What Happens When AI Agents Can Spend Your Money?

Summary

• In the last three months, agents jumped from “spectators to actors” because payment credentials are their “arms and legs.” Terry Angelos, VGS chief strategy officer, says access to payment credentials makes agents much more useful. His example: an agent didn’t just recommend piano teachers; it checked schedules and booked the first lesson, “infinitely more useful than dumping yet another task on my doorstep.”
• That shift has “kicked off what I call the wallet wars”—every wallet racing to connect to agents. Agents want a wallet with many consumers who already have credentials stored and broad merchant reach: Stripe Link has about 300M consumers and 1M merchants; Shop Pay has similar consumer reach and probably about 1.7M merchants; PayPal has over 400M accounts, depending on measurement, and around 30M merchants.
• Terry’s sharpest frame: “Stripe in many ways is like the AOL of agentic commerce”—a walled garden that works until its limits get in the way. When Link lacked a Walmart connection, Stripe bought Terry’s outdoor lights with a one-time Visa virtual card and charged him separately. But Walmart’s follow-on Walmart+ offer failed because that one-time-use card couldn’t support the new transaction. In a test, AmEx sent someone seeking help with the transaction to a phone number that went straight to a Stripe engineer—not a chargeback process.
• The open-standards answer—network “agentic tokens”—went from zero to “a few million of these tokens per week” in three months, with VGS “by far the largest provider.” A registered, verified agent gets a new 16-digit token with transaction context; the merchant charges the consumer’s real card, preserving network chargeback rules and follow-on transactions. Agent-error liability remains unresolved.
• VGS’s position is built on scale and neutrality: it secures credentials for “about a third of all e-commerce by GMV,” holds 10 billion credentials, and serves the largest merchants, neobanks, and frontier labs. Terry’s thesis: vaults are going “from single-player to multiplayer”—for example, a frontier lab’s subscription vault can now make credentials available to agents—and “any business going from single-player to multiplayer inherently becomes more interesting.”
• Merchant responses may split three ways: “fear on the Amazon side, greed on the Walmart side, and no choice on the SMB side.” Alex Rampell says Amazon has rational reasons to resist agents: “you can’t monetize an agent’s eyeballs because the agent doesn’t have eyeballs.” Terry sees an open-banking parallel: negotiated access through APIs that may limit data and may carry fees.
• Agent liability is unresolved—and could become a competitive differentiator. Terry says that if an agent makes a mistake despite the network validating the agent and instruction, the dispute mechanism is “sort of unresolved”; he thinks agents may have to take responsibility. Overhyped: a bank run from yield-maximizing agents. Underhyped: unmonetized demand—“human desires and needs are infinite”—while rewards and other breakage models may be disrupted.

Deep dive

1. VGS is the boring, neutral vault behind a third of online commerce

• Terry’s description: VGS captures, vaults, and retrieves payment credentials so “the online ordering company never actually has to touch the payment information.” It secures about a third of all e-commerce by GMV, serves the largest online merchants, neobanks, and frontier labs, and stores 10 billion credentials. Rampell says he almost guarantees listeners have a credential stored at VGS through a merchant that uses it. He also describes VGS as taking PCI compliance out of scope.
• Why merchants can’t easily do this themselves: a merchant doing about $1B in GMV typically uses three to five processors for differences in costs, approval rates, and regions—“you want to shard.” Each processor multiplies the vaulting and update burden. About a third of cards turn over each year; network tokens are domain-bound to a merchant, and networks have their own standards for updating credentials.
• Rampell’s example of the failure mode: his Capital One Visa became a Discover card after the acquisition, and “every week I get notifications from very sad merchants—we are unable to process your card.” One merchant cannot map the old card to the new one; a large vault can use network account-updating tools to get those updates. VGS acts as an independent vault for merchants using multiple processors.

2. Agents got arms and legs—and the wallet wars began

• The episode’s central claim, in Terry’s words: “in the last 3 months we’ve had this huge leap from agents being what I would call spectators to agents being actors… they effectively have arms and legs, which are payment credentials.” His piano-teacher story carries it: an earlier ChatGPT query produced recommendations, but an agent later asked questions, checked schedules around his son’s activities, and booked the first lesson.
• The structural consequence: “we’ve kicked off what I call the wallet wars where every wallet is now rushing to connect to the agents.” An agent wants two things from a wallet: many consumers with stored credentials and broad merchant reach. Terry sizes the field: Stripe Link has about 300M consumers and 1M merchants; Shop Pay has similar consumer reach and probably about 1.7M merchants; PayPal has over 400M accounts, depending on measurement, and on the order of 30M merchants.
• Rampell’s historical rhyme: wallet wars are old—from “dead-cow wallets” and Capital One paying Samuel L. Jackson to the NASCAR-like checkout page, with issuers such as Chase and AmEx paying tens of millions of dollars to get their cards preferred at Uber and Airbnb. The 2 a.m.-flowers problem that helped motivate consumer wallets is also an agent friction problem.
• Terry distinguishes wallets that store a credential and hand it to a merchant from transaction wallets such as Shop Pay, Link, or PayPal, which collect money from the consumer and remit it to the merchant. Agentic commerce is becoming a blend of the two.

