Visa admits some AI agents to its payment network with authorisation rules undisclosed

Taneja put the threat in film terms. "we have seen the trailer... I think this is just a small snippet of what the movie will look like," he told Reuters ^[5]. Part of the defensive side is now public code ^[1]. The agent side is the part that moves money. The Reuters account, as summarised in a dev.to post, does not say how many agents Visa has admitted, which ones, or under what controls ^[2][3].

For a team wiring an agent to a card, the only authorisation rules it can read and test are its own. In my view two of them belong outside the model's context: a hard spending cap per agent credential, and a human approval step above a fixed amount. Both should run in code the agent cannot edit. Whatever Visa checks on its own side is a second layer, and its strength is unknown.

The dev.to post offers one design. Its author proposes scoring every payment instruction, paying automatically at 0.80 or above, asking a human between 0.50 and 0.79, and escalating below 0.50 ^[9]. The author ran it against a live endpoint at scriptmasterlabs.com ^[14]. The published request sets "amount_usd":0 and asks, in prose, whether an agent should authorise payments on a Visa card with no per-payment approval ^[13]. So the gate scored a policy question as if it were a payment. It returned 0.35 and escalated, from a decider labelled local-heuristic-v1 with calibrated=false ^[10]. The author printed the weak result next to the proposal. A second question, about the sandbox escape, also scored 0.35, and the heuristic "cannot discriminate between them," the author wrote ^[10][16].

For those thresholds to carry over to anyone's traffic, the score has to be calibrated on that team's own payments. A 0.80 should be right about four times in five, on that team's merchants and agents. The author makes the same point: "a score is only as good as its calibration" ^[15]. The band edges also set the review workload. Visa handles about a billion payments a day worth around $15 trillion a year ^[7]. That averages out to roughly $41 a payment ^[1]. The average covers all card traffic, and agent purchases may run larger or smaller. On traffic like that, a wide confirmation band puts a person in front of a great many small purchases.

The author concedes a confidence gate would not have retroactively stopped Mythos or the sandbox escape ^[12]. It targets a different failure: an agent with a valid credential spending when it should not. The Reuters report, as quoted in the post, described the network's position this way: "payments firms rely on trust, meaning cyberattacks can be devastating" ^[8].