When AI Agents Start Spending Your Money | Alex Rampell & Terry Angelos
Alex Rampell, Terry Angelos
AI-assisted summary of When AI Agents Start Spending Your Money | Alex Rampell & Terry Angelos — original source. Check the original for full context.
Source published:
Key ideas
- AI agents are transitioning from passive recommendation engines into active commercial buyers, requiring tokenized payment credentials to execute transactions autonomously. (0:00)
- Independent vaulting infrastructure like Very Good Security (VGS) touches roughly 80% of U.S. payment cards and is provisioning millions of standardized agentic tokens weekly to bypass proxy-purchasing hacks. (24:35)
- Card networks are formalizing agent registration and agentic tokens with spending limits to preserve chargebacks, identity checks, and merchant customer relationships. (24:35)
- Merchants are bifurcating in response to agentic traffic: Amazon blocks scrapers to protect retail ad margins, whereas logistics-heavy players like Walmart and small Shopify merchants lean into automated orders. (35:00)
- Widespread agentic optimization threatens corporate business models built on breakage, consumer inertia, and cross-subsidized credit card reward programs. (45:00)
Detailed notes
## Background Published on October 15, 2026, on the a16z Podcast feed, this episode features a16z General Partner Alex Rampell interviewing VGS Executive Board Member and Chief Strategy Officer Terry Angelos. According to the show description, the conversation explores the payments infrastructure required when AI agents shift from recommending products to directly executing purchases, covering the emerging wallet wars, agentic tokens, merchant resistance, and shifting liability models.
## TL;DR Alex Rampell and Terry Angelos explore how granting autonomous AI agents payment credentials transforms them from passive recommendation engines into active commercial participants. They analyze the technical infrastructure required for safe delegated purchasing, contrasting legacy PCI compliance and proprietary virtual card hacks with standardized, domain-bound agentic network tokens. The discussion details the corporate battle between major digital wallets scrambling for default agent status, while examining merchant resistance from ad-driven giants like Amazon versus volume-driven platforms like Walmart. Finally, they unpack the broader economic ramifications, arguing that agentic optimization will eliminate consumer breakage models such as forgotten subscriptions and cross-subsidized credit card rewards while unlocking latent demand across e-commerce.
## Atmosphere & style The conversation carries an easy, conversational warmth rooted in two decades of shared operating history between former co-founders, complete with self-deprecating banter about aging, physical leather wallets, and buying apology flowers. Beneath the nostalgic rapport lies an intense, fast-paced technical deep dive into the esoteric plumbing of global payments, rich with inside-baseball analogies ranging from Las Vegas casinos and early AOL walled gardens to NASCAR-style checkout screens. The tone remains analytically grounded and pragmatically skeptical, avoiding breathless AI hype in favor of concrete mechanics around liability, unit economics, and merchant incentives.
## Bulletin - `00:00` AI agents are transitioning from passive recommendation engines into active commercial buyers, requiring tokenized payment credentials to execute transactions autonomously. - `24:35` Independent vaulting infrastructure like Very Good Security (VGS) touches roughly 80% of U.S. payment cards and is provisioning millions of standardized agentic tokens weekly to bypass proxy-purchasing hacks. - `24:35` Card networks are formalizing agent registration and agentic tokens with spending limits to preserve chargebacks, identity checks, and merchant customer relationships. - `35:00` Merchants are bifurcating in response to agentic traffic: Amazon blocks scrapers to protect retail ad margins, whereas logistics-heavy players like Walmart and small Shopify merchants lean into automated orders. - `45:00` Widespread agentic optimization threatens corporate business models built on breakage, consumer inertia, and cross-subsidized credit card reward programs.
## Key takeaways - `00:00` AI agents are becoming transactional actors rather than spectators by gaining direct access to payment credentials as their functional 'arms and legs'. - `03:40` Modern e-commerce relies on domain-bound network tokens issued by card schemes rather than raw 16-digit PANs to limit the fraud blast radius and eliminate PCI DSS compliance overhead. - `05:30` Merchants with over $1 billion in annual GMV typically run three to five payment processors simultaneously, necessitating independent, processor-neutral vaults to avoid vendor lock-in. - `05:30` Roughly 30% of credit cards turn over every year through routine expiration, loss, theft, or portfolio changes, requiring automated network account updaters to prevent subscription failure. - `12:35` A new 'wallet wars' era has erupted between major platforms (PayPal, Shop Pay, Link) competing to become the default payment rail for emerging agentic task runners. - `17:30` Pass-through vaults like Apple Pay hand network tokens to the merchant's processor, whereas transactional wallets like PayPal or Shop Pay act as full-stack payment settlement layers. - `20:00` The early phase of agentic purchasing relied on virtual card workarounds where wallet intermediaries bought items on behalf of consumers, severing customer support loops and obscuring merchants of record. - `24:35` Single-use virtual cards break post-purchase merchant relationships, including recurring subscriptions and loyalty enrollments, by rendering credentials unusable for follow-on billing. - `24:35` Card networks have introduced standardized agentic tokens bound to specific spending caps and merchant authorizations, maintaining standard chargeback and dispute rights. - `26:40` Vault architecture is shifting from 'single-player' storage for a single gateway into 'multiplayer' infrastructure that delegates payment authority across multiple processors and external agents. - `30:00` Evaluating transactions involves card validity, payer identity, and capacity/intent; agents currently introduce significant dispute friction regarding whether they hallucinated purchase parameters. - `35:00` Under delegated authority, merchants expect full payment without post-purchase excuses, treating agents like human family members or authorized assistants rather than writing off friendly fraud. - `35:00` Amazon actively resists AI purchasing tools like Muse because headless agents do not view high-margin sponsored search advertisements, threatening retail media revenue. - `35:00` The friction between merchants and agents mirrors the early Plaid vs. banks conflict, likely resolving into tokenized, opinionated, and toll-gated commercial APIs. - `40:00` Rather than causing immediate bank runs via yield optimization, agents are poised to unlock latent consumer demand and increase personal spending by removing friction from recurring purchase recommendations. - `45:00` Asymmetric advantages of bots will diminish as everyone adopts agents, forcing counterparties to establish strict proof-of-humanity checks or revise terms and conditions. - `45:00` Credit card rewards programs that rely on breakage and cross-subsidization will be severely challenged if agents programmatically route every transaction to maximize rewards. - `48:00` VGS has evolved through three distinct phases: first as a secure PCI storage vault, second as a dynamic token lifecycle manager, and third as a network-level broker enabling agentic commerce.
