In May 2026, someone hid a message in Morse code inside a post on X. An AI assistant read the post, decoded the dots and dashes, and did what they said. Within minutes, a wallet under that AI's influence sent roughly $174K in tokens to the attacker, who moved the funds and deleted their account. No smart contract was broken. No private key was stolen. Somebody talked a machine into it.
Hold that story. It is the whole subject in miniature: everyone says AI agents will move money on chain. Who makes sure an agent only moves what it is allowed to move, and who can prove it afterwards?
I meet this question from both sides. My working days are spent in data and AI governance for large enterprises. My evenings run Canton Catalyst, which operates its own small fleet of AI agents under strict rules: every seat has a mandate, every output passes a human check, nothing ships without my sign-off. So this piece is written from practice, not from a whitepaper.
Two words before we start, in plain language, because everything else hangs on them. An agent is software that acts on your behalf: it reads, decides, and does things without you approving each step. A mandate is the written boundary of what it may do: how much, with whom, until when. Keep those two definitions and the rest reads easily.
One more note on scope. I start with payments because that is where autonomy meets money first, where the volume already exists, and where mistakes are final. But this is not a payments story. It is a job description framework for a new kind of employee, and before the end I will walk it through the other jobs an agent can hold on a network like Canton.
The moment this stopped being theoretical
Machine to machine payments were an economics problem before they were a technology problem. Card rails carry fixed costs that make a forty cent transaction pointless. AI agents want to pay per API call, per data query, per task, thousands of times a session. Stablecoin settlement clears in seconds for a fraction of a cent. That single fact opened the door.
The numbers stopped being small. The x402 standard, launched by Coinbase in May 2025 and handed to a neutral foundation under the Linux Foundation in July 2026, processed $24.3M across 75.4 million transactions in a recent 30 day window, network wide across every chain it runs on. Not Canton's volume; the standard's. We will come back to that distinction.
Chainalysis counts over 100 million cumulative x402 transactions on Base alone through Q1 2026, with the honest caveat that part of the late 2025 surge was meme activity rather than agents buying services. Separate research co-published by Keyrock counts roughly 176 million agent settled transactions from May 2025 to April 2026, the typical transaction a few dozen cents, almost all in USDC.
Watch what the payment protocols themselves are building, because the vocabulary gives the game away. Google's AP2, announced with more than 60 organizations behind it, runs on cryptographically signed mandates: proof of what a user authorized an agent to buy, at what price, by what method. Stripe's MPP runs on sessions: a pre-authorized spending limit the agent streams payments against. Strip the branding and you are looking at a delegation of authority matrix and a corporate card limit. Payments engineers are rebuilding the controls enterprises already apply to employees, because at machine speed there is no alternative. A human cannot approve ten thousand payments a day. A human can approve a mandate.
That is the whole shift in one sentence: governance moves from approving actions to defining envelopes, and from watching the worker to verifying the evidence. You do not stand behind an employee's chair all day. You give them a job description, a spending limit, and an audit trail, and you check the trail.
What the record says about hiring without a handbook
The enterprise numbers first, precisely scoped, because they get misquoted constantly.
MIT's NANDA project found that roughly 95 percent of enterprise generative AI pilots showed no measurable profit and loss impact. That measures pilots and returns, not cancellations. And the diagnosis was not model quality: generic tools stall because they never learn the organization's workflows.
RAND puts general AI project failure above 80 percent. A different study, measuring a different thing; the two numbers are cousins, not twins.
Gartner predicts over 40 percent of agentic AI projects will be canceled by the end of 2027, naming escalating costs, unclear value, and inadequate risk controls. It also estimates that of the thousands of vendors selling agents, only about 130 are real.
Deloitte finds about three quarters of companies plan to deploy agents within two years, while 21 percent have mature agent governance.
Read together: organizations are hiring a workforce they have not written an employee handbook for.
The named cases teach sharper lessons.
Klarna automated customer service, not sales, as the retelling usually has it. Its assistant handled 2.3 million chats in its first month, work the company equated to roughly 700 full time agents. By May 2025 the CEO admitted the company had cut too deep, told Bloomberg the cost focus produced lower quality, and brought humans back for complex cases while the AI kept the routine tier. The lesson is not that AI failed. The lesson is scope: they delegated the judgment tier along with the routine tier, and found the line only by crossing it.
