Your AI Assistant Is About to Be Able to Swipe Your Card

Something happened recently that made me stop and think about it for a long time.

March 17, 2026 — that’s yesterday — Sam Altman’s World (formerly Worldcoin) launched something called AgentKit. Simply put: it lets your AI Agent prove “there’s a real human behind me.”

At the same time, Coinbase launched an AI Agent-specific wallet in February, and Visa and Mastercard are racing to define standards for how Agents pay online.

Did you notice? These companies aren’t building “smarter AI.” What they’re doing is — giving AI an ID card.

Why? Because when AI Agents can spend money on their own, the question “who are you” suddenly becomes a hundred times more important than “how smart are you.”

First, Let’s Talk About the Problem: How Dangerous Are Agents Without Identity

Let me tell you a real case.

January 2024, a multinational company in Hong Kong was scammed out of $25.6 million. How? Someone used deepfake technology to fake a video conference with the company’s CFO — even the colleagues were fake. The finance employee saw the “CFO” talking to them on screen and transferred the money.

That’s a case of a human being scammed. Now imagine the AI Agent world:

  • Your AI assistant helps you buy things, but how does it prove it’s “you” who authorized it?
  • One person deploys 1,000 Agents, each claiming free trial offers — how does the platform stop that?
  • Agent A trades with Agent B — how do they confirm the other is legitimate?

According to Deloitte research, losses from AI fraud are growing from $12.3 billion in 2023 at a rate of 32% annually, expected to reach $40 billion by 2027. Between 2024 and 2025 alone, GenAI-driven fraud cases increased by over 450%.

So you get it — it’s not that AI isn’t smart enough. It’s that we have no way to verify “who this AI actually represents.”

World AgentKit: Giving AI an Identity Through Iris

World’s approach is straightforward and bold.

Here’s how it works

  1. You scan your iris at World’s Orb device (yes, the eyeball scan)
  2. The system generates an encrypted World ID — this is your digital identity proof
  3. Through AgentKit, you “delegate” this identity to your AI Agent
  4. When the Agent goes to a website to buy something or use a service, the platform can verify: “There’s a verified real human behind this Agent”

Here’s the key point — the whole process uses Zero-Knowledge Proofs (ZKP).

What does that mean? The platform only knows “there’s a real human behind it” but has absolutely no idea who you are. They don’t get your name, your email, or any personal information. Mathematically proven, but nothing leaked information-wise.

What problem does it solve

Remember the “one person deploys 1,000 Agents” problem I mentioned earlier?

World AgentKit lets platforms trace back to the number of underlying real humans. You can have 10 Agents, but they all link to the same World ID. The platform can set rules: each real human can only book once per day, each real human can only claim a trial once.

No matter how many Agents you have, you’re just one person.

The World network has already verified over 17.9 million real humans. AgentKit integrates with Coinbase’s x402 protocol, so any website that already supports x402 can directly add “human verification” functionality.

Coinbase Agentic Wallets: Giving Agents a Wallet

Having identity alone isn’t enough. Agents need wallets to spend money.

February 11, 2026, Coinbase launched Agentic Wallets — claimed to be “the first wallet infrastructure designed specifically for AI Agents.”

What it can do

  • Agents can hold USDC stablecoins
  • Autonomous trading: buy crypto, swap, pay API fees
  • 24/7 operation, no human approval needed for each transaction

What about security?

This is what I’m most concerned about. You let AI spend money on its own — what if it gets prompt injection attacked and transfers all your money out?

Coinbase’s approach:

  • Private keys never touch the AI model. The keys are stored in a Trusted Execution Environment (TEE). Agents can only use them through predefined operations. Even if the AI is hacked, it can’t get the keys.
  • Configurable spending limits: maximum per transaction, maximum per session
  • Built-in KYT (Know Your Transaction): automatically blocks high-risk transactions

Then there’s the x402 protocol — when an Agent calls a paid API, the server returns HTTP 402 (Payment Required), the Agent’s wallet automatically pays and retries the request. The whole process doesn’t require human involvement.