## Detailed walkthrough ### `00:00` From Spectators to Actors: The Dawn of Agentic Commerce
The conversation opens on the pivotal shift underway in artificial intelligence: software agents are transitioning from merely browsing and recommending products to executing transactions directly. As Terry Angelos observes: “In the last three months, we've had this huge leap from agents being what I would call spectators to agents being actors, because they effectively have arms and legs, which are payment credentials.” Giving autonomous agents the ability to spend money unlocks tremendous utility, but it instantly ignites new ecosystem friction. Platforms like Amazon have already pushed back by blocking services such as Muse, prompting merchants to divide between those resisting agentic traffic and those leaning into it. At the same time, platforms like Muse and Instinct have ignited what Angelos calls the “wallet wars,” in which established digital wallets scramble to become the default payment rail powering autonomous agents.
Alex Rampell and Terry Angelos share a long operating history, having co-founded TrialPay together in 2006. Rampell jokes about the passage of two decades, noting that while Terry looks unchanged, he himself looks very different: “Yes, you look the same. So I think you're insulting me and I'm complimenting you and hopefully not the other way around.” After TrialPay was acquired by Visa, Angelos led Visa’s corporate investment into Very Good Security (VGS), a startup where Rampell had led one of his earliest venture investments at a16z. Rampell highlights that the name VGS was conceived as a lighthearted homage to Pretty Good Privacy (PGP), the classic encryption program: while PGP relied on the mathematical difficulty of factoring large composite prime numbers to deliver unbreakable privacy despite its modest name, VGS was named to deliver “Very Good Security” to enterprise infrastructure.
Angelos has now joined VGS as Chief Strategy Officer and board member, where the company operates at the nexus of modern digital transactions. VGS sits as neutral infrastructure securing payment credentials across roughly one-third of all e-commerce gross merchandise value (GMV), powering top-tier online merchants, major neobanks, and leading frontier AI research labs. With agents requiring access to payment rails, VGS finds itself orchestrating the delicate handoffs between wallets, autonomous agents, and downstream merchant processors.
- **Founding roots**: Alex Rampell and Terry Angelos co-founded TrialPay in 2006 before its eventual acquisition by Visa. - **VGS scale**: Secures credentials representing approximately one-third of total e-commerce GMV. - **Client profile**: Encompasses large-scale online merchants, enterprise neobanks, and frontier AI research labs.
---
`03:40` Demystifying Credentials and Network Tokenization
To establish baseline mechanics before diving into agentic commerce, Angelos and Rampell walk through the anatomy of a payment credential in traditional e-commerce. In common parlance, a credential is simply a credit card, but handling it securely requires intricate compliance and data partitioning. In a typical integration—such as a large-scale food ordering or delivery platform—the merchant cannot directly handle or store the raw card details without subjecting their entire server footprint to stringent, expensive PCI-DSS compliance audits. Instead, VGS intercepts and captures the card number at checkout, vaults it in an isolated, secure environment, and provides the merchant with an abstraction so their internal systems never touch sensitive financial data.
The underlying mechanics of this vaulting have evolved dramatically over the past decade. Back during the TrialPay era, companies would store and encrypt the raw 16-digit Primary Account Number (PAN), decrypting it on demand to transmit to back-end acquirers like Chase Paymentech. Modern e-commerce instead relies heavily on network tokenization issued directly by the major card networks—Visa, Mastercard, American Express, and Discover. Rather than circulating the raw PAN, VGS requests a network token that is cryptographically restricted and domain-bound strictly to that specific merchant’s web domain. If that token is intercepted or leaked, it cannot be used anywhere else across the web, drastically curtailing the blast radius of payment fraud.
```mermaid flowchart TD accTitle: Legacy Card Processing vs Modern Domain-Bound Tokenization accDescr: Diagram contrasting how 16-digit PANs were handled in legacy workflows versus modern network tokenization through an independent vault.
subgraph Legacy["Legacy PAN Handling"] A["Customer PAN (16 Digits)"] --> B["Merchant Encrypts & Stores PAN"] B --> C["Merchant Decrypts PAN"] C --> D["Acquiring Processor"] end
subgraph Modern["Modern Network Tokenization (VGS)"] E["Customer Inputs Card"] --> F["VGS Intercepts & Vaults PAN"] F --> G["Card Network (Visa/MC/Amex/Discover)"] G --> H["Domain-Bound Network Token"] H --> I["Merchant Transacts Safely"] I --> J["Acquiring Processor"] end ```
---
`05:30` Multi-Processor Architecture, Churn, and Account Updaters
The necessity of an independent vault becomes stark when managing enterprise-scale merchants. When Angelos asks how many payment processors an online merchant doing over $1 billion in GMV typically runs on the back end, Rampell notes that while smaller outfits rely on a single gateway, large operations deliberately unbundle storage from processing. Angelos confirms that enterprise merchants operate between three and five distinct processors simultaneously: “And so back to that question, by the way, for a merchant of a billion dollars, it's about three to five processors that merchant will have.” Merchants implement multi-processor setups to shard payment traffic across different vendors, seeking lower interchange and processing fees, higher regional authorization and approval rates, and structural redundancy.
