Six standards and one blind spot

Six organisations shipped agent payment protocols between April 2025 and March 2026. The coverage reads it as a standards war and waits for a winner. I think that framing is wrong, and it is wrong in a way that hides the more interesting fact: on the question that matters most, all six give the same answer, and the answer is silence.

Part one ended on a list of seven things an agent needs from a payment rail, and the observation that no existing rail supplies them. This part looks at what the industry built in response, what one of those protocols has actually done in production, and who got left out.

Fair warning on the middle section. The most useful thing I can do with x402 is not repeat its launch numbers. It is show you where they came from, because three different transaction counts are in circulation and none of them measure quite the same thing.

Not one race, four layers

A payment has at least four separable questions in it, and once you see them separately the six protocols stop looking like rivals.

Who authorised this, and within what limits. A human, or an institution, has to have said that this agent may spend up to this much, on these things, for this long. That permission has to travel with the transaction in a form the far end can check.

Who is this counterparty. Not the wallet address. The identity, and whether anyone has vouched for it.

What is being bought, and did it arrive. The commercial layer. Cart, price, terms, delivery, and what happens when the thing is wrong.

Where does the money actually move. The settlement layer. Which asset, on which system, with what finality.

Almost every piece of coverage I have read collapses these into one. That is the category error, and it is being repeated confidently. A protocol that answers question one is not competing with a protocol that answers question four. It needs one.

These protocols mostly do not overlap. Several of them are designed to stack. Waiting for one to win is like waiting to see whether HTTP beats TCP.

Where each of the six actually sits

Taking them in the order part one listed them, and placing each on the layer it occupies. CONFIRMED

Google's AP2, published September 2025 with more than sixty launch partners, is an authorization protocol. It structures signed mandates: a verifiable record that a principal permitted a specific kind of spend. It is deliberately settlement-agnostic, which is not a gap in it. It is the design. AP2 answers question one and leaves question four to whatever rail you bring.

Visa's Trusted Agent Protocol, the same month, sits on identity. Verified agent credentials and issuer-signed consent. It answers question two, on infrastructure Visa already runs.

Mastercard's Agent Pay, announced April 2025, extends existing card tokenisation to agents. The Agentic Commerce Protocol from OpenAI and Stripe is checkout. Stripe's Machine Payments Protocol, March 2026, is the same family. All three answer question three, and all three settle on rails that already exist, which is both their strength and their ceiling. Card rails carry a fixed per-transaction component. Part one showed what that does below a dollar.

Coinbase's x402, May 2025, is the settlement layer answer. It revives HTTP 402, a status code reserved by the original web architects in 1991 and left dormant for roughly thirty-five years, so that a server can quote a price inline and a client can pay it inline. It answers question four and says almost nothing about questions one through three.

Six protocols. Four layers. Two genuine overlaps, in checkout. That is not a war.

x402 as the worked example

x402 is the one worth following closely, not because it is winning but because it is the furthest along in public and therefore the only one where you can check claims against measurements.

The governance history matters more than it sounds, and it is routinely compressed into one date. Coinbase and Cloudflare announced an x402 Foundation in September 2025. The Linux Foundation announced it was launching that foundation on 2 April 2026, at the MCP Dev Summit in North America, together with Coinbase's intent to contribute the protocol. The operational launch came later: 14 July 2026, at which point the contribution from Coinbase was complete and the foundation was live under formal open governance with roughly forty members. CONFIRMED

April was the announcement of intent. July was the handover completing. I flag the distinction because I have seen April cited as the moment Coinbase stopped controlling the protocol, and by Coinbase's and the Linux Foundation's own accounts that took another three months.

The membership is the genuinely striking part. Visa, Mastercard, American Express, Stripe, Adyen, Fiserv, AWS, Microsoft, Google, Cloudflare, Circle, Shopify, Polygon Labs, the Solana Foundation. Card networks joining the governance of a protocol that routes around card networks is not a contradiction, it is a hedge, and it is the clearest signal in this whole area that the incumbents think the HTTP layer is worth a seat at.

