Ten Shopify merchants. Six months. Agent-driven sales: approximately zero.
That is the hardest number in the agentic commerce story, and almost nobody quotes it. Stripe's Instant Checkout shipped in March 2026. By September it was off. The merchants were not obscure โ they were Shopify storefronts with real SKUs, real traffic, real carts. The agent traffic arrived. The conversions did not.
Against that, in April 2026, Stripe published 288 agentic commerce products in a single release cycle.
Two hundred and eighty-eight SKUs. Ten-plus merchants with near-zero sales. Those two facts usually live in different articles. Put them in the same paragraph and the category's actual problem becomes legible.
I have run this drill before. In 2017 I sat inside 0x v0.9.9 for six weeks and pulled three unsigned integer overflows out of fillOrder; the bounty was $5,000 and the lesson was free โ the code tells you what the marketing cannot. In 2022 I reverse-engineered the LUNA/UST loop until I could point at the block height where the peg break became mathematically irreversible. Pre-mortems are cheaper than post-mortems and nobody pays you for either.
So I reversed Stripe's agentic stack. What I found is not an engineering deficit. It is an ownership deficit. The pipes are built. The protocols are specified. The tokens route. And the layer where money actually moves โ the layer that carries liability โ has no owner.
That absence is the most important fact in the entire category, and it is being priced as a feature.
Context: what is actually being built
Agentic commerce is a simple claim with a complicated bill of materials. A user delegates a purchase decision to a model. The model browses, compares, selects, and initiates payment. No human clicks a checkout button.
Everything downstream of that sentence is contested.
The protocol layer has three live candidates. PAP. Visa's TAP. And UCP. All three share one architectural decision, and it is the decision that matters: identity first, money later. Each spec resolves who the agent is, who the user is, and what the agent is permitted to do, before it touches a settlement rail. The authorization graph is defined upstream. The funds movement is defined downstream, and downstream is where the specs thin out.
Stripe sits in an unusual position in that stack. It occupies two layers simultaneously. It is a payment layer โ acquiring, settlement, Link Wallets, shared payment tokens, Shop Pay integration. And since the $7.5 billion OpenRouter acquisition, it is also a model routing layer: 80-plus suppliers, 400-plus models, roughly 10 trillion tokens per day flowing through the gateway.
That combination is genuinely rare. It means Stripe sees the intent stream and the transaction stream in the same telemetry pipeline. Nobody else in payments has that. Visa sees authorization. Adyen sees authorization. Shopify sees carts. OpenAI sees prompts. Stripe, in theory, sees the causal chain from prompt to paid invoice.
On the demand side, the numbers are thinner than the architecture. Meta's Muse is the only hard user metric in the story: 2.18 million DAU. That is Meta's number, not Stripe's. Stripe does not appear in it as a brand. It appears as plumbing.
And the sentiment data is brutal. 93% of merchants believe the agent side should bear liability for agent-initiated errors. 14% of consumers are willing to trust an agent to complete a purchase unsupervised.
Hold those two figures next to each other. The party that wants responsibility and the party that grants trust are not the same party, and the gap between 93 and 14 is the entire commercial problem. It is not a UX problem. It is not a latency problem. It is a liability allocation problem wearing a technology costume.
One more contextual detail that reads as a footnote and is not: Stripe's agentic payment flow is still running in test mode. The Chain of Trust demonstration is a demo. Test mode is a technical state. It is also, conveniently, a compliance posture โ a sandbox shape that avoids formal production filings while the regulatory classification of "AI agent initiating payment" remains undefined.
Core: five failure surfaces in the stack
1. The authorization primitive is a capability token without scope semantics
This is the part I care about most, because I have watched this movie in Solidity.
Stripe's shared payment token is, structurally, a bearer capability. It grants a party the right to move funds. The questions that determine whether it is safe are not cryptographic. They are semantic:
What is the scope? What is the expiry? Who verifies scope compliance, and at what point in the flow? What happens when the scope check and the settlement call are not atomic?
The closest solved analogue in my world is the ERC-4337 session key. A session key is a delegated authority with an explicit permission set โ spend caps, allowlisted contracts, time bounds, and crucially, an on-chain verifier that rejects out-of-scope calls deterministically. The failure mode of session keys is well documented: an over-broad permission set is functionally identical to handing over the private key. The entire security model collapses into the quality of the scope definition.
Now map that onto agent payments. A prompt-injected agent does not need to steal a credential. It needs a token whose scope is broader than the user's actual intent. An over-scoped payment token and a compromised payment token produce the same on-chain outcome: a valid transaction nobody intended.