3. Stripe is the AOL of agentic commerce—and the walled garden can break trust and merchant relationships

• Terry’s chandelier story, told as a compliment: “Stripe in many ways is like the AOL of agentic commerce.” An agent found outdoor lights at Walmart, but Link had no Walmart connection. Stripe bought the item on Terry’s behalf with a one-time Visa virtual card, then charged him in a second transaction, DoorDash-style. The purchase worked, but the arrangement created problems.
• Disputes: if Terry calls his bank about a Walmart purchase, “we don’t see a Walmart transaction here—we just see a Stripe transaction.” In a test, someone used an AmEx card and called AmEx about a transaction with the merchant; AmEx only saw Stripe and provided a phone number for the Link merchant. The call went straight to a Stripe engineer, because Stripe wasn’t set up to run a chargeback.
• Follow-on merchant relationships: Walmart emailed Terry about crediting his $6.99 delivery charge toward Walmart+ if he subscribed. The subscription transaction failed because the card Walmart had was the Stripe one-time-use card. Terry frames this as a break with e-commerce norms: merchants spend money to acquire customers and want the chance to build a relationship and upsell them.
• Rampell’s underlying point about why Visa and Mastercard are “impregnable”: chargebacks are a trust mechanism that makes both sides willing to transact. Crypto, by contrast, is a bearer instrument: “I pay you with crypto, I’m never getting that back,” which can be a bug or a feature.

4. Agentic tokens went from zero to millions per week, and vaults turned multiplayer

• The open-standards approach: card networks’ agentic tokens let wallets hand credentials to agents safely. The agent must be registered with the network, and the transaction can carry context—for example, “I’m about to make a transaction. I’m a verified agent. I’m going to spend no more than $100.” The agent passes a new 16-digit number to the merchant, which charges the consumer’s card, preserving chargeback rules and the possibility of follow-on transactions.
• The growth number worth remembering: “3 months ago, this was at zero. It did not exist… now we’re doing a few million of these tokens per week,” with VGS “by far the largest provider.” VGS supplies them for agents, wallets, and some merchants.
• Terry’s generalization: vaults are going “from single-player to multiplayer.” A frontier lab that vaulted cards to bill subscriptions can now make that credential available to its agent under open standards—much as a personal vault can be shared with others. “Any business that is going from single-player to multiplayer inherently becomes more interesting.”

5. Valid card, valid owner, sound mind—agent liability is the open question

• Rampell’s three-step framework: is the card valid (a checksum can establish that it is in the valid universe of numbers, and the bank can confirm it is an actual card); is the person interacting with the merchant the valid owner; and, in his Vegas example, is the buyer of sound mind? The internet made the second question hard to answer; agents make it harder still.
• The networks’ standards address agent identity: the agent must be registered with Visa, Mastercard, or AmEx, and the transaction can include context about what it is authorized to do. But Terry says the standards do not yet resolve what happens if an agent gets the details wrong—such as booking the wrong hotel dates even though the network validated the agent and instruction. That dispute mechanism is “sort of unresolved”; he thinks agents may have to take some responsibility.
• Rampell’s delegated-authority concern: merchants have dealt with “friendly fraud,” such as a consumer disavowing a purchase they did make; for small transactions, banks may refund consumers rather than fight. He says that creates moral hazard, and suggests an agent’s willingness to take liability could become a value-add in competition for users.

6. Amazon’s incentives to resist, Walmart’s possible opening, and SMBs’ limited choice

• Amazon recently blocked Muse. Rampell says the antagonism is rational, not simply laggard behavior: Amazon is an advertising company, and “you can’t monetize an agent’s eyeballs because the agent doesn’t have eyeballs.” He argues that selling attention can be more valuable than selling the product.
• Terry’s tentative taxonomy: “maybe there’s fear on the Amazon side, maybe there’s greed on the Walmart side”—a major retailer with strong last-mile delivery might see agents as an opportunity—“and maybe there’s no choice on the SMB side,” where merchants under Shopify may see a vital new channel. His open-banking analogy is the Plaid-and-banks experience: negotiations could result in access through APIs that limit what data is shared; account tokenization and possible fees were also raised.
• Terry also imagines merchants having their own agents, like a Best Buy salesperson who helps a customer but earns a commission. Amazon might function as an “opinionated API” with its own view of what a customer should buy, in conversation with the customer’s agent. “In the end, I think consumers probably win, but we don’t know what that’s going to look like.”
• Rampell warns that early consumer wins depend on asymmetry: a small number of consumers have tools that counterparties may not detect. Terry’s restaurant-reservation example is that the first few people with a tool to call at 7 a.m. benefit, but if everyone uses it, the venue gets too crowded. Rampell says Comcast appears to block some agent logins, possibly based on IP addresses; he says he has ChatGPT, Codex, and Astra log in on his computer to do tasks. He expects counterparties eventually to recognize agents and demand to speak to the person instead.

7. Overhyped, underhyped, and VGS’s three compounding eras

• Overhyped, per Terry: “I don’t think we’re going to get a bank run on savings deposits” from agents moving money to maximize yield. He contrasts a Mercury personal account with Chase: even if Mercury offers a good savings rate, Chase’s bill pay and integrations work better for him, and that friction limits the prospect of extreme volatility.
• Underhyped: unmonetized demand. Terry’s cycling WhatsApp group has a member who periodically recommends tires based on rolling resistance; Terry says he would buy them more often if his agent acted on those recommendations. Agents may also save money by finding forgotten subscriptions or trials that are hard to cancel. “As far as I can tell, human desires and needs are infinite.”
• Another potential disruption: if agents intermediate transactions and route spending to the card that earns points, the card-rewards ecosystem—and other models built on breakage—may have to change.
• Where VGS goes: Terry describes three overlapping eras—the vault, built over a decade into a trusted store for credentials; information going into and out of the vault, including updates and network tokens; and the “network era,” brokering credentials among parties according to the rules. VGS is also working with banks on tokenization. As it adds services for more merchants and issuers, Terry expects network effects; “agentic commerce is just fuel into that ecosystem.”