Notice
This article was written as of July 21, 2026, and includes analysis and interpretation by DANA NOTES.
What This Article Covers
As AI agents begin to move beyond simple information retrieval, such as checking schedules, searching for products, and comparing vendors, and start performing actual tasks, a new infrastructure market is taking shape.
Until now, AI competition has centered on model performance, including the ability to produce more accurate answers and solve complex problems. However, models alone are not enough for AI to connect to corporate work tools and external services or conduct transactions and make payments on behalf of users.
This is because separate infrastructure is required for everything from connecting AI agents to external systems and delegating user permissions to providing payment methods that allow them to spend money and maintaining records that can establish accountability when problems occur.
AI Agents Cannot Perform Tasks with Models Alone
AI models can understand user requests and determine what actions are required.
However, to check a calendar or retrieve information from a corporate database, an AI agent must be connected to those systems. To send an email or order a product, it must also have permission to execute actual functions within external services.
For example, if an AI agent is responsible for preparing a business trip, it must complete the following process:
- Check the business trip schedule on the calendar.
- Search for flights and accommodations.
- Compare prices and travel conditions.
- Select products that meet the user’s requirements.
- Complete the booking and payment.
- Record the transaction results and report them to the user.
In this process, the AI model is responsible for making decisions, but it is connectivity, authentication, permissions, and payment infrastructure that enables the task to be completed.
MCP Is a Common Interface That Connects AI to External Systems
The Model Context Protocol, or MCP, is a common interface that allows AI to access external data and services.
It is intended to simplify a structure in which developers previously had to build separate connections from scratch for each calendar, database, and internal business tool by providing a common method of connection. Businesses are also emerging that support the secure connection of AI agents to enterprise services such as Gmail, Slack, and Salesforce and enable them to execute actual functions.
As MCP becomes more widely adopted, AI agents will be able to use different services and tools more easily. Companies will also be able to reduce the burden of repeatedly developing separate integration structures for each AI product.
However, the existence of a standard does not mean it can immediately be operated at scale in real corporate environments.
Under the existing MCP structure, servers had to continuously manage session IDs to distinguish each user’s connection state. In large-scale environments where traffic is distributed across multiple servers and regions, the operating structure can become complex because each server must share the same session information.
The planned MCP update is designed to reduce servers’ dependence on maintaining session state. Its goal is to lower the maintenance, scaling, and operating costs of large-scale MCP servers.
This indicates that, within the AI agent market, not only models but also the operational infrastructure that allows agents to function reliably within real corporate systems is becoming an important business area.
The Next Bottleneck After Connectivity Is Payment
AI agents have already advanced to the point where they can search for products or vendors, compare prices, and coordinate business terms with counterparties.
However, at the actual payment stage, human approval is still often required.
Existing credit card and bank transfer systems were designed primarily around transactions initiated and authorized by humans. Therefore, when AI agents designed to perform tasks autonomously use existing payment networks, they must call a human back into the process at the final payment stage.
Natural, a startup developing payment infrastructure for AI agents, raised $30 million to address this problem.
Natural is building an agent payment orchestration layer that enables AI agents to store and transfer funds. The concept is that companies integrating this infrastructure could allow their agents to make payments, collect funds, and transact with humans or other agents.
Natural is not merely aiming to automate the process of clicking a payment button. It is also attempting to incorporate the handling of transaction disputes into its payment structure and is developing a system that supports not only U.S. dollar-backed stablecoins but also traditional bank payments.
Stripe is also preparing payment rails for AI agents, while other startups are entering the market as well.
AI Agent Payments Are Different from Conventional Automatic Payments
Current automatic payment systems repeatedly charge users for products they have selected in advance or for predetermined fees.
By contrast, in AI agent payments, the AI can explore multiple options, compare conditions, and then determine which transaction to execute.
Therefore, simply enabling payments is not enough. At a minimum, the following financial controls must also be implemented.
Spending Limits
The amount an agent can spend in a single transaction and its cumulative daily or monthly spending must be limited.
Transaction Scope
It must be possible to restrict payments to specific vendors or categories of products.
Approval Procedures
Transactions exceeding a certain amount or presenting a high level of risk must be executed only after receiving human approval.