The protocol went neutral. The settlement layer did not.

x402 is chain-agnostic in the specification and, in practice through April 2026, every production deployment settled in stablecoins on a small number of chains. That gap between what a standard permits and what it actually runs on is the single most important thing this series has to say about standards, and part three is where it lands.

What the numbers actually say

Here is where I have to be careful, because the headline figures are real and they are also not what most people repeating them think.

The widely quoted set is roughly sixty-nine thousand active agents, one hundred and sixty-five million transactions, and about fifty million dollars of cumulative volume. Those are Coinbase's figures, reported by Coinbase, as of late April 2026. That is not a criticism. It is an attribution, and it is the difference between a measurement and a disclosure. CONFIRMED

Independent counts exist and do not match. The academic team behind the largest security study measured one hundred and nineteen million x402-related transactions across Base and Solana. A separate paper from a different group puts all-time transactions at one hundred and thirty million. Coinbase says one hundred and sixty-five million. CONFIRMED

Three numbers, three methodologies, three definitions of what counts as an x402 transaction. Nobody is lying. They are measuring different things and none of them publishes a reconciliation. When you see one of these quoted without a source, you are being handed a number whose meaning nobody has established.

The trend underneath is more useful than the totals. In the thirty days to mid-July 2026 the protocol carried roughly seventy-five million transactions worth about twenty-four million dollars, an average of around thirty-two cents a call. On the narrower measure of x402 decentralised exchange volume tracked by DefiLlama, activity peaked near $970,000 on 3 December 2025 and had fallen to roughly $16,000 a day by 13 July 2026. CONFIRMED

Transaction counts accumulate. Value does not grow. For a protocol whose entire purpose is sub-dollar payments, that is arguably the system working as designed rather than a failure. But it does mean anyone reading the transaction count as a proxy for economic significance is reading it wrong, and one industry analysis puts roughly half of the volume down to testing rather than commerce. SPECULATED

Three papers, one architecture problem

Before the findings, the mechanism, because it is the part that gets skipped and it is where the risk lives.

When a server quotes a price and a client pays it, somebody has to check that the payment proof is valid and then actually settle it on chain. In x402 that job is delegated to a facilitator. The merchant does not verify the payment. The facilitator does, on the merchant's behalf, for many merchants at once. That is what makes integration easy, and it means a single facilitator sits inside the trust path of every service that uses it.

Three separate academic groups published security analyses in 2026 and they converge on the same conclusion from different directions.

The largest study tested fifteen real-world facilitators together used by more than sixty thousand sellers and three hundred and sixty thousand buyers, accounting for around 99 percent of x402 transactions. It identified forty-nine violations of eight security rules, translating to thirty-one previously unknown vulnerabilities, across four attack classes the authors call free shopping, asset theft, service denial and gas abuse. Every facilitator evaluated violated at least one rule, and every rule was violated by at least one platform. The most common practical risks were sponsor-paid cost amplification and free shopping. Asset theft was rarer and highest impact, and was found in top-volume facilitators. All of it was responsibly disclosed and mitigated, including by Coinbase. CONFIRMED

A second group, working across three universities, found four flaw classes including a duplicate-settlement race that a later third-party report independently corroborated, and demonstrated resource-leakage ratios reaching 100 percent against official software development kits and a production deployment. They also proved something structural rather than implementational: for pay-per-token pricing, no output-only price can be simultaneously fair to honest users and bounded against inflation of the hidden reasoning tokens a model generates. That is not a bug anyone can patch. It is a property of billing for work you cannot see. CONFIRMED

A third paper ran more than twenty-five thousand payment requests across forty-eight configurations and found agent selection bias reaching 71.8 percent under metadata manipulation, meaning an attacker who controls how a service describes itself can steer which service an agent chooses. CONFIRMED

None of this means x402 is broken. A protocol eighteen months old, carrying real money, attracting three independent security teams and shipping mitigations is a protocol behaving normally. What it does mean is that the facilitator is the architectural centre of gravity, and a design whose selling point is that no bank has to approve you has re-created a small number of parties everybody has to trust.

The floor that did not move

Part one opened on an Exa search that costs seven tenths of a cent, and the claim that no rail on earth can carry it. x402 is the answer to that, and I owe you an awkward number.

