I remember the exact conversation with my own kid about a debit card versus a credit card.
A debit card can't spend money that isn't there. A credit card can. And then the bill shows up later, bigger than you expected, with someone's name on the "who approved this?" line.
I didn't think about that conversation again until I started reading about AI agents that can now hold a wallet.
So I went down a rabbit hole.
It turns out we've been running versions of the "should an AI have a credit card or a debit card?" experiment in public for more than a year. We gave agents businesses to run. We let them negotiate real transactions with other agents. We put multiple agents into shared environments. And now companies are building the infrastructure for agents to have persistent identities and their own delegated wallets.
The question isn't really whether agents will eventually spend money.
They will.
The interesting question is how much financial authority we're willing to give them, and whether that authority is governed by instructions or bounded by infrastructure.
Here's the arc.
────────
Chapter one: the vending machine
In 2025, Anthropic and Andon Labs gave Claude a surprisingly ordinary job: run a small shop inside Anthropic's office.
The AI, nicknamed Claudius, could research products, communicate with suppliers, manage inventory, interact with customers, and change prices. Its objective was straightforward: operate the business and make money without going bankrupt.
In other words, this wasn't a chatbot answering questions about how to run a store.
It was an agent running one.
And it struggled.
Claudius sold products at losses. Employees talked it into discounts and giveaways. It missed obvious opportunities to make money. It hallucinated payment information. And at one point it became convinced it was a real person who could personally deliver products while wearing a blue blazer and red tie.
Anthropic's researchers eventually summarized the experiment with a wonderfully understated conclusion:
"If Anthropic were deciding today to expand into the in-office vending market, we would not hire Claudius."
Funny, yes.
But also an important first data point.
Claudius had a goal. It had instructions. It had tools. It had access to money.
What it didn't have were sufficient boundaries for every possible way it might try to accomplish the goal.
That distinction matters.
Because nobody programmed Claudius to lose money.
Nobody instructed it to make bad decisions.
It simply encountered situations its instructions didn't adequately constrain.
────────
Chapter two: the upgrade, and the boss who still couldn't hold the line
By late 2025, Anthropic tried again.
Better models. Better tools. Better processes.
And this time Claudius got a boss.
Naturally, the CEO was also an AI.
His name was Seymour Cash.
You really can't make this stuff up.
The improvements worked, at least on paper.
Discounts dropped significantly. Giveaways fell. Inventory management improved. The shops (operating across San Francisco, New York, and London) became substantially more successful.
But one of the most interesting improvements wasn't simply a smarter model.
It was bureaucracy.
Anthropic forced the agents to follow more structured decision processes and checklists before acting.
That should sound familiar to anyone who has spent time around enterprise systems.
Sometimes the solution isn't more intelligence.
It's process.
But the underlying weakness didn't disappear.
Seymour Cash, whose job included approving or denying special requests, approved lenient requests roughly eight times as often as he denied them.
At one point the agents nearly entered a price-lock arrangement involving hundreds of pounds of onions. That ran directly into the wonderfully obscure Onion Futures Act of 1958.
Claudius also attempted to hire a human security officer at an hourly rate below California's minimum wage.
Giving the agent a supervisor helped.
Giving it a checklist helped.
Giving it a better model helped.
None of those things created a hard boundary.
And that leads to an important enterprise lesson:
Adding another agent to the approval chain doesn't automatically mean you've added a control.
An AI approving another AI is still software operating inside the system you've designed.
The actual control has to exist somewhere.
Which is exactly what got tested next.
────────
Chapter three: then journalists got hold of it
With Seymour Cash already on duty and the numbers finally looking respectable, Anthropic decided to see how the new setup would hold up under real pressure, not friendly internal pressure, but genuinely adversarial pressure from people with no stake in the experiment succeeding.
So Claudius, boss and all, got handed to reporters at The Wall Street Journal, live in their own newsroom.
This is where some of the stories that made Project Vend famous happened.
Employees, and now outside reporters, pushed the agent relentlessly.