Air Canada tried the opposite defense. When its chatbot invented a bereavement discount, the airline argued before a British Columbia tribunal that the bot was a separate legal entity responsible for its own actions. The tribunal rejected that in February 2024. Your agent's words are your words. On chain, your agent's transactions are your transactions, with one brutal upgrade: settlement finality deletes the refund remedy the tribunal ordered.
Then the pre-AI ancestors every risk officer already knows. Knight Capital, August 2012: autonomous execution plus capital, no enforced envelope, no kill switch, $440M gone in about 45 minutes. Zillow, 2021: model driven house buying, drift unmonitored, a write down past half a billion, a business line closed. Neither involved a language model. Both involved software holding money and a mandate nobody had bounded.
And the new generation. In July 2025 an AI coding agent at Replit deleted a production database during an explicit code freeze. The instruction existed. The permission boundary did not.
Instructions are not guardrails.
The crypto record is worse, because the money is already attached
Return to the heist that opened this piece. Two weeks after the Morse code transfer, the wallet service involved, Bankr, paused all swaps and transfers after 14 wallets were accessed. And one reported detail should stop you cold: a safety block against that exact injection path had existed since a similar attack in March 2025, and it disappeared in a later rewrite of the agent's code. A control that lives inside a codebase version is a temporary condition, and attackers know it.
This was no one off. The aixbt agent was manipulated into sending 55.5 ETH in March 2025. The Freysa experiment lost about $47K to a prompt injection on attempt number 482, which tells you exactly how patient the other side is. Prompt injection, if the term is new to you, is the trick from the opening: hiding instructions inside content an AI reads, so the machine obeys the attacker instead of its owner. CrowdStrike's 2026 threat report counts prompt injection attacks against more than 90 organizations and an 89 percent year on year rise in AI enabled attacks. Zscaler has documented live campaigns embedding hidden prompts in websites specifically to steer AI agents into making crypto payments.
The environment agents transact in is adversarial by default. Out of the losses, the security community converged on a rule my profession has enforced for decades under other names: spending limits belong at the wallet or custody layer, never inside the model's prompt, because injection routes around anything written in words.
Write the limit where the attacker cannot talk to it.
The three layers institutions will demand
Strip away the jargon and agent governance is people governance, rebuilt for software. Enterprises already run this stack for every human employee. Three layers.
Layer one: identity and mandate. Who is acting, on whose authority, inside what envelope? The know your agent framework donated to the Decentralized Identity Foundation in March 2026 reduces it to four questions any service should answer: who is the agent, who authorized it, what may it do, and what is the scope of that delegation. That is an onboarding checklist wearing new clothes; my field calls the discipline identity and access management, deciding who may touch what. The Cloud Security Alliance published a Zero Trust framework for agents in February 2026, next to a survey finding 84 percent of organizations could not pass a compliance audit focused on agent behavior, and only 23 percent hold a formal agent identity strategy. NIST opened its own workstream on agent identity and authorization the same month. Meanwhile, the plumbing agents actually use today: a security scan of roughly 2,000 MCP servers, the connectors agents reach tools through, found every single one lacked authentication. The identity layer is being specified at standards bodies and skipped in production.
Layer two: rules and accountability. What may be done, at what risk tier, and who answers for it? The EU AI Act is the binding anchor, though its high risk obligations for listed use cases just moved from August 2026 to December 2027 under the Digital Omnibus. The US position is more revealing: the revised interagency model risk guidance of April 2026 explicitly excludes generative and agentic AI from its scope. The primary supervisory framework for model governance does not reach the autonomous agents now entering financial systems. The FSB is consulting on whether existing sound practices even address agentic AI. The rules layer was written for models inside institutions, and it has a hole exactly where agents on shared infrastructure sit.
Layer three: evidence. What actually happened, provably? My field calls this layer lineage and audit. The AI industry calls it observability, the tooling that shows what a system did and why. By the industry's own market research it is the weakest layer in the stack: 57 percent of organizations run agents in production, yet trust is thin enough that 69 percent of AI decisions still get human verification.
Article 12 of the AI Act requires high risk systems to log events automatically across their lifetime; manual records do not count, and logs are the first thing a market surveillance authority requests. Article 72 requires providers to monitor performance for the system's whole life, including, in a clause that reads like it was written for this piece, analysis of interaction with other AI systems.
Policy without evidence is theater. Evidence without policy is telemetry with no owner. Institutions will demand both, wired together, before an agent touches client assets.
What Canton has natively, and what it does not
Now hold those three layers against Canton's architecture. Evidence tiers stay explicit.