If a merchant were to rely on a single processor’s proprietary vault (such as Stripe or Chase), switching processors or routing transactions flexibly would require duplicating hundreds of millions of credentials across multiple isolated vaults. An independent vaulting layer like VGS eliminates this vendor lock-in by maintaining the golden record of credentials in a processor-neutral environment, issuing appropriate network tokens to whichever processor handles a given transaction.
This independent vault architecture also mitigates the massive underlying churn of payment credentials. Roughly one-third of all payment cards turn over every year: 25% mathematically expire due to standard four-year expiration schedules, and another 5% are reissued due to loss, theft, or portfolio migrations. Rampell shares a personal example from Capital One’s acquisition of the Discover Network, where his existing Capital One 1.5% cashback Visa card was reissued as a Discover card, triggering an avalanche of failed transaction notices from recurring subscription merchants whose records broke. Independent vaults integrate directly with automated account updater services from the card networks, updating expired or converted cards behind the scenes so consumer billing continues without disruption.
- **Enterprise processor footprint**: Merchants with >$1B in annual GMV maintain an average of 3 to 5 payment processors. - **Card turnover rate**: ~30% of credit cards turn over each year (25% from routine 4-year expiration cycles, ~5% from fraud, theft, or portfolio changes). - **Network account updaters**: Real-time card brand updating tools replace expired numbers and accommodate portfolio conversions (e.g., Visa to Discover shifts) without requiring manual consumer re-entry.
`10:00` PCI DSS Compliance and Why AI Agents Need VGS
Alex Rampell reflects on how Very Good Security (VGS) started years ago as an infrastructure business built around solving a painful, highly regulated compliance problem. The landscape suddenly shifted with the explosion of agentic e-commerce. AI companies racing to deploy autonomous tools quickly realized they could not simply ask users for credit card numbers and store them in plain text. Alex jokes about the universal domestic dilemma of wanting to buy flowers for his wife on Mother’s Day so she will not be mad at him: a user might prompt a chat interface with that request, but the underlying AI application has no desire to hold sensitive card data. Storing and transmitting payment credentials drags a company into the grueling labyrinth of PCI DSS (Payment Card Industry Data Security Standard) compliance—a dense framework spanning well over a hundred pages of operational, architectural, and security mandates that every financial institution strictly enforces.
Alex emphasizes that whether Visa and Mastercard are bitter competitors on every other front, they stand entirely united on cardholder data protection. If a company wants to process or issue credit cards, compliance is an inescapable prerequisite. VGS solves this bottleneck by taking PCI compliance out of scope altogether, acting as the secure backend custodian so software platforms can operate like modern tech companies rather than pseudo-banks. As conversational agents evolve from simply generating advice to executing real-world purchases, having this pre-built, compliant vaulting infrastructure positions VGS squarely in the middle of autonomous agent transactions.
> “You cannot process credit cards unless you are PCI compliant.” — Alex Rampell
- **PCI DSS scope:** Over 100 pages of compliance mandates that all issuing banks, acquirers, and card networks mandate for any business touching raw payment card data. - **VGS value proposition:** Desensitizes systems by tokenizing card numbers and credentials on ingestion, taking the host application's servers entirely out of PCI audit scope.
```mermaid flowchart LR accTitle: AI Agent Checkout Flow with VGS accDescr: Diagram illustrating how an AI agent uses VGS tokenization to process purchases without touching raw PCI data.
subgraph UserAgent["User & AI Interface"] U["User Prompt<br/>('Buy flowers')"] --> A["AI Agent"] end
subgraph SecurityLayer["Compliance Boundary (VGS)"] A -->|"Delegates transaction"| VGS["VGS Token Vault"] VGS -->|"Detokenizes credential"| P["Payment Rail"] end
subgraph MerchantLayer["Commerce Endpoints"] P --> M["Flower Merchant / Acquirer"] end ```
---
`12:35` From Spectators to Actors: Giving Agents Arms and Legs
Terry Angelos describes a massive paradigm shift that unfolded rapidly: AI agents transitioned from passive observers into active commercial participants. For months, generative models were limited to drafting recommendations, comparing specs, or delivering research reports that ultimately ended with a task dumped back on the user's to-do list. Terry illustrates this shift with a personal example from his own household. He and his wife had spent weeks trying to hire a piano teacher for their seven-year-old son, a logistical headache involving family calendars, soccer practice three afternoons a week, finding an instructor willing to travel to their home, and matching availability. Months prior, ChatGPT could only offer generic suggestions and local directory links; the previous night, an autonomous agent handled the entire end-to-end transaction—vetting candidates, cross-checking mutual availability, asking Terry a few clarifying questions, and booking the first lesson.
Terry points out that payment credentials serve as the literal “arms and legs” for autonomous software. Without a funded credential, an agent remains an advisor; with one, it becomes an autonomous purchaser. This shift has kicked off what he dubs the "wallet wars" among emerging agentic frameworks (such as MultiOn, Induced AI, and others) and established identity and payment platforms. Every wallet provider is now scrambling to integrate directly into agent workflows. For an agent, the ideal wallet partner must satisfy two fundamental requirements: an enormous existing base of pre-enrolled consumer credentials and widespread merchant acceptance.