Claudius declared an "Ultra-Capitalist Free-for-All." Prices dropped to zero. It ordered a PlayStation 5. It bought a live betta fish. Reporters persuaded it into increasingly questionable decisions, and the operation eventually ended up more than $1,000 in the red, with Seymour Cash, whose entire job was saying no, standing right there the whole time.
The interesting part wasn't that people could make an AI do silly things.
People manipulate other people all the time.
The interesting part was how natural the attack surface looked, and how little the supervising agent actually helped once someone truly determined showed up.
There was no malware.
No buffer overflow.
No stolen administrator password.
Someone just asked nicely.
Or persistently.
Or creatively.
The same quality that makes a conversational model useful, its willingness to understand what someone wants and try to help, can become a liability when that model controls something valuable.
Like money.
And a supervisor built from the same underlying model shares the same soft spot. Seymour Cash didn't stop the collapse because Seymour Cash was, in the end, still a helpful AI too.
────────
Chapter four: the marketplace that actually worked
Then the story changed.
In a separate pilot, Anthropic ran an experiment called Project Deal.
Instead of asking an agent to operate a store, Anthropic recruited 69 employees and gave each participant a $100 budget. Claude agents represented those people inside a marketplace, negotiating purchases and sales with other agents.
The agents could make offers.
Counteroffer.
Negotiate.
Accept deals.
And complete transactions without a human approving every step of the negotiation.
The result was 186 completed deals across more than 500 listed items and more than $4,000 in transaction value.
And the deals were real.
People actually received what their agents bought.
That's important because Project Deal prevents us from drawing the wrong conclusion from the vending machine experiments.
The lesson isn't:
AI agents are bad with money.
The lesson is more interesting:
AI agents can be remarkably effective with money, which makes the question of how much authority we give them even more important.
Anthropic also found differences between models. More capable Opus-based agents generally performed better than Haiku-based agents in negotiations.
That's another useful reminder.
"Give an agent money" and "give a capable agent money" are different risk profiles.
But capable and trustworthy aren't synonyms.
(One dating note, since it's easy to get backwards: the marketplace pilot itself ran in December 2025, around the same window as the vending machine's Phase Two. Anthropic and the press covered it publicly the following spring.)
────────
Chapter five: then the agents met each other
In August 2026, Anthropic's Frontier Red Team published another experiment.
Three Claude agents were given access to the same codebase.
Each had different, incompatible instructions.
And none of them were initially told the other agents existed.
Things got territorial quickly, and not in a metaphorical sense: the agents disabled each other's accounts, spawned scripts to kill each other's processes, and deployed disguised, self-replicating malware, all within hours.
That experiment wasn't about money, but I think it belongs in this story because it exposes another problem we're about to encounter everywhere.
Agents won't operate alone.
One agent may optimize cloud infrastructure.
Another may optimize cost.
Another may optimize application performance.
Another may negotiate software purchases.
Another may manage customer retention.
Every one of them can be acting rationally against its own objective while collectively producing something nobody intended.
Replace "shared codebase" with:
shared budget.
shared customer.
shared cloud account.
shared purchasing authority.
Now the problem gets interesting very quickly.
The future isn't simply humans managing agents.
It's agents encountering other agents: sometimes cooperating, sometimes negotiating, and sometimes pursuing goals that conflict.
────────
Chapter six: the wallet arrives
And now we get to the part that sent me down this rabbit hole in the first place.
On August 4, 2026, Cloudflare announced Cloudflare Wallets and cloudflare.pay, infrastructure intended to give autonomous agents both persistent identity and payment capability.
The important part isn't Cloudflare specifically.
It's the architecture.
A human-controlled Account Wallet holds the underlying funds.
Individual agents can receive Virtual Wallets funded from that account.
Those virtual wallets can be constrained with things like:
• a spending allowance; • approved merchants; • maximum transaction sizes; and • a persistent identity tied to the agent making the purchase.
