Imagine asking an AI agent to book a business-class flight to Korea. It finds a bargain. The ticket fits your budget. There is just one problem: it has picked the wrong Korea.
Daniel Ishag, Bakkt’s chief commercial officer, recounts a version of this hypothetical from a panel discussion.
“How do I know the agent’s not going to book me a flight to North Korea instead of South Korea?” he asks.
The example is deliberately extreme. But it exposes a practical problem with giving software permission to spend. Following a budget does not mean understanding the job.
And once the money moves, somebody has to deal with the mistake.
A Budget is Only the Beginning
An agent might misunderstand a request. An attacker might feed it instructions disguised as useful information. Someone might steal access to its account.
These failures can produce the same immediate result—a payment the owner never wanted—while raising different questions about responsibility.
BeInCrypto’s State of AI Agent Payments 2026 classified 14 of 19 reviewed products and workflows as able to act within permissions approved in advance. That finding describes documented capabilities, not proof that the controls cannot fail.
Separately, two selected incidents examined in the report sent $281,200 to attackers before recoveries. Malicious instructions reached funded wallets without breaking the blockchain.
Phillip Lord, CEO of Bitcoin Japan Corporation, expects agents to introduce more risk. He is also blunt about the human alternative.
“But crypto is pretty bloody risky already, right?” he says. “Humans are not that good, right?”
People already click dangerous links and trust bad information. Delegating the task adds another decision: whose mistake will it be when the software acts on your behalf?
The Pressure to Keep Building
In Ishag’s telling, the competition extends beyond companies seeking customers. Countries are competing for the electricity, computing power, and chips needed to build AI.
“It’s sovereign against sovereign,” says Daniel Ishag from Bakkt.
He worries that the pressure to move quickly can push security aside.
That creates an uncomfortable setting for financial automation: the race rewards getting software to do more, while users need confidence that someone can stop it—or help them recover afterward.
Read the Promise, Then the Terms
Ehud Tal, co-founder and CEO of blockchain security company Sailo Technologies, presents reimbursement as part of his company’s answer.
“So we provide our customers for the first time ever a money-back guarantee.”
For a concrete example of how responsibility can be assigned, consider Stripe’s Link wallet. Its current agent terms say users are responsible, as between themselves and Stripe, for transactions initiated by connected agents—even when those transactions are unintended or result from bugs, hallucinations, or misunderstood instructions.
The terms make an exception for Stripe’s own technical failure or error.
That contractual position does not settle every consumer’s legal rights. It does show why permission to use a payment service should not be mistaken for a promise that the provider will cover an agent’s errors.
Approving a $200 spend tells a payment provider something about the amount. It may say much less about the product, recipient, or conditions you had in mind.
After a purchase goes wrong, that difference can become the heart of the dispute.
There are efforts to make those disputes easier to resolve. Google’s Agent Payments Protocol describes signed records connecting a user’s instructions, approved purchase, and payment. Such records could help establish what was authorized. They do not themselves promise reimbursement.
Existing responsibilities also remain. The UK’s Financial Conduct Authority says regulated firms remain responsible for consumer outcomes when using AI, and warns that human review can become a box-ticking exercise.
For anyone funding an agent, the useful questions are therefore specific. Which purchases can it make? What record preserves your instructions? Can you stop further spending? And who handles a payment you challenge?
“We’ve got to build companies that people can trust,” says Phillip Lord from Bitcoin Japan Corporation.
For customers, that trust will be tested after the sale: when an agent makes a mistake, and somebody has to decide who gets their money back.