> “In the last three months, we've had this huge leap from – agents being what I would call spectators to agents being actors.” — Terry Angelos
- **Stripe Link:** Boasts approximately 300 million consumer accounts and reaches roughly 1 million integrated merchants. - **Shopify (Shop Pay):** Encompasses a comparable consumer footprint alongside an estimated 1.7 million merchant storefronts. - **PayPal:** Commands upwards of 400 million active consumer accounts and a global merchant footprint exceeding 30 million sellers. - **Agent utility inflection:** Equipping software agents with programmatic payment mechanisms shifts the consumer experience from passive recommendation to completed execution.
---
`14:48` The Long History of Wallet Wars: From Dead Cow Wallets to NASCAR Checkouts
Alex and Terry look back at the historical precedent for digital wallet battles, reminiscing about their shared background in payments and their previous employer, Visa, which launched early wallet plays like V.me (later rebranded to Visa Checkout). Alex pulls out his physical leather wallet to make a tactile point, dubbing it a "dead cow wallet." He notes that the struggle for top-of-wallet status is decades old: card issuers spent vast fortunes—like Capital One hiring Samuel L. Jackson to ask "What's in your wallet?" during prime-time commercials—solely to condition consumers in a Pavlovian way to pull their specific plastic card out at the Chipotle register.
The battlefield later shifted into digital software environments. Alex recalls working at TrialPay and navigating partnerships where card networks and banking institutions, such as Chase and American Express, poured tens of millions of dollars into platforms like Uber and Airbnb simply to be selected as the default payment method inside those apps. Terry observes that this intense merchant-level competition led directly to the classic "NASCAR checkout," where e-commerce landing pages became cluttered with dozens of competing branded checkout buttons: PayPal, Google Checkout, Apple Pay, and credit card options all vying for consumer attention.
> “And so we sort of have kicked off what I kind of call the wallet wars, where every wallet is now rushing to connect to the agents.” — Terry Angelos
- **V.me:** Visa’s early attempt to build a proprietary digital checkout button and consumer digital wallet before transitioning into Visa Checkout. - **Issuer bounties:** Mega-banks paid tens of millions of dollars directly to top-tier digital marketplaces (Uber, Airbnb) to secure default billing status over rival payment networks. - **The "NASCAR checkout" effect:** The visual fragmentation of modern e-commerce checkouts caused by competing payment brands fighting for button space.
---
`17:30` Merchant Vaults, Consumer Wallets, and Friction in the Agentic Era
Alex and Terry contrast the mechanics of consumer wallets against merchant wallets. Alex frames platforms like VGS as effectively operating like "merchant wallets." While a merchant is not purchasing goods, it constantly receives payments and often needs to bill recurring customer subscriptions. Storing 16-digit Primary Account Numbers (PANs) and three-digit security codes on internal servers is the digital equivalent of keeping credit card numbers on paper scraps in a physical cash register drawer. Merchants need an isolated tokenized vault to handle that recurring billing securely without taking on massive liability.
On the consumer side, wallets originally solved an acute late-night e-commerce friction problem. Alex jokes about waking up at 2:00 AM needing to order flowers online—quipping dryly that whether it is to make up for something bad or celebrate something good, the core friction remains identical: the physical dead cow wallet is downstairs, the card numbers are out of reach, and the purchase will be abandoned unless a digital credential wrapper like PayPal or Apple Pay bridges the gap. Terry notes that the word "wallet" conflates two distinct models:
1. **Credential Pass-Through Wallets (e.g., Apple Pay):** These wallets securely store and tokenize credentials, passing a device-specific network token directly to the merchant’s processor (such as Adyen, Stripe, or Braintree) to finalize the settlement. 2. **Full-Stack Transactional Wallets (e.g., Shop Pay, Link, PayPal):** These wallets sit directly in the transaction flow, holding the consumer’s identity, processing the payment natively, and collecting the funds on behalf of the merchant.
In the emerging agentic economy, this distinction becomes critical. If an AI agent has to interrupt a user at 2:00 AM to ask for their 16-digit card number, the autonomous workflow collapses back into high-friction manual checkout. Seamless agentic commerce depends on connecting autonomous task runners directly to existing tokenized credentials.
> “When I shop at a store with Apple Pay, Apple is effectively giving my Capital One Visa card, effectively tokenized in the wallet, to the merchant.” — Terry Angelos
| Wallet Architecture | Primary Example(s) | Operational Mechanism | Role in Transaction | |:--- |:--- |:--- |:--- | | **Pass-Through Digital Vault** | Apple Pay | Stores device tokens derived from issuing banks; passes them to the merchant's payment processor. | Hardware/credential conduit; does not process or settle funds directly. | | **Transactional Ecosystem** | Shop Pay, Stripe Link, PayPal | Manages identity, holds stored payment methods, and executes the charge directly within its network. | Merchant-facing settlement layer; facilitates end-to-end purchase execution. | | **Merchant Backend Vault** | Very Good Security (VGS) | Intercepts cardholder data upstream, tokenizes card numbers, and provides API tokens for merchant rebilling. | Data security infrastructure; shields merchants from PCI DSS exposure. |
`20:00` The "AOL Phase" of Agentic Commerce and the Virtual Card Hack
Terry Angelos draws a direct parallel between the emerging ecosystem of agentic commerce and the early days of consumer internet access. In this nascent phase, convenience often relies on closed environments and clever engineering shortcuts rather than unified, open standards. Stripe, with its consumer-facing wallet Link, operates within this bounded model: Link is enabled across roughly one million merchants, which works seamlessly if a requested item is in that network, but fails whenever a user sends an AI agent to buy from an unsupported merchant.