One published comparison puts x402's practical floor on Base at around a cent. If that is right, the payment that opened this series does not clear the floor on the chain that carries most of the traffic. SPECULATED

I am marking that speculated rather than confirmed deliberately. It comes from a single source, and that source is a Bitcoin publication making a favourable comparison to Lightning, which is exactly the sort of interested framing this series is supposed to catch when other people do it. But I cannot dismiss it either, because the direction is consistent with the average call value of roughly thirty-two cents. If sub-cent payments were routine, the average would be lower.

What would settle it: a published distribution of x402 payment sizes rather than an average, from a party that does not own a chain. I have not found one. If you have, I want it.

The counterparty nobody built for

Now the thing all six have in common.

Read the launch material for any of them and the same customer appears. An agent buying from a merchant on behalf of a consumer. Your assistant books the flight, orders the groceries, renews the subscription, buys the API call. Google's sixty launch partners, Stripe and OpenAI's checkout protocol, Visa's issuer-signed consent, Mastercard's tokenisation: consumer commerce, intermediated by software.

That is a real market and probably an enormous one. It is also not the transaction I have been circling for two instalments.

When one regulated institution's agent pays another regulated institution's agent, four things change, and none of them is scale.

The counterparty is a legal entity, not an address. Not a verified agent credential. A named firm, with a jurisdiction, a licence and a balance sheet, and a legal relationship that survives the transaction going wrong.

Confidentiality runs both ways. A bank's agent querying a pricing endpoint is disclosing what that bank is interested in. On a transparent ledger, the fact of the query is a signal, and the signal is tradeable. Privacy here is not a preference, it is a precondition.

A supervisor has to be able to see it. Not a log the operator keeps. A record a regulator can compel, read and act on, ideally without the operator's cooperation being the thing that makes it possible.

Settlement has to be in something the institution can hold. Which narrows the asset list considerably, and drags in every question about what a stablecoin legally is that part one said the GENIUS Act and MiCA had only just begun to answer.

Go back through the six. AP2 handles authorization but is agnostic about who the parties are. TAP verifies that an agent is a legitimate agent, not that its principal is a supervised entity. The checkout protocols assume a consumer and a merchant, because that is the shape of the market that funded them. x402 will move value between two addresses and has no opinion about whose addresses they are.

Not one of them addresses the counterparty problem, because not one of them was built to. The institutional segment is not losing a standards war. It is not in it.

Six protocols, one quarter, and the largest counterparties in finance were not the customer any of them had in mind.

Which leaves the question part three has to answer. If the requirement is a known legal entity, selective confidentiality, a supervisor with a view, and settlement in a regulated asset, then the protocol layer is not where that gets decided. The substrate is. A settlement layer either knows who its parties are or it does not, and no amount of protocol design on top adds it later.

So: if your institution's agent had to pay another institution's agent next quarter, which of these six could you actually use, and what specifically stops you? I am collecting answers, because I suspect the blockers are more mundane and more interesting than the architecture debate.

References

1. Linux Foundation, launch of the x402 Foundation and contribution of the protocol, 2 April 2026 (prnewswire.com)
2. Linux Foundation, operational launch of the x402 Foundation, 14 July 2026 (linuxfoundation.org)
3. x402 whitepaper and specification (x402.org)
4. When HTTP 402 Meets the Blockchain: Risks on Emerging x402 Payments, arXiv 2607.19545 (arxiv.org)
5. Free-Riding the Agentic Web: A Systematic Security Analysis of x402 Payments, arXiv 2605.30998 (arxiv.org)
6. Five Attacks on x402 Agentic Payment Protocol, arXiv 2605.11781 (arxiv.org)
7. Coinbase-reported x402 adoption figures as of late April 2026, agent and transaction counts (eco.com)
8. Thirty-day transaction and value figures to mid-July 2026, and DefiLlama x402 exchange volume series (note.com)
9. Agentic payments layer taxonomy and chain-share claim for Base, April 2026 (rzlt.io)
10. x402 practical floor on Base and Lightning comparison, single source, interested party (tftc.io)