AI Agent Payments Put Bakkt and Security Under Pressure
Bakkt warns that AI agents can carry out payments that are technically correct but still wrong in substance. The debate also touches on liability, wallets, and protocols like Google’s Agent Payments Protocol.
Key Takeaways
- Bakkt CEO Daniel Ishag warns that AI agents can process payments correctly and still make the wrong choice.
- In BeInCrypto’s report, a combined $281,200 went to attackers in two incidents before recovery was possible.
- The debate also centers on liability, because payment service terms often hold users responsible for agent-initiated transactions.
AI agents that make payments on behalf of users create a practical problem, according to Bakkt CEO Daniel Ishag: they can carry out an instruction perfectly and still make the wrong choice. His example of a business class flight to Korea shows that following a budget is not the same as understanding what someone actually means. Once the money has been sent, someone has to fix the mistake.
Where Things Can Go Wrong
Ishag describes a situation where an agent books the wrong destination, but the same risk applies more broadly. An agent can misread an instruction, an attacker can feed it misleading directions, or someone can steal access to the account. In all cases, the result can be the same: a payment the owner never wanted to make.
BeInCrypto’s State of AI Agent Payments 2026 counted 14 of the 19 products and workflows it reviewed as able to act within preapproved permissions. That says something about what these systems can do, but not that those controls always keep working. In two selected incidents from the report, a total of $281,200 (€251,700) went to attackers before recovery was possible.
Who Pays for the Damage
The debate is not just about technology, but also about responsibility. Phillip Lord, CEO of Bitcoin Japan Corporation, points out that people also make mistakes themselves and click dangerous links. Still, an AI agent changes the question of who is liable when software acts on a user’s behalf.
That becomes clear in the terms of Stripe’s Link wallet. They say that users, as between themselves and Stripe, are responsible for transactions initiated by linked agents, even if they are unintentional or come from bugs, hallucinations, or misunderstood instructions. Only if Stripe itself makes a technical error does that change. For crypto companies and payment services, this shows that permission for a payment does not guarantee a provider will automatically reimburse a mistake.
Why This Also Matters for Crypto
For the crypto market, this matters because AI agents are increasingly being connected to wallets, payment flows, and other financial tools. The risks look similar to earlier incidents where AI systems gained access to accounts or bypassed security rules, including outside the crypto sector. That makes clear logs, tight permissions, and clear recovery agreements more important, especially as more companies experiment with autonomous software.
Google’s Agent Payments Protocol is trying to structure these discussions in part with signed records of instructions and purchases. The UK regulator FCA also says regulated firms remain responsible for customer outcomes when they use AI, and warns that human oversight can quickly turn into a box-ticking exercise. So for users, the core question stays simple: what exactly is the agent allowed to do, and who pays if something goes wrong?
The recent security questions around agent payments also show that budget limits alone are not enough to prevent mistakes or abuse. That research focused on cases where agents still moved large amounts after manipulated instructions.