To illustrate, Angelos shares an experience from two weeks prior when he needed outdoor lights for an event at his house. He used an agent to search for the lights, and it found the best inventory at Walmart. The agent loaded the shopping cart, but when it came time to check out, Link had no direct payment integration with Walmart. Rather than abandoning the transaction or passing Angelos’s raw card credentials directly to the agent and Walmart, Stripe acted as an intermediary buyer. Stripe purchased the lights on Angelos's behalf using its own one-time-use Visa virtual card, and then ran a separate transaction to charge Angelos directly—a model closely mirroring how DoorDash handles orders and pays non-partnered restaurants.
Terry highlights how this proprietary, walled-garden design characterizes this period of commerce:
> “And for those people who were around in the sort of AOL era, Stripe in many ways is like the AOL of agentic commerce.”
```mermaid flowchart TD accTitle: The AOL Model of Agentic Purchasing accDescr: Diagram illustrating how an agentic purchase routes through an intermediary virtual card rather than directly to the merchant.
subgraph UserStage["1. Consumer & Agent"] U["User (Terry)"] -->|"Requests lights"| AG["AI Agent"] AG -->|"Loads cart"| WM["Walmart"] end
subgraph IntermediaryStage["2. Intermediary Workaround"] AG -->|"Requests payment"| SL["Stripe Link"] SL -->|"Issues 1-time Visa virtual card"| WM WM -->|"Fulfills order"| U end
subgraph SettlementStage["3. Secondary Charge"] SL -->|"Charges actual card in separate transaction"| U end ```
---
`22:15` Trust Mechanisms, Chargebacks, and the Broken Support Loop
While the proxy-purchasing mechanism successfully delivers items, it fractures the fundamental trust, dispute, and customer service models established over decades of electronic payments. In Angelos's Walmart purchase, the chandelier arrived and the correct dollar amount cleared. However, should an issue arise with the product, the banking paper trail reflects a purchase from Stripe rather than Walmart. Angelos recounts an anecdote from an internal testing phase where someone executed this exact proxy flow on an American Express card and encountered an issue. When they called Amex customer service, Amex had no record of the underlying retail merchant—only a transaction labeled "Stripe." Amex provided the merchant contact number attached to that record, which rang directly on the personal cell phone of a Stripe engineer, exposing the reality that payment infrastructure providers are not staffed to operate retail customer-support desks.
Alex Rampell points out that this structural flaw undermines the primary reason card networks remain dominant. Unlike bearer instruments like cryptocurrency—where an erroneous or fraudulent transaction permanently transfers funds with no recourse—Visa and Mastercard provide an essential adjudicative framework through rules and chargebacks. If a merchant fails to deliver functional outdoor lights, an established dispute process protects both consumer trust and merchant reputation. Layering complex engineering workarounds between the buyer and the seller strips away these consumer protections and breaks standard reconciliation.
Alex emphasizes why the network-level dispute mechanism is so critical to commerce:
> “One of the reasons why Visa and MasterCard have such impregnable positions is because they intermediate everything and they set the rules and chargebacks are very important.”
- Crypto acts as a bearer instrument where transferred funds cannot be recovered, creating friction in retail environments where products might be defective. - Intermediary virtual cards obscure the true merchant of record, leaving issuing banks (such as Capital One or Amex) blind to the actual retailer involved in the purchase. - Consumer chargeback rights and merchant rules provide an institutional trust layer that clever proxy-payment hacks unintentionally break.
---
`24:35` The Rise of Agentic Tokens and Preserving Merchant Relationships
The limitations of virtual card workarounds extend beyond chargebacks to downstream customer lifetime value and recurring transactions. Shortly after his Walmart purchase, Angelos received an email from Walmart noting the $6.99 delivery fee and offering to credit that amount toward a subscription to Walmart+. Angelos clicked the button to accept the offer, but the transaction immediately failed. Walmart attempted to bill the credential on file, which was merely the single-use virtual card Stripe had generated for the chandeliers. This prevented Walmart from retaining and upselling a paying customer, disrupting standard e-commerce merchant incentives.
To solve this, card networks have introduced an open standard called "agentic tokens." Under this framework, if a digital wallet (like Stripe Link, Shop Pay, or PayPal) holds a cardholder's credential on file but lacks a merchant integration, it can issue an agentic token instead of acting as a proxy buyer. The agent verifies its identity, specifies a spending cap (for example, no more than $100), and receives a newly generated 16-digit network token bound to that specific authorization. The agent supplies this token to Walmart, which processes the transaction against the customer’s actual card account. This preserves the merchant's ability to run recurring billing or cross-sells, leaves chargeback protections intact, and eliminates proxy-purchasing hacks.
Terry describes how quickly this infrastructure is being adopted across the ecosystem:
> “VGS is by far the largest provisioner of these agentic tokens.”
- Agentic tokens represent a transition from closed "AOL-style" proprietary workarounds to standardized network protocols. - The token functions as a fresh 16-digit number tied directly to consumer authorization rules, such as merchant identity and maximum spend amounts. - Three months prior to the discussion, agentic token volume was at absolute zero; VGS is now provisioning several million agentic tokens per week across agents, wallets, and merchants.
---
`26:40` From "Boring" Vaults to Multiplayer Infrastructure: VGS and Frontier Models
Alex Rampell characterizes VGS's core data-vaulting business as intentionally "boring," emphasizing that in the security and payments sphere, safety and lack of surprises are the ultimate virtues. A vaulting platform securely holds 15-digit Amex or 16-digit Visa/Mastercard/Discover credentials, hands back non-crypto reference tokens, and allows high-volume enterprise consumer apps—such as major burger chains with tens of millions of users—to retrieve credentials and route them to payment processors without the merchant ever handling or storing card data. Angelos estimates that VGS touches or stores approximately 80% of cards in America across its roughly 10 billion vaulted credentials.