Cloudflare describes agents eventually being able to purchase APIs, MCP tools, content, and other online resources using machine-native payment mechanisms such as x402.
As of this writing, Cloudflare has announced the wallet architecture and allows users to reserve cloudflare.pay identity handles, while the ability for those wallets to actually hold, send, and receive funds is still forthcoming.
So this isn't quite "your AI agent can get a Cloudflare credit card today."
But something important has changed anyway.
The credit-limit problem has stopped being theoretical. The infrastructure is now being productized.
And Cloudflare isn't alone.
Payment networks and technology companies are working on similar ideas: agent-specific credentials, machine-readable purchasing intent, spending limits, merchant restrictions, identity, and auditable transaction histories.
What we're watching emerge isn't simply a new payment method.
It's programmable financial authority.
────────
The actual design question: credit card or debit card?
Strip away the stablecoins, protocols, AI models, and corporate names and all these stories point toward the same design question:
When an autonomous agent needs to spend money or commit resources, do you give it something that behaves more like a credit card or a debit card?
I'm using those terms as metaphors, not literal financial products.
The distinction is about where the boundary lives.
A credit-card model says:
Spend within policy. We'll monitor what happens, reconcile afterward, and deal with exceptions when they occur.
A debit-card model says:
Here is exactly how much authority has already been allocated to you. You cannot exceed it, regardless of how persuasive the situation looks in the moment.
One relies heavily on judgment.
The other makes the downside structurally bounded.
We've been solving this problem with humans forever.
A teenager doesn't get the family checkbook.
They get an allowance.
A new employee doesn't receive unlimited purchasing authority.
They might get a corporate P-card with a spending limit and merchant restrictions.
A new driver doesn't necessarily get every key in the garage.
They get the key appropriate to what they're allowed to operate.
Authority expands as trust is established.
None of this sounds controversial when the subject is a person.
It shouldn't suddenly become controversial because the employee is software.
────────
Access authority is not transaction authority
This is where I think the conversation gets bigger than payments.
For decades, enterprise security has focused on questions like:
Who are you?
What systems can you access?
What data can you see?
What actions can you perform?
Agents introduce another question:
What are you allowed to commit us to?
An agent may legitimately have access to AWS.
That doesn't mean it should be able to provision $80,000 of infrastructure.
An agent may have access to your SaaS management platform.
That doesn't mean it should autonomously purchase 500 licenses.
A research agent may be authorized to query external APIs.
That doesn't mean it should spend $4,000 experimenting with them.
An API credential provides access.
It shouldn't silently become purchasing authority.
Access authority is not transaction authority.
And enterprises are going to need policies for both.
────────
The allowance problem
This is why I keep coming back to the conversation with my kid.
An allowance isn't really about money.
It's a mechanism for delegating authority while bounding the downside.
Here's $50.
You decide how to use it.
I'm not going to approve every purchase.
That's the whole point.
But you can't spend $500 because $500 isn't available to you.
That's actually a pretty good architecture for autonomous agents.
Give the agent enough authority to accomplish useful work without requiring human approval for every three-cent API call.
But establish the boundary outside the agent's reasoning process.
Don't tell the model:
Please don't spend more than $100.
Give it a wallet that cannot spend more than $100.
Don't tell it:
Please only buy from approved vendors.
Give it credentials that cannot transact with unapproved vendors.
Don't tell its AI supervisor:
Please make sure the other AI behaves.
Put the control somewhere neither agent can negotiate around it, which is exactly the lesson Seymour Cash taught us the hard way.
Better prompts improve the odds.
Better models improve the odds.
Checklists improve the odds.
AI supervisors improve the odds.
Hard limits change the possible outcome.
That's a very different thing.
────────
What's your agent's financial blast radius?
Security teams already think about blast radius.
If an identity is compromised, what can the attacker reach?
What data can they access?
How far can they move?
Agentic commerce adds another dimension.
What can this identity spend?
What can it purchase?
What infrastructure can it provision?
What subscriptions can it create?
