Is crypto needed to protect the security of AI agents paying each other online?
The infrastructure race for agentic commerce is already producing winners.
Anthropic’s Model Context Protocol now runs on greater than 10,000 public servers and pulls 97 million month-to-month SDK downloads, connecting AI functions to exterior instruments and knowledge.
Google’s Agent-to-Agent protocol launched in April 2025 with 50 companions and scaled to greater than 100 supporting corporations earlier than shifting below Linux Foundation governance.
On Jan. 11, Google unveiled the Universal Commerce Protocol, pulling in Shopify, Walmart, Target, Mastercard, Stripe, Visa, and American Express as early supporters, aiming to standardize how agents navigate reside checkout flows.
Coinbase’s x402 protocol handles the payment transport layer, enabling computerized stablecoin funds over HTTP. The mission reported greater than 100 million funds processed throughout APIs, apps, and AI agents by late 2025.
That is quite a bit of standardization for a know-how class that hardly existed three years in the past.
However, each one of these protocols addresses the similar slender slice: how agents connect, coordinate, and provoke funds.
None of them solutions the tougher industrial query sitting one step additional down the stack: Who decides the work was truly accomplished?
| Protocol / commonplace | What it does | What it doesn’t clear up | Why it issues on this story |
|---|---|---|---|
| MCP (Model Context Protocol) | Connects AI functions and agents to exterior instruments, APIs, and knowledge sources | Does not confirm whether or not a process consequence was truly delivered | It handles the device/knowledge layer, not the belief layer round accomplished work |
| A2A (Agent-to-Agent) | Lets agents talk and coordinate throughout techniques or organizations | Does not maintain funds in escrow or choose deliverable high quality | It solves agent interoperability, however not conditional settlement |
| UCP (Universal Commerce Protocol) | Standardizes agent-driven commerce and checkout flows | Does not decide whether or not a bought service or process was satisfactorily accomplished | It pushes agents deeper into actual transactions, making the lacking verification layer extra seen |
| AP2 (Agent Payment Protocol) | Uses signed cost mandates to show what an agent is permitted to spend | Proves permission, not whether or not the paid-for consequence materialized | It is an authorization commonplace, not a work-verification commonplace |
| x402 | Enables computerized funds over HTTP, together with stablecoin funds | Moves cash, however doesn’t resolve whether or not cash ought to transfer solely after work is verified | It is the cost transport rail, not the escrow/adjudication layer |
| Mastercard Verifiable Intent | Creates a belief and audit layer for proving person buy authorization | Focuses on sanctioned purchases and dispute trails, not process completion itself | It reveals incumbents are standardizing intent and accountability, however nonetheless not full consequence verification |
| ERC-8183 | Defines a job-based escrow circulate: funds locked, work submitted, evaluator completes or rejects, expiry can refund consumer | Does not clear up evaluator belief, disputes, or “agentic” id by itself | It is the article’s hook as a result of it targets the lacking conditional cost / verification step |
| ERC-8004 | Provides a belief/fame framework for agents and counterparties | Is not itself an escrow or payment-release mechanism | It is the seemingly composition layer for making ERC-8183-style analysis extra reliable |
| Oracle / staking / zkML / TEE-style belief techniques | Potential methods to confirm outcomes or again evaluator judgments with stronger ensures | None is a settled commonplace for broad agentic commerce but | These are doable solutions to the article’s central query: who will get to choose that the job was accomplished? |
Escrow as the lacking primitive
ERC-8183, a draft Ethereum commonplace printed Feb. 25, is crypto’s try to make that judgment programmable.
Strip the jargon, and the proposal is a minimal state machine for task-based commerce: a consumer locks the finances into escrow, a supplier submits work, and an evaluator marks the job full or rejects it.
Expiry refunds the consumer robotically. The spec calls this sequence: Open, Funded, Submitted, Terminal. Additionally, it explicitly states that the evaluator alone might mark a job as accomplished as soon as work lands.
That structure is narrower than its “agentic commerce” framing implies.
Critics in the Ethereum Magicians discussion thread identified that there’s “nothing particularly ‘agentic’” about the proposal. One commenter referred to as it “a job registry with escrowed funds.”
The critique is correct, and likewise the most helpful factor about the story.
What ERC-8183 truly specifies is a programmable escrow primitive relevant to any task-based transaction, human or machine.