Coinbase CEO Brian Armstrong said he believes “AI Agent transactions will soon exceed human transactions.” Binance’s CZ went even bolder, predicting in public that Agent trading volume will eventually far exceed humans.

Regardless of whether these numbers are accurate, the direction is clear: Agents need their own wallets, and these wallets must be more secure than human ones.

Visa vs Mastercard: Racing to Define Standards

Interestingly, traditional financial giants are also racing for this market.

Visa — Trusted Agent Protocol

Launched in October 2025, developed in partnership with Cloudflare. The core concept:

  • Each AI Agent carries cryptographic signatures containing three pieces of info: Agent intent (what it’s buying), consumer identification (who it represents), payment information
  • Merchants can identify “this is a legitimate AI Agent” vs “this is a malicious bot” at the CDN layer
  • No system changes needed — merchants can support it with near-zero cost

By December 2025, Visa had completed real Agent transaction tests with over 30 partners. Shopify, Stripe, Microsoft, and Coinbase are all on the list.

Mastercard — Agent Pay

Mastercard’s approach is a bit different:

  • Every AI Agent must register before it can trade — getting a unique identifier
  • Each transaction uses dynamic encrypted tokens — similar to your credit card’s virtual card number, but Agent-specific
  • Complete audit trail: what the Agent bought, what limits the consumer set, whether the transaction was within validity

In February 2026, PayOS and Mastercard completed the first real transaction using Agentic Tokens.

The two companies are now publicly competing to define industry standards for Agent transactions. This feels a lot like the drama of Visa and Mastercard competing for mobile payment standards, but the stakes are much higher this time.

W3C DID: The Academic Answer

While commercial companies battle for market share, W3C (the organization that sets web standards) hasn’t been sitting idle either.

March 5, 2026, W3C published the DID v1.1 (Decentralized Identifiers) Candidate Recommendation.

DID’s concept is simple: a digital identity that doesn’t depend on any central authority. No Google, no Facebook, no company to “issue” your identity. You generate it yourself, you control it, it’s mathematically verifiable.

A paper from the Technical University of Berlin proposed using DID for AI Agents:

  • Each Agent has its own DID (decentralized identity)
  • Paired with Verifiable Credentials (VC) — third-party issued certificates proving what capabilities the Agent has, who authorized it
  • Agents don’t need to know each other in advance — they can verify each other’s identity on the fly

This sounds academic, but it solves a real problem: when two unfamiliar AI Agents need to trade, how do they establish trust?

It’s still in the research phase and far from commercial deployment. But DID’s advantage is that it’s an open standard, not controlled by any single company.

Why This Matters — My Take

I use AI Agents in my work every day. So this topic isn’t news to me; it’s my daily life.

But when I see giants like World, Coinbase, Visa, and Mastercard all doing the same thing simultaneously, I think there are a few notable trends worth paying attention to:

First, “paying” and “identity” are merging.

These were two separate things before — you log into your account (identity), then check out (payment). But in the Agent’s world, Agents need to simultaneously prove “who I represent” and “how much I can spend.” The World + Coinbase integration is doing exactly this.

Second, privacy and trust no longer contradict each other.

Zero-knowledge proofs let you prove something is true without revealing any details. “There’s a real human behind me” — proven. “Who is this real human” — unknown. In a world where Agents are deployed at scale, this is the only viable approach. You can’t have every Agent carrying its owner’s ID around.

Third, the standards war is just beginning.

There are too many protocols now: World AgentKit, Visa Trusted Agent Protocol, Mastercard Agent Pay, W3C DID, Coinbase x402… How many will survive? I don’t know. But what I do know is that people who invest in understanding these protocols now will have a huge first-mover advantage in three years.

The Agent economy isn’t “the future.” It’s happening right now. And identity verification is the foundation of this entire new economy.

An Agent without identity is like a traveler without a passport — it can’t go anywhere.

Further Resources

Every protocol covered in this article has public technical documentation. If you want to dive deeper:

AI × Trading Complete Bundle — Course + Commander Handbook
$59 Save $4.90 · Bilingual · Lifetime updates
Get Bundle →