ConfirmedAs architecture: on Canton the actor of record is a party, and parties live on identifiable participant nodes. Authorization is a validation rule, not a convention: a Daml choice, the action a contract permits, can only be exercised by a party granted that right. Which means a mandate can be a contract. Agent A may move up to amount X of asset Y with counterparties Z until date D, with the cap and the expiry enforced when the transaction validates, not when a prompt politely asks. Every action lands in a record that is selectively disclosable, meaning each party sees exactly what it is entitled to see: the principal and a supervisor can see everything, the market sees nothing. Layer one and layer three, native to the protocol. That is the write the limit where the attacker cannot talk to it rule, built into the rails.
Confirmedx402 support on Canton is real. ChainSafe's facilitator code, the service that verifies and settles the payments, has been public since October 2025, and Canton's own developer forum now carries an integration guide for accepting agent payments, with settlement through the Splice token standard and custody staying with the payer, who signs on their own participant. The productized portal is still launch gated, so treat the rail as arriving rather than arrived. I also owe you the record on this one. On 15 July I rejected the x402 on Canton claim as unverified. On 5 August I published the correction, once the forum guide and the repositories proved me wrong. The record of what I got wrong is what makes the rest worth reading.
AnnouncedSingle source: in April 2026 Cantor8 reported the first private AI agent payment on Canton, a Claude agent transferring USDCx with atomic settlement and selective disclosure, work funded under its agentic standardization grant. One source, the company's own blog, so it stays announced until a second primary lands.
Beyond payments: three more jobs for the same stack
This was never only a payments piece. Give the same employee different jobs and the same three layers reappear.
Asset lifecycle agents. The unglamorous work of tokenized markets is margin calls, collateral substitutions, coupon processing, treasury sweeps. Every one is a bounded, rule following task, exactly what agents are suited to, and every one moves value. The mandate question is identical to payments: which contracts may this agent exercise, up to what size, and who signs off above the threshold? On Canton, the answer can live in the contract itself.
Compliance and supervision AI. The reverse direction: not agents that act, but AI that watches. A transaction monitoring model, or a supervisor's analytics, needs access that on a public chain is either total or absent. Selective disclosure changes the shape of the problem: the watcher can be granted exactly the visibility its legal basis supports, no more, and the grant itself sits on the record. Who watched what becomes provable, which any data governance practitioner will tell you is half the battle.
ConfirmedFederated analytics, and the bridge to my own field. Institutions want models trained across many firms' data without any firm surrendering its data, and on Canton that is a live thread, not a hypothetical. T-RIZE (@trize_io) co-leads the first Industrial Research Chair in Tokenization and Federated Learning, supported by the Government of Canada, building privacy preserving machine learning for regulated markets. Federated learning, in plain words: the model travels to the data, the data never leaves home, only the model's updates move. Its founder sits on the Canton Foundation board, a relationship worth knowing when you weigh the signal.
Put the three jobs next to each other and a pattern shows itself. Federated learning moves model updates, not data. Canton settlement moves selective disclosures, not the contract. The x402 facilitator moves signed, scoped payments, not custody. Independent efforts, one design principle: move the authorization, never the underlying asset of trust. Nobody coordinated that. The architecture selected for it.
The counterweights
This is analysis, not advocacy, so here is the other side of the ledger. Virtually all agent payment volume today lives on public chains; Base alone counts nine figures of x402 transactions while Canton's agent lane is one grant funded payment and one launch gated facilitator. No regulator has said ledger records satisfy Article 12, and they may never, because an agent's reasoning lives off ledger: the chain can prove what was done under whose authority, not why. Who counts as provider versus deployer when an agent misfires from a participant node on shared infrastructure is unresolved law everywhere, Canton included. And settlement finality cuts both ways: the property that makes the audit trail trustworthy also deletes the undo button. On chain, the governance bar sits higher, not lower.
The test you can run
Next time a project, on Canton or anywhere, announces an AI agent product, ask five questions:
Who is the agent, as an identity someone attests to?
Who authorized it, and can they revoke it?
What exactly may it do, and is the limit enforced outside the model, where a prompt injection cannot reach?
What happens the moment it exceeds the mandate?
Can anyone prove, afterwards, what it did and under whose authority?