In 2026 I spent two months inside a verifiable-compute protocol testing ZK proof verification for AI model inference. I found a gas inefficiency in the verifier's constraint handling that cut transaction costs by 40%. The interesting part was not the optimization. It was what the verifier proved: that a specific model ran on specific inputs. It did not prove that the model's output corresponded to the user's intent. Those are different claims, and only the second one matters for payment authorization.
Abstraction layers hide complexity, but not error. The shared payment token abstracts away the authorization decision. It does not abstract away the consequences of getting that decision wrong.
2. Identity-first, money-later leaves the money layer unclaimed
PAP, TAP, and UCP all front-load identity. That is a defensible design choice โ you cannot delegate authority to an entity you cannot identify. But it produces a structural vacuum at the tail of the flow.
When an agent-initiated transaction goes wrong, the question is: who eats the loss? Under the current specs, the answer is nobody, because the specs terminate before the loss event. Identity is resolved. Permission is asserted. Settlement executes. Liability is... implied.
This is why the money layer is unclaimed. Settlement is not where value is captured. Settlement is where liability lands. Every rational actor in this stack wants to own the authorization graph and rent out the settlement rail. Stripe wants the pipes. Visa wants the trust protocol. Meta and OpenAI want the intent surface. Nobody wants to be the entity that pays out when a prompt-injected agent buys 400 units of the wrong SKU.
In 2020 I spent three months simulating slippage vectors on Ethereum mainnet for a paper on liquidity depth in stable pools. The finding that got cited was not about slippage. It was about who absorbs the edge case โ and in every AMM design, the edge case is absorbed by the passive liquidity provider, because they are the only party in the system who did not negotiate terms. Agentic commerce has the same shape. The passive party is the merchant, and the merchant knows it, which is why 93% of them are pre-emptively pointing at the agent.
3. The OpenRouter acquisition inherits a compliance surface Stripe did not buy
$7.5 billion for a gateway routing 10 trillion tokens per day across 400-plus models from 80-plus suppliers. The strategic logic is legible: buy the intent layer before someone else does.
The compliance logic is not.
Routing requests across 400-plus models means crossing the jurisdictional boundaries of 80-plus suppliers. Model providers sit in multiple regulatory regimes. Prompt data is not transaction data. Transaction data is a record of something that happened. Prompt data is a record of something someone thought about buying. That is a materially different privacy classification, and it maps onto GDPR, CCPA, and PIPL with far less tolerance than payment metadata ever received.
Stripe's entire compliance identity is built on money transmission licenses and merchant KYB. That framework has no clause for "we also process the reasoning traces of end users." The OpenRouter acquisition did not add a product line. It added an unquantified, multi-jurisdiction AI data exposure attached to a company whose regulatory relationships are all denominated in payments.
There is a second-order problem. Under a money-transmission framework, KYC logic is simple: whoever initiates is whoever is responsible. Agent payments break that identity. The initiating principal is an autonomous process. The beneficial owner is a human who may have typed a three-word prompt and walked away. AML monitoring models are trained on human behavioral patterns. A prompt-injected agent produces transactions that are neither fraudulent nor normal. They are valid but unintended. There is no typology for that.
4. Deterministic failure mapping
I build pre-mortems because post-mortems are expensive. Here is the failure tree for the current architecture.
Node 1 โ Injection. An agent ingests adversarial content during browsing. This is not hypothetical; it is the default state of any agent reading untrusted web content.
Node 2 โ Scope escape. The agent holds a shared payment token whose permission set is broader than the specific purchase intent. Scope verification is either absent or non-atomic with settlement.
Node 3 โ Valid execution. The payment settles. It passes every fraud check, because it is not fraud. It passes every KYC check, because the credential is legitimate. It passes every velocity check, because the amount is unremarkable.
Node 4 โ Liability vacuum. The merchant disputes. The agent platform points at the protocol. The protocol points at the identity layer. The identity layer points at the token issuer. The token issuer is running in test mode.
Node 5 โ Resolution by contract, not by code. The loss gets allocated by whichever party has the better legal team, not by whichever party had the defective scope check.
That is the deterministic path. It does not require a novel attack. It requires one over-scoped token and one piece of adversarial text, and it terminates in a courtroom rather than a revert.
In my Terra analysis, the value was in locating the irreversibility point โ the moment after which no incentive could restore the peg. The agentic equivalent is Node 3. Once a valid-but-unintended payment settles, every downstream remedy is a clawback negotiation. The system has no atomic revert, because the money layer was never designed to have one.
5. The unit economics are not early. They are absent
Ten-plus Shopify merchants. Six months. Near-zero agent-driven sales.
I want to be precise about what this measures. It does not measure conversion rate optimization headroom. It measures whether demand exists at the small-merchant end of the market. If agentic commerce had genuinely inflected in September, small merchants would show some signal โ a nonzero baseline, a category of SKU that agents reliably buy. They show zero.
