Mastercard is seeking to make network tokens the payment standard for purchases initiated by AI agents. On its October 29, 2026, earnings call, Chief Executive Michael Miebach described processor-issued one-time virtual card numbers as a temporary bridge rather than a lasting approach. He said Mastercard would support end-to-end tokenization through Agent Pay to preserve cardholder choice, rewards and spending controls. The company also announced that Shopify is integrating Agent Pay and network tokens into Shop Pay, alongside a strategic partnership with OpenAI covering AI payments and services. Mastercard has been building merchant-facing tools for agentic commerce throughout 2026, but Miebach acknowledged that merchants’ technical readiness remains uneven. Other payments companies are developing their own approaches: Stripe supports agentic network tokens from Mastercard and Visa, while Visa has introduced tools for AI-driven shopping. Consumer concerns about fraud and liability remain a potential barrier to adoption.

Visa launched a live pilot with BILL and Billtrust at Money20/20 USA in late October 2026 to test end-to-end B2B invoice payments executed by software agents. The agents act on invoices enterprise buyers have already approved; they do not decide which supplier payments to authorize. Visa’s Trusted Agent Protocol and Agentic Directory are designed to authenticate those agents when they access supplier and merchant portals without shared credentials or manual human login. Separately, Visa has put Commercial Payment Controls into production for eligible issuers in supported regions, allowing businesses to set limits and restrictions on corporate spending. The company plans general availability of Commercial Virtual Authentication and Commercial Supplier Validation in 2027 after pilot completion. Its SESA 2.0 analytics platform has identified more than $600 billion in potentially cardable supplier spend. The pilot tests whether approved invoice payments can be executed through automated workflows while preserving buyer-defined controls.

Mastercard and Visa are advancing different approaches to AI-initiated business payments. At Cloudflare Connect, Mastercard demonstrated an agent making nine payments across multiple service providers under one authorized budget. It also opened early developer access to Agent Pay APIs, a sandbox and toolkits. Visa expanded its commercial agentic suite around a BILL and Billtrust pilot, alongside spend analytics and fraud tools. The distinction is how each approach constrains the agent. Visa’s pilot lets an agent pay invoices that buyers have already approved, using its Trusted Agent Protocol to navigate supplier-portal security without sharing underlying login credentials. Mastercard is testing controls for machine-to-machine transactions, including signed vouchers, agent verification and a score intended to estimate whether an incoming transaction was AI-initiated. Both efforts leave a consequential question for business payments: how responsibility should be assigned when an authorized agent follows its technical instructions but breaches a procurement condition.

Visa, BILL and Billtrust have begun a live pilot in which a payment agent executes end-to-end business invoice settlements between participating buyers on BILL and suppliers on Billtrust. The BILL Payment Agent acts only on buyer-approved payment instructions; it cannot choose invoices independently. Visa’s Trusted Agent Protocol lets Billtrust verify the agent’s cryptographic identity, while invoice-specific tokenized credentials replace exposed portal credentials and physical card data. The pilot addresses a longstanding obstacle to accounts-payable automation: supplier portals often treat automated activity as a potential security threat. Visa also launched Commercial Fraud Solutions to authenticate virtual-card activity and validate supplier credentials before authorization. The companies plan to assess expansion across platforms after initial acceptance benchmarks. They have not disclosed pilot transaction volume or identified the participating enterprises, leaving the scale and broader applicability of the approach unproven.