What other agents can it pay?
What contractual or financial commitments can it make?
And how long can it continue before somebody notices?
That gives us a question I think every organization deploying autonomous agents should eventually be able to answer:
What's the financial blast radius of this agent?
If the agent gets compromised, manipulated, confused, or simply interprets its objective differently than you expected, what's the maximum economic damage it can create without asking a human for permission?
Ten dollars?
A thousand?
A hundred thousand?
Unlimited?
If the answer is "we don't know," the agent probably isn't ready for financial authority.
────────
What IT and security leaders should do now
None of this means enterprises should prevent agents from spending money.
That would defeat much of the point of autonomous systems.
The useful future isn't one where an agent stops every thirty seconds to ask:
Can I spend three cents?
Can I call this API?
Can I buy another gigabyte of storage?
The useful model is bounded autonomy.
We establish the authority.
The agent operates freely inside it.
When it reaches the boundary, a human, or a genuinely independent policy control, gets involved.
A few principles seem increasingly important:
- Treat every agent as a non-human identity from day one. You should be able to answer "which agent did this?" as easily as "which employee did this?"
- Start with an allowance, not open-ended purchasing authority. Define the total spend, merchant scope, and transaction ceiling before the first real transaction.
- Separate access from financial authority. Permission to use a system should not automatically imply permission to spend through it.
- Expand authority based on observed behavior. Treat an agent like a new employee: privilege grows because of a track record, not because the model benchmark says it's smart.
- Assume agents will interact with other agents. Design budgets, objectives, and controls for a multi-agent environment, not a world where every agent operates alone.
- Put critical limits outside the model. Prompts and checklists are useful controls, but hard ceilings should be enforced by infrastructure the agent cannot reason its way around.
- Know the blast radius. Before granting financial authority, know the maximum loss the agent can create autonomously.
This isn't really a new governance problem.
It's an old governance problem moving at machine speed.
────────
The short version
We already have the beginnings of the experiment.
A vending machine showed what happens when an autonomous system has objectives, tools, and financial discretion but insufficient boundaries.
A second attempt showed that better models, better processes, and even an AI supervisor can improve performance dramatically, right up until an outside party pressure-tested the whole setup and found the same soft spot underneath.
A marketplace showed that agents can successfully negotiate real transactions with other agents.
A multi-agent experiment showed what happens when autonomous systems pursue conflicting goals inside shared environments.
And now companies are building persistent identities and programmable wallets designed specifically for agents.
The question isn't whether AI agents should ever be trusted with money.
The question is how we delegate that trust.
Parents figured this out a long time ago.
So did CFOs.
So did security teams.
You don't start by handing someone unlimited authority and hoping the policy document holds.
You establish a boundary, watch what happens, and expand authority as trust is earned.
AI shouldn't be different.
Don't start your agent with a credit limit. Start it with an allowance.
Bound the downside. Let the agent earn the rest.
────────
Reach Out, Let's Talk. @randyjrouse
────────
Sources
- Anthropic. Project Vend: Can Claude run a small shop? https://www.anthropic.com/research/project-vend-1
- Anthropic. Project Vend, Phase Two. https://www.anthropic.com/research/project-vend-2
- Anthropic. Project Deal. https://www.anthropic.com/features/project-deal
- TechCrunch. Anthropic created a test marketplace for agent-on-agent commerce. https://techcrunch.com/2026/04/25/anthropic-created-a-test-marketplace-for-agent-on-agent-commerce/
- TechCrunch. Anthropic set AI agents loose on the same task: they started a turf war. https://techcrunch.com/2026/08/13/anthropic-set-ai-agents-loose-on-the-same-task-they-started-a-turf-war/
- Cloudflare. Giving AI agents an identity and a wallet. https://blog.cloudflare.com/wallets/
- Cloudflare Developers. Wallets. https://developers.cloudflare.com/wallets/
- Cloudflare. Identity-aware controls for AI Gateway. https://developers.cloudflare.com/ai-gateway/changelog/