The AI framing is layered on high of a construction that predates agents totally. The extra attention-grabbing query is whether or not that construction is the one piece the stack at the moment lacks.
The authorization-verification hole
The funds incumbents constructing round agentic commerce are fixing authorization, not verification.
Google’s Agent Payment Protocol frames funds round cryptographically signed mandates that show what an agent was permitted to spend.
Mastercard’s Verifiable Intent, co-developed with Google and launched on Mar. 5, creates a belief layer for proving what a person licensed and an audit path designed for dispute decision.
Those are strong solutions to “Was this buy sanctioned?” They say nothing about whether or not the bought consequence materialized.
That hole is the productive contradiction in the stack.
A2A ensures agents can speak throughout organizational boundaries. MCP ensures they’ll attain the proper instruments and knowledge. AP2 and x402 guarantee cash strikes robotically. ERC-8183 proposes that the funds be held conditionally till an evaluator attests that the deliverable has cleared.
Whether that evaluator is the consumer, an oracle community, a staking system, or a zkML proof is left to implementers, however the spec explicitly names ERC-8004’s trust and reputation layer as the beneficial composition level for higher-value jobs.
The energy middle no one named
The evaluator position is the place the proposal turns into politically attention-grabbing.
ERC-8183’s security part warns {that a} malicious evaluator can arbitrarily full or reject jobs, recommends fame or staking mechanisms for higher-value contracts, and acknowledges that there isn’t a dispute decision inside the core spec.
One builder in the Magicians thread wrote that “the Evaluator is the place the actual complexity lives.” Another summarized the broader downside as “everybody verifies the cost, no one verifies the work.”
Those observations level to a structural dynamic in any open agent market: whoever controls analysis controls the market.
The spec’s design makes the stress specific.
For enterprise deployments the place the consumer and evaluator are the similar entity, the complexity is manageable. For multi-party agent networks the place a supplier in a single group submits work to a consumer in one other, the evaluator turns into a belief bottleneck with platform-level leverage.
ERC-8183 names the choke level with out but having a sturdy reply for it.
Where the stack truly stands
The adoption numbers counsel the surrounding layers are shifting sooner than verification.
Gartner says 33% of enterprise software program functions will include agentic AI by 2028, and 15% of day-to-day work selections will run autonomously by that yr, up from 0% in 2024.
Deloitte pegs the world agentic AI market at $8.5 billion in 2026, rising towards $35 billion by 2030, with 75% of corporations probably investing in the class by the finish of this yr.
IBM and NRF reported in January that 45% of consumers already use AI throughout shopping for journeys, together with 41% for product analysis.
That quantity of agentic exercise wants settlement infrastructure.
The bull case for ERC-8183 and its surrounding stack is that open agent marketplaces, masking analysis, code, inference, knowledge, and microservices, generate sufficient cross-organizational, machine-to-machine commerce that on-chain conditional settlement turns into genuinely obligatory.
The bear case is that funds incumbents and enterprise software program soak up the verification downside earlier than crypto builds a sturdy wedge.
AP2’s cryptographic mandates, Verifiable Intent’s authorization audit path, and UCP’s reside retailer integrations are already positioning card networks and Big Tech at precisely the layer that ERC-8183 targets from the other route.
Who owns the judgment layer
If Gartner’s 2028 projections maintain, and agentic AI handles a significant share of enterprise procurement, analysis outsourcing, and repair shopping for, the highest-margin place in that stack is not going to be held by the mannequin supplier.
It will belong to whoever owns the second of conditional cost, which is the infrastructure that holds funds, attests to outcomes, and releases cash solely when the work clears verification.
ERC-8183 could also be that layer, or it could be market escrow sporting higher branding.
The Magicians thread is correct that the underlying construction predates AI totally. Yet the similar holds for many monetary primitives that turned out to matter.
Escrow predates the web. Conditional cost predates blockchains.
The idea being stress-tested proper now could be whether or not the verification downside in agentic commerce is finest solved by Big Tech’s authorization requirements or by programmable on-chain escrow with composable belief layers.
Both approaches are reside, neither is settled, and the reply will seemingly rely on the place agents are doing the most economically significant work when adoption crosses the threshold that makes the infrastructure struggle value having.
The put up Is crypto needed to protect the security of AI agents paying each other online? appeared first on CryptoSlate.
