The agents are spending. What is missing is the infrastructure that makes all of it safe—the governance layer that controls what agents access, what they spend, and what happens when something goes wrong. The companies building that layer now are not solving a security problem. They are building the foundation every agent-powered business will eventually require.

AgentPMT is where automated businesses are created. Vetted tools, controlled spending, full audit trails—the infrastructure for agent-powered businesses that actually operate safely. Explore the marketplace and set up your agent's budget controls.

Key Takeaways

Five competing AI agent payment architectures went live in Q1 2026, with Santander and Mastercard completing Europe's first regulated AI agent payment on March 2
Snyk's ToxicSkills research found 36.82% of skills on the largest open agent marketplace have security vulnerabilities, with 76 confirmed malicious payloads
Model-level AI safety guardrails are insufficient—fine-tuning attacks bypass Claude Haiku in 72% of cases and GPT-4o in 57%, making infrastructure-level governance essential
The governance gap between agent spending ability and agent security infrastructure is the most urgent problem in agentic commerce

Sources

Santander and Mastercard Complete Europe's First Live End-to-End Payment Executed by an AI Agent - Mastercard Newsroom
ToxicSkills: Malicious AI Agent Skills on ClawHub - Snyk
AI Went From Assistant to Autonomous Actor and Security Never Caught Up - Help Net Security
The Agent Control Plane: Architecting Guardrails for a New Digital Workforce - CIO
IBM 2026 X-Force Threat Index - IBM Newsroom
Buy It in ChatGPT: Instant Checkout and the Agentic Commerce Protocol - OpenAI
Announcing Agents to Payments AP2 Protocol - Google Cloud Blog
Inside the ClawHub Malicious Campaign: AI Agent Skills Drop Reverse Shells - Snyk
Fiserv and Mastercard Expand Partnership to Enable AI-Initiated Commerce - PYMNTS
ClawJacked Flaw Lets Malicious Sites Hijack Local AI Agents via WebSocket - The Hacker News
AI Agent Payment Solutions in 2026 Compared - Privacy.com
Agentic Payments Explained: ACP, AP2, and x402 - Orium
Stripe Powers Instant Checkout in ChatGPT and Releases Agentic Commerce Protocol - Stripe Newsroom
Visa and Partners Complete Secure AI Transactions, Setting the Stage for Mainstream Adoption in 2026 - Visa