And the CEO does not disclose numbers, which is itself a disclosure.
Meanwhile the release cadence tells a different story. 288 products in one April cycle is not demand-driven shipping. It is narrative-driven shipping โ a land grab for standard definition rights, executed at SKU velocity. There is a real technical debt implication here. 288 surfaces that need to be integrated, versioned, and kept coherent against three competing protocol specs is not a platform. It is a portfolio of bets with a shared billing account.
Truth is not consensus; truth is verifiable code. The verifiable code here says: the demand signal is zero at the edge, the product surface is maximal at the center, and the gap between them is being bridged with capital rather than with evidence.
Contrarian: the consensus is wrong about who wins
The consensus position is that agentic commerce is inevitable and Stripe is best positioned because it owns the pipes. I think the pipes are the least defensible part of the stack, for three reasons the consensus keeps skipping.
First: the binding constraint is trust, and trust is not an engineering output. 14% consumer willingness is the only number in this entire story that functions as a gate rather than a metric. You do not fix 14% with better latency or a cleaner API. You fix it with a decade of loss experience and a liability regime that makes the consumer whole without litigation. Stripe's technical stack can be best-in-class and the number can still be 14% in 2029.
Second: the neutral infrastructure position is structurally fragile. Covering OpenAI, Microsoft, Meta, and Google simultaneously looks like indispensability. It is actually hostage-taking in reverse. Every one of those four has both the motive and the engineering capacity to internalize checkout โ OpenAI already tried it, and the fact that its Instant Checkout was retired after six months bought Stripe a time window, not a moat. The moment Meta, which already holds 2.18 million DAU of agent surface through Muse, decides the take rate is too high, Stripe's role degrades from "neutral infrastructure" to "backend processor." That is a demotion, not a negotiation.
Third โ and this is the part I would stake capital on: the actual wedge is stablecoin settlement, not card rails.
The money layer is unclaimed precisely because card-network settlement carries an incumbent liability holder. When a card transaction disputes, the chargeback machinery assigns cost. That machinery is the reason nobody wants to own the agent settlement layer: inheriting it means inheriting dispute exposure on transactions that are valid but unintended, at machine velocity.
Stablecoin settlement has no such incumbent. It has no chargeback primitive. It settles finally, in seconds, with programmability at the token level โ spend constraints enforceable in the transfer itself rather than in an adjacent risk engine. For high-frequency, micro-denominated, machine-initiated payments, that is not a marginal improvement. It is the only architecture that matches the workload.
I have written before that yield-bearing stablecoin products are maturity-mismatch machines that fail first in a bear market, and I stand by that. But settlement is not yield. Settlement is plumbing, and plumbing with enforceable scope at the token layer solves the exact problem Nodes 2 and 3 above describe. A token that cannot be transferred outside its permission set has an atomic scope check. That is what the card stack is missing, and it is why the "money layer has no owner" observation is not a bug report โ it is a market signal pointing somewhere specific.
Here is the uncomfortable corollary for Stripe. If settlement migrates to programmable rails, the value of owning the payment layer collapses toward zero, and the value of owning the intent layer becomes total. The OpenRouter acquisition may turn out to be the only strategically correct decision in the entire 288-product cycle โ not because of the token routing revenue, which is unproven, but because it is the only asset in the portfolio that survives the settlement layer being commoditized.
Takeaway: three signals to watch before you believe anything
I do not forecast prices. I map failure conditions.
Signal one: a named liability holder. If European or US regulators publish guidance assigning agent-error losses to the infrastructure party, Stripe's license moat hardens and the category accelerates. If guidance assigns losses to the licensed payment party, Stripe inherits a liability pool it did not price. Either outcome is decisive. Neither has happened.
Signal two: scope enforcement at the settlement layer, not adjacent to it. Watch for any spec โ PAP, TAP, UCP, or a stablecoin-native equivalent โ that makes permission verification atomic with fund movement. Until that exists, every agent payment is running on an honor system with a legal department behind it.
Signal three: a nonzero small-merchant baseline. Not a headline GMV figure. A single Shopify merchant cohort showing agent-driven revenue that is distinguishable from noise. When that prints, the demand question is settled. Until then, the 288 products are a bet, not a business.
Reversing the stack to find the original intent gives one clean reading. Stripe built the pipes faster than anyone. The pipes are good. But the layer that decides who pays when the machine is wrong is still empty, still unclaimed, and still being marketed as a feature rather than flagged as a hole.
When the first nine-figure agent-error dispute lands, it will not be resolved by an API. It will be resolved by whoever signed the merchant agreement โ and right now, that signature is sitting in test mode.