Cancellations and Dispute Resolution
There must be a way to process cancellations and refunds when an agent purchases the wrong product or misunderstands the terms of a transaction.
Audit Logs
It must be possible to determine what information the agent used when selecting a transaction and under what authority it made the payment.
Accountability
When an incorrect transaction occurs, it must be possible to determine whether responsibility lies with the user, the agent developer, the payment provider, or the seller.
Once an AI agent begins spending money, a flawed decision can result not merely in an incorrect answer but in a direct financial loss.
Alipay Is Also Combining Payment, Trust, and Openness into a Single Structure
Payment infrastructure for AI agents is not a business area limited to startups.
Alipay has announced a strategy centered on payment, trust, and openness in preparation for the AI agent era.
Its core objective is to establish relevant protocols that allow AI agents to receive delegated authority from users, execute payments, and trace transaction records and accountability. The goal is to create an environment in which AI can move beyond providing information and carry out actual bookings, consumption, and transactions.
Alipay is also developing an open platform that connects not only smartphones but also in-vehicle infotainment systems, AI glasses, wearable devices, various AI models, and service providers.
The concept is to allow businesses to provide services across multiple environments through a single integration, rather than requiring them to develop separate systems for each device and AI environment.
Under this structure, a single task rather than an individual product may become the unit of transaction.
For example, when a user says, “Plan my weekend evening,” an AI agent could combine restaurant reservations, transportation arrangements, movie tickets, and payments into a single task.
Because the services of multiple businesses are connected within one agent, competition centered on individual apps may shift toward competition over service connectivity and transaction infrastructure that AI agents can select and use.
Security Risks Increase as Connectivity Standards Spread
Connectivity standards such as MCP improve development convenience and interoperability.
However, as AI agents gain access to more systems, the range of targets available to attackers also expands.
The following risks require particular consideration.
Malicious MCP Servers
A server disguised as a legitimate business tool could provide incorrect information to an agent or steal authentication credentials.
Excessive Permissions
If an agent that only needs permission to view a calendar is also granted permission to modify or delete events, a minor error could escalate into actual operational damage.
Prompt Injection
Malicious instructions embedded in external documents or web pages could distort the agent’s judgment and induce it to perform actions that were not originally authorized.
Credential Theft
If credentials used by an agent to access calendars, email, databases, and payment services are stolen, multiple systems could be compromised in succession.
Abuse of Payment Authority
If an attacker manipulates an agent’s objective or transaction conditions, funds could be transferred to the attacker through otherwise legitimate payment procedures.
Connectivity and payment infrastructure must therefore provide more than convenience. Least-privilege access, user approval, transaction verification, and logging must be incorporated into the underlying structure.
What to Watch Going Forward
Virtual Cards and Single-Use Payment Methods for Individual Agents
Issuing separate payment methods for each task would make it possible to restrict payment scope and amounts and block only the relevant payment method when a problem occurs.
Human Approval Before Transactions and Audit Logs Afterward
Even when humans do not manually process every transaction, additional approval must be required for high-value or abnormal transactions.
Defenses Against Malicious MCP Servers and Prompt Injection
Security technologies that verify the trustworthiness of connected servers and tools and distinguish externally delivered instructions from the user’s original request will become increasingly important.
Participation by Payment Companies and Financial Institutions in Standards
It will be necessary to examine how not only Stripe but also Visa, Mastercard, and banks participate in agent authentication and payment standards.
DANA NOTES Commentary
The AI agent industry is moving beyond competition over how intelligent models are and entering a stage focused on designing how those models connect to real systems, under what authority they act, and how they conduct transactions.
MCP is creating the foundation that connects AI to external services, while companies such as Natural and Alipay are preparing structures that allow actual transactions and payments to take place on top of those connections.
These two developments are not separate markets.
For AI agents to perform actual tasks, they must be connected to external systems, and to complete commercial activities, they must be able to make payments. As connectivity expands, authentication and permission management become more important. As payment capabilities expand, financial controls involving limits, approvals, cancellations, audits, and accountability become necessary.
The competitiveness of the AI agent market is unlikely to be determined by model performance alone.
Infrastructure that enables agents to connect securely, operate within authorized boundaries, and spend money in a verifiable manner will become a core foundation for the commercialization of AI agents.