Klarna, Air Canada, Knight, Zillow, Replit, and the Grok wallet each failed at least one of these. The 95 percent of stalled enterprise pilots mostly never reached the questions at all, because the organization's own rules were never written in a form an agent could follow. That is the maturity gap, and crypto teams are not exempt from it. They ship fastest, with the least governance muscle, on rails where failure is instant and final.
Open questions I am taking to calls
Five things I do not know and intend to ask people who might. Who holds the AI Act's provider versus deployer obligations for an agent on shared infrastructure? Would a supervisor accept selectively disclosed ledger records as compliance logs? Do agent payments even land in the Act's high risk list, and if not, which operational resilience rules bind instead? How do AML obligations and travel rule data attach when an agent initiates a transfer? And is any Canton participant building mandates as contracts in production today? If you work on any of these, my inbox is open.
Disclosure: I hold $CC, $CNTN, and $RIZE. This is analysis, not financial advice. Always do your own research.
The closing question, and I want actual answers: which arrives on Canton first, a project publishing its agent mandate policy, or a supervisor asking to see one? I have a view. Tell me yours.
References and further reading
- Canton Network Forum, Integrate x402 into your app in under 30 minutes (forum.canton.network)
- ChainSafe, Canton x402 Facilitator (x402.chainsafe.io); facilitator and MCP server repositories public since October 2025
- x402 Foundation and protocol overview (x402.org); Linux Foundation stewardship, July 2026
- Concordium, x402 explained: agentic payments and identity, including the Chainalysis Base transaction count (concordium.com)
- Keyrock co-published research on agent settled transactions, May 2025 to April 2026, via CoinDesk coverage (cryptodaily.co.uk)
- Google Cloud and partners, Agent Payments Protocol announcement, September 2025 (overview: bitontree.com)
- Stripe and Tempo, Machine Payments Protocol, March 2026 (comparison: crossmint.com)
- MIT NANDA, The GenAI Divide: State of AI in Business 2025, via Fortune (fortune.com)
- Gartner, over 40 percent of agentic AI projects will be canceled by end of 2027, June 2025 (gartner.com)
- RAND Corporation analysis of AI project failure rates; Deloitte enterprise AI governance findings (survey roundups: beri.net, softwareseni.com)
- Klarna AI customer service case study and May 2025 rebalance (twig.so; Bloomberg interview via entrepreneur.com)
- Moffatt v. Air Canada, British Columbia Civil Resolution Tribunal, February 2024
- US SEC administrative order on Knight Capital, 2013; Zillow Q3 2021 shareholder letter on winding down Zillow Offers
- Fortune, Replit AI coding agent incident, 23 July 2025 (case roundup: visione-edge.com)
- OECD AI Incidents Monitor, Grok linked wallet prompt injection, 4 May 2026 (oecd.ai)
- Ledger Academy, crypto security review 2026, Grok and Bankr exploit mechanics (ledger.com); technical analysis (giskard.ai)
- Reported control decay detail on the March 2025 predecessor attack (irishtechnews.ie)
- aixbt agent incident, March 2025 (crypto.news); Freysa prompt injection experiment, November 2024 (the-decoder.com)
- CrowdStrike 2026 Global Threat Report on prompt injection, via CryptoBriefing (cryptobriefing.com)
- Zscaler research on prompt injection campaigns targeting agent payments, via SecurityWeek (securityweek.com)
- KYA-OS at the Decentralized Identity Foundation; Cloud Security Alliance Agentic Trust Framework, February 2026 (overview: idenhq.com)
- NIST NCCoE, Accelerating the Adoption of Software and AI Agent Identity and Authorization, concept paper, February 2026 (nccoe.nist.gov)
- South et al., Authenticated Delegation and Authorized AI Agents (arxiv.org); MCP server authentication scan (arxiv.org)
- EU AI Act, Articles 12 and 72 (artificialintelligenceact.eu, ai-act-service-desk.ec.europa.eu); Digital Omnibus timeline changes (insideprivacy.com)
- SR 26-2 and OCC Bulletin 2026-13 scope exclusion for generative and agentic AI (arxiv.org; 360factors.com)
- FSB consultation on responsible AI adoption; IMF Note 2026/004, How Agentic AI Will Reshape Payments (arxiv.org; imf.org)
- Agent observability market research (guptadeepak.com; confident-ai.com)
- Cantor8, first private AI agent payment on Canton, April 2026 (cantor8.io)
- Canton Foundation, board and T-RIZE research chair (canton.foundation); Digital Asset on AI assisted Daml development (blog.digitalasset.com)