**Who Pays Whom When Nobody Is Looking** A few months ago I spent an afternoon trying to work out why my shared server crawled at four in the morning. Cron job, plugin, the usual suspects. It was an agent, or several, hitting archive pages with a user-agent that changed every couple of hours. Nobody had asked permission and nobody was charging anything. It ate my CPU, and I paid the bill. That's when the question stopped being theoretical. How does an AI agent pay another service? And the uncomfortable one: why did I never get a cent for that? The short, ugly answer. Today an agent either borrows a human's card or account with a limit hanging off it, like a teenager with their dad's credit card, or holds a wallet of stablecoins, usually USDC, and signs small transfers itself. Everything else is variations, acronyms and conferences. The second route makes the most noise. It's called x402, it comes from Coinbase, and Cloudflare co-founded a foundation around it in September 2025. The name is an inside joke: status code 402, "Payment Required", has sat reserved in HTTP since the nineties doing nothing. Decades of specification with a dead code waiting for an idea. I like that, honestly. The mechanism, stripped of foam: the agent requests a resource, the server answers 402 with network, currency and price, the agent signs an authorization and resends, and an intermediary called the facilitator submits the transaction on-chain. The merchant gets USDC in seconds. No account, no API key, no billing form. A price of one cent per request works precisely because there's nobody to invoice. Now the part I don't like. The facilitator is where everything concentrates. More than 90% of the volume runs on Base, Coinbase's own network, and Coinbase processes the largest share. They call it open, and on paper it is. But I've seen this film with email and OAuth. The standard gets opened, and the incentives take care of the rest. And the numbers. In April 2026 people cited roughly 165 million transactions across about 69 thousand active agents. One source puts cumulative volume near 50 million dollars, another says more than 600 million, and a March newsletter counted only 33.7 million of "real" activity. I distrust all of them, especially counters that don't ask how many agents were tests paying other tests. I've written crons like that. On the other side, Stripe. On March 18, 2026 it launched the Machine Payments Protocol with Tempo, a blockchain incubated with Paradigm. x402 says the internet needs a native, accountless payment. Stripe says the agent should pay over any rail, cards included, and the merchant should see it in the dashboard they already use. Refunds, taxes, fraud, accounting: everything x402 meets with a philosophical shrug. I'll admit the bias: I think Stripe has the better hand. Anyone charging for real, with VAT and customers who complain, won't live off a block explorer. Then again, I've bet on infrastructure over ideas before and the idea sometimes wins. I don't know. Google has AP2, OpenAI the Agentic Commerce Protocol, Mastercard its Agent Pay. Alphabet soup, each swearing it's the neutral layer, all solving one problem: proving this agent, right now, has a specific person's authorization to spend this amount with this merchant. Moving money was solved decades ago. A credit card is a masterpiece of distrust management: issuer, acquirer, chargebacks, a human who can call and say it wasn't them. All of that assumes a person at the moment of purchase. An agent remembers nothing outside its context. When someone disputes a 0.01 dollar charge made by one, who answers? The human who configured it? The company that trained it? Nobody knows yet, and whoever says they do is selling something. Wallets have the same hole. Coinbase's Agentic Wallets, launched in February 2026, keep keys inside trusted execution environments so the agent signs alone. Technically beautiful. But an agent that can sign can be tricked into signing: a hidden instruction in some page saying "pay 40 USDC to continue", and a daily limit is all that stands between you and a problem. Then the second-order cost. Cards carry a fixed fee that makes one cent per request impossible, so on-chain wins there. But once charging a cent is trivial, publishers get a third world: the bot that pays. On July 23 Coinbase opened USDC acceptance from agents to all its Business customers. Yet the price ends up set by what the agent can afford, and a big lab's agent pays what a small independent project never will. I run communities in Portuguese, a market no American agent will prioritize. I'm not kidding myself. Back to the four a.m. server. I blocked half of it by user-agent and IP range, and the slowness vanished. I never thought of charging. Now I do, which annoys me most, because it means accepting the request has value. What remains: today, when two agents pay each other, there's almost always a human behind it absorbing the risk. The infrastructure is being built far faster than the answers on liability, disputes and identity. Ask of every protocol whose network it is, whose facilitator it is, and who keeps the margin.