Agents Get Wallets: When AI Pays, Who Sets the Spending Limits?

As AI agents move from giving information to getting things done, part of the work now involves spending money: booking, ordering, canceling subscriptions, paying a bill. Three notable developments pushed in this direction in recent days.

What changed

• On September 28, Manus launched Manus 2.0 and the Cue app. Each Cue agent has its own email address, phone number, wallet and computer; it can send messages, answer calls and leave a summary, and make payments within a budget the user sets.
• Instinct, a personal agent that handles everyday tasks end to end, raised $1 billion from Sequoia, Benchmark and Coatue at a $10 billion valuation, up from $2.5 billion in its previous round.
• Mastercard's Agent Pay, Visa's Intelligent Commerce, OpenAI's Agentic Commerce Protocol and Google's AP2 are setting standards for how agents pay.

How does an agent pay without seeing the card number?

The card networks' approach rests on tokenization. Mastercard's agent tokens, for example, bind a card credential to a specific agent, a specific merchant scope and a specific consent policy, so the agent can complete a checkout without ever holding the real card number. For machine-to-machine and cross-border payments, stablecoin rails are gaining ground.

Four controls for enterprises

• Budgets and limits: per-transaction and per-period spending caps for each agent.
• Approval threshold: human sign-off for transactions above a set amount.
• Scope: which merchants and categories an agent may spend with.
• Short-lived authority and logging: as Instinct does, isolated sandboxes, short-lived credentials and a record of every transaction.

The remot angle

Every step a paying agent takes is a model or tool call. Because remot routes those calls through a single point, policy can define which agent may use which payment tool with what limit, transactions above a threshold can be sent for approval, and every transaction is logged. That way an agent's ability to spend becomes a bounded authority rather than an uncontrolled risk.