All postsStart free
Top News6 min read

AI Agents Can Now Pay: What Visa x OpenAI Means for App Security

MW

Marcus Webb

Principal Security Engineer · June 11, 2026

Illustration of an AI agent making an authorized payment through a chat interface

In the last 48 hours, Visa partnered with OpenAI to let AI agents conduct authorized payments directly through ChatGPT, while Samsung announced it will bake ChatGPT, Gemini, and Claude into its core operations. Agentic commerce is no longer a demo, it is shipping. For teams building mobile apps, an agent that can move money is a brand-new, high-value attack surface.

Why agentic payments change the threat model

Traditional mobile security assumes a human taps the buttons. When an autonomous agent can authorize a purchase, the gap between intent and action widens, and that gap is exactly where attackers operate. A poisoned prompt or a manipulated context window can now trigger a real transaction.

Apps integrating agentic payment flows need to treat every agent action as untrusted until verified, the same way they treat raw user input.

The new failure modes to watch

Our research team is already mapping these flows in customer builds. The recurring risks look familiar but