Visa and Mastercard Are Building Rival Rails for AI Agents to Pay for Things

Mastercard and Visa are each building their own protocol for letting an AI agent initiate a payment on a person's behalf, and the two are not compatible with each other. Mastercard's Agent Pay binds a tokenized card credential to a specific agent, merchant scope, and consent policy through what it calls Agentic Tokens. Visa's Trusted Agent Protocol, launched with Cloudflare in October 2025, issues a Verified Agent ID alongside a separately signed consumer consent record. Different architecture, different trust model, same underlying problem: letting software spend money on your behalf without letting it spend money it shouldn't.

A third rail nobody asked for yet

Alongside the two card-network standards, Coinbase's x402 protocol offers a stablecoin-based rail positioned specifically for machine-to-machine and cross-border B2B payments rather than retail consumer commerce. That's three separate approaches to the same emerging problem, from three companies with genuinely different incentives, running in parallel rather than converging toward one standard.

This is further along than "future roadmap"

Visa states it has already completed hundreds of agent-initiated transactions with partners as of mid-2026, and predicts millions of consumers will use AI agents to complete purchases by the 2026 holiday season. That's a near-term timeline, not a speculative one. If your product roadmap includes any feature where an AI agent needs to complete a purchase, subscribe to something, or move money on a user's behalf, this isn't a protocol you can safely ignore until it settles.

What to actually do about it now

Don't build tightly against one of these three rails as though it's already won. Visa's card-network reach and Mastercard's competing standard both have real distribution behind them, and Coinbase's rail serves a genuinely different use case (B2B, cross-border, machine-to-machine) that the card networks aren't optimized for. If agentic commerce is on your roadmap at all, the safer bet right now is designing your integration layer to be protocol-agnostic, so you're not locked into whichever standard turns out to lose this fight.