```mermaid flowchart LR accTitle: Single-Player vs Multiplayer Vaults accDescr: Comparison showing how vaults shifted from storing single merchant-to-processor tokens to routing across multiple processors and AI agents.
subgraph SinglePlayer["Single-Player Era"] VaultA["Vault"] -->|"1 credential"| ProcA["Single Payment Processor"] end
subgraph Multiplayer["Multiplayer Agentic Era"] VaultB["Vault"] -->|"Network Token"| Proc1["Adyen / Stripe / Chase"] VaultB -->|"Agentic Token"| Agent["AI Agent"] Agent -->|"Authorized Purchase"| Retailer["Third-Party Merchant"] end ```
The underlying architecture of these vaults is undergoing a massive shift: moving from "single-player" to "multiplayer." Historically, a merchant vaulted a card to communicate with a single payment gateway. As merchants adopted multi-processor routing strategies across providers like Chase, Stripe, Adyen, Braintree, and Razorpay, the vault transformed into a multiplayer hub. The emergence of frontier AI models has accelerated this dynamic even further. A frontier model provider that initially vaults cards purely for single-player consumer software subscriptions now needs those same credentials to empower AI agents to complete transactions across third-party web properties. Terry compares this evolution to password managers expanding from simple personal storage into multi-party delegation platforms.
Terry frames this transformation in infrastructure terms:
> “I think you're charging on something really interesting, which is vaults are going from single player to multiplayer.”
- VGS holds roughly 10 billion credentials and interacts with an estimated 80% of payment cards in the United States. - Multiplayer vault architecture allows stored network tokens to be distributed across diverse payment processors including Stripe, Chase, Adyen, Braintree, and Razorpay. - Frontier AI model providers are transitioning their credential stores from basic SaaS subscription billing into multiplayer delegation tools that empower autonomous agents to spend across the open web.
`30:00` The Three-Step Transaction Test: From Las Vegas Casinos to AI Agents
Alex Rampell breaks down the fundamental anatomy of approving a payment transaction into three distinct steps, contrasting how physical retail handled it decades ago with how digital and agentic commerce must handle it today. The first step is simply verifying whether a card is real. This can be checked synthetically using a checksum—specifically the Luhn algorithm or mod 10 check—to confirm it belongs to the universe of possible valid card numbers, followed by an issuer check with the bank to ensure it is an active account. The second step is confirming identity: verifying that the person presenting the card is actually authorized to use it. Twenty-five years ago, a physical merchant, such as a jewelry store selling a $15,000 item, would verify the signature strip on the back of the card and demand a government-issued photo ID. Alex notes humorously that the physical Apple Card was the first card he ever saw that eliminated the signature line on the back entirely.
The third step is determining capacity or intent: is the buyer of sound mind to execute the purchase? Alex illustrates this using Las Vegas casinos, where a customer might present a completely valid card and a matching ID, but if they have had fifteen drinks and cannot speak coherently, the cashier will refuse the transaction. Translating this framework to agentic commerce exposes severe unresolved friction. While card validity is an easily solved technical problem, confirming whether an agent or an IP address is authorized—and whether that agent was operating of "sound mind" or hallucinating—creates enormous liability exposure. Terry Angelos explains that payment networks like Visa, Mastercard, and American Express are building open standards where an agent must be explicitly registered with the network and contextual transaction metadata must be passed along. Terry shares a personal example where he instructed an agent to book a hotel for his daughter’s gymnastics tournament in San Diego with a strict cap of $500. While the card validity and registration can be proven, determining whether the agent accurately interpreted the dates or hallucinated remains completely outside current payment rail dispute mechanisms.
“The third question is like, is the agent of sound mind? Like, did it get it right? Was it drunk? You know, exactly. Did it hallucinate? And so that part, I don't think we fully understand yet, because if there's a mistake that the agent makes and the card network did everything right, they validated that this is your agent and your instruction.” — Terry Angelos
```mermaid flowchart TD accTitle: Three-Step Transaction Verification Framework accDescr: Comparison of traditional verification checks against how AI agentic transactions are validated.
subgraph Step1["Step 1: Card Validity"] A["Card Checksum (Mod 10)"] --> B["Bank Issuer Verification"] end
subgraph Step2["Step 2: Authorized Payer"] C["Physical: ID & Signature Match"] D["Agent: Registered with Visa / Mastercard / Amex"] end
subgraph Step3["Step 3: Capacity & Sound Mind"] E["Physical: Sobriety / Sound Mind (e.g., Vegas Casino)"] F["Agent: Did it hallucinate context or dates?"] end
Step1 --> Step2 Step2 --> Step3 ```
- Mod 10 (Luhn checksum) proves mathematical validity, while the issuing bank confirms account existence. - Legacy card-present identity checks relied on physical signatures and driver's licenses; the Apple Card pioneered removing physical signature strips. - Network agent registration standards require the AI agent to register with card schemes (Visa, Mastercard, Amex) and attach explicit intent context (e.g., booking parameters) to the transaction.
`35:00` Delegated Authority, Friendly Fraud, and the Battle for Merchant Receptivity
The conversation shifts to the liability models governing delegated authority. If an agent books the wrong room or overspends, merchants will refuse to absorb the financial hit, arguing that the customer voluntarily gave authority to an AI agent just as they might to a spouse or a human executive assistant. Alex recalls the epidemic of "friendly fraud" from his days running TrialPay, where consumers—embarrassed by spending $10,000 on virtual gems in a mobile game—would lie to their spouses and claim to their banks that the charge was fraudulent. While banks historically wrote off small disputes (such as $10 charges) to keep customers happy, creating widespread moral hazard, delegated authority with automated agents threatens to balloon these dispute disputes unless agents begin offering financial indemnity or chargeback guarantees as a competitive differentiator between services like Muse or Instinct.
This friction leads into a strategic divide: how merchants choose to respond to agentic shoppers. Amazon recently made headlines by blocking the AI purchasing tool Muse. Alex explains that Amazon’s hostility is not mere technological backwardness; Amazon is primarily an advertising company whose most lucrative SKU is selling sponsored search placements to monetize human eyeballs. Because an AI agent has no eyeballs to monetize, Amazon has strong economic incentives to insert CAPTCHAs and erect barriers. Terry outlines three distinct merchant stances across the retail landscape:
1. **Amazon (Fear/Protection):** Guarding its advertising and retail media margins against headless scrapers and bots. 2. **Walmart (Greed/Scale):** Embracing automated orders because its world-class retail footprint and last-mile logistics make every additional automated SKU sold purely advantageous. 3. **Shopify SMBs (Necessity):** Small merchants who lack search dominance and must embrace agents as an essential new customer acquisition funnel.
Terry compares this looming merchant standoff to the battle over open banking between Plaid and major banks like JPMorgan Chase. Initially, banks attempted to block screen-scraping aggregators, but the conflict eventually settled into negotiated API frameworks where banks controlled tokenized account data, dictated security boundaries, and charged fees. Terry predicts a similar trajectory for e-commerce, where platforms like Amazon will eventually expose "opinionated APIs" or deploy their own merchant-side sales agents—akin to a Best Buy floor salesperson steering a customer toward specific flat-screen TVs to earn a commission—pitting the merchant's biased agent against the consumer's agent in a complex automated negotiation.
“In the case of Amazon, it might be, I am an opinionated API. I have an opinion on what you should buy, Alex, based on many, many different sort of data points about you. And then my agent may have an opinion about what I want. And so that's going to be a fascinating battle or communication.” — Terry Angelos
- Delegated authority treats an AI agent identically to a human assistant or family member, meaning merchants expect full payment without post-purchase excuses. - Amazon's core economic objection to agentic commerce is eyeball disintermediation and the destruction of high-margin retail media advertising revenue. - The open banking precedent (Chase vs. Plaid) indicates merchant antagonism will eventually shift from flat bans to proprietary, tokenized, and potentially toll-gated commercial APIs.
`40:00` Overhyped vs. Underhyped: Friction, Unmonetized Demand, and Economic Breakage
Alex Rampell frames the ongoing AI shift through his rule of thumb: Silicon Valley typically overhypes emerging technologies early on, while the rest of the world underhypes them. He uses his experience with Tesla's self-driving technology as a metaphor. Having bought a Model 3 in 2017 with Full Self-Driving that "didn't work at all" and felt like a joke, he became skeptical, only to realize years later on a new Tesla that the technology had actually matured into something functional. Similarly, people who evaluated ChatGPT in 2022 dismissed it as a toy for drafting poems or cheating on English essays, assuming it could never autonomously purchase items, yet today it is rapidly taking on real-world actions.
```mermaid flowchart LR accTitle: The AI Agent Value Realization Loop accDescr: Diagram showing how agent-driven savings offset by unmonetized demand leads to net consumer spend expansion. subgraph S1["Efficiency Gains"] A["Cancel Sticky Subscriptions"] B["Prune Unused Free Trials"] end subgraph S2["Latent Demand"] C["WhatsApp Cycling Recs"] D["Instant Algorithmic Purchases"] end subgraph S3["Net Impact"] E["Infinite Human Desires"] F["Higher Personal GDP Output"] end
A --> E B --> E C --> D D --> F E --> F ```
When asked what is overhyped versus underhyped, Terry Angelos argues that extreme financial disruption is overhyped: “I don’t think we’re going to get a bank run on savings deposits where agents are going to sort of maximize yield and move my money around between different accounts.” Using his own banking habits as an example, Angelos explains that while he is a happy Mercury personal account customer and could theoretically maximize yield by sweeping all savings there until the exact moment bills are due, he still keeps money at Chase because its bill pay just works better, has deeper integrations, and involves established friction. Conversely, what Angelos considers vastly underhyped is unmonetized consumer demand and the expansion of GDP driven by "always on" agents:
> “You’re dramatically under-monetized on your bike equipment, Alex. If the agent could find things that could help you with cycling and just bought them for you, there’s more GDP coming out of Alex on cycling.”
- **The Cycling Chat Example:** Angelos highlights their shared cycling WhatsApp group, where a friend named Seth regularly reviews tire rolling resistance and recommends safer tires every six months. Rampell normally only buys tires every two years due to friction, but an agent embedded in the chat could act on Seth’s recommendations instantly every time. - **Economic Offsets:** Agents will simultaneously save consumers money by eliminating forgotten trials and pruning difficult-to-cancel subscriptions, effectively freeing up purchasing power that gets redirected toward satisfying infinite human wants.
---
`45:00` The Fragility of Breakage Models and the Death of Asymmetric Exploitation
Rampell notes that early consumer enthusiasm for agents stems from an asymmetric advantage where early adopters use agents to bypass intentionally hard, non-economic barriers—such as automated scripts snatching 7:00 AM restaurant reservations. However, once everyone has the same tool, that asymmetry disappears. Rampell recounts using coding tools like ChatGPT, Codex, or Astra to automate customer-service disputes with Comcast because Comcast began blocking automated tooling IPs. He envisions counterparties adapting and refusing to transact with non-humans, insisting on verifying that an actual person is on the other end of the line.
Angelos emphasizes that AI agents excel at reading terms and conditions and navigating complex program rules right up to the legal margin—such as optimizing flight purchases to land on the exact minimum threshold required to trigger a seat upgrade. However, this level of automated optimization threatens business models built on consumer inefficiency and breakage:
> “And if agents are intermediating all of our transactions and I’m only getting points on the card that gets me—I’m only using the card where I get points, the whole points reward ecosystem falls apart. So many, many of these things could start—anything with a sort of breakage model in it is going to start to fall apart, and then we’ll have to have new terms and conditions.”
- **Rewards Cross-Subsidization:** Credit card rewards rely on breakage and cross-subsidization; card issuers offer flashy headline perks on dining knowing that consumers will sub-optimally swipe that same card for everyday fuel or retail purchases. - **Automated Routing:** If agents perfectly route every micro-transaction to whichever payment method extracts the highest reward, card programs will be forced to rewrite their commercial terms to survive.
---
`48:00` The Evolution of VGS: From Vault to Ecosystem Broker
Rampell calls Very Good Security (VGS) one of the most formidable behind-the-scenes businesses in payments—a massive credential vault that secures payment data across internet commerce, meaning almost every listener has credentials stored within it. Angelos outlines how VGS has transitioned across three compounding eras to position itself at the center of agentic commerce:
```mermaid flowchart TD accTitle: The Three Compounding Eras of VGS accDescr: Architecture diagram outlining VGS's evolution across three phases from security vault to agentic network broker. subgraph Era1["Era 1: The Vault"] V["10-Year Hardened PCI Storage Layer"] end subgraph Era2["Era 2: Tokenization & Lifecycle"] L["Annual Credential Updates (~33% rot)"] T["Network Token Management (Visa, Mastercard, etc.)"] end subgraph Era3["Era 3: The Network Broker"] B["Agentic Commerce Tokens"] I["Bank Issuer & Merchant Orchestration"] end
V --> L L --> T T --> B T --> I ```
- **Era 1 (The Vault):** A decade spent building a secure, trusted storage vault for sensitive credentials across the web to ease compliance and security burdens for merchants. - **Era 2 (Data In/Out & Tokenization):** Managing the dynamic lifecycle of credentials, where roughly one-third of stored credentials expire or change annually. This required navigating disparate card network standards and managing multiple network tokens so stored card data remains continuously updated and valid. - **Era 3 (The Network Era):** Serving as a multi-party credential broker that facilitates transactions across ecosystem rules. By working simultaneously with bank issuers on card tokenization and merchants on credential storage, VGS can securely swap data between parties—a capability that Angelos notes is now directly fueling agentic commerce.
---
`50:00` Closing Banter and Disclosures
The conversation wraps with nostalgic reflections on the early days of working together, reminiscing about a very early podcast they recorded about the history of TrialPay in a far less sophisticated studio. Angelos jokes about one lasting constant across all their years of discussions: “I think what’s consistent between that first podcast and this one is you should be buying more flowers for your wife.” Rampell readily agrees before signing off.
The episode concludes with the official *a16z Podcast* production wrap and standard legal disclosures stating that content is provided solely for informational purposes, should not be construed as legal, business, tax, or investment advice, and that Andreessen Horowitz maintains investments in companies discussed on the show.
## Notable quotes > `00:00` In the last three months, we've had this huge leap from agents being what I would call spectators to agents being actors, because they effectively have arms and legs, which are payment credentials. — Terry Angelos
> `22:15` One of the reasons why Visa and MasterCard have such impregnable positions is because they intermediate everything and they set the rules and chargebacks are very important. — Alex Rampell
> `20:00` Stripe in many ways is like the AOL of agentic commerce. — Terry Angelos
## Mentioned Alex Rampell, Terry Angelos, Very Good Security, TrialPay, Visa, Mastercard, American Express, Discover, Capital One, Stripe, Stripe Link, Shopify, Shop Pay, PayPal, Apple Pay, Amazon, Walmart, Muse, Instinct, MultiOn, Induced AI, DoorDash, Adyen, Braintree, Chase, Chase Paymentech, Razorpay, Mercury, Plaid, JPMorgan Chase, Tesla, ChatGPT, Codex, Astra, Comcast
## Video description a16z General Partner Alex Rampell sits down with VGS Executive Board Member, Terry Angelos, to unpack what happens to payments when AI agents go from recommending what to buy to actually making the purchase. Terry explains the infrastructure required to safely give agents access to payment credentials, why wallets like PayPal, Shop Pay, and Link are competing to become the default payment layer for agents, and how new agentic tokens could preserve the chargebacks, identity checks, and merchant relationships that make today's payment networks work. VGS, which already secures payment credentials across a significant share of e-commerce, is now provisioning millions of these agentic tokens each week. They also discuss what happens when merchants don't want to transact with agents, how delegated authority changes liability when an agent makes a mistake, and why AI could simultaneously increase consumer spending while eliminating the subscriptions, fees, and other forms of economic "breakage" that depend on people not paying attention.
[Source](https://mgln.ai/e/1344/afp-848985-injected.calisto.simplecastaudio.com/3f86df7b-51c6-4101-88a2-550dba782de8/episodes/6234b162-a09d-4e3e-8647-37199663e239/audio/128/default.mp3?aid=rss_feed&awCollectionId=3f86df7b-51c6-4101-88a2-550dba782de8&awEpisodeId=6234b162-a09d-4e3e-8647-37199663e239&feed=JGE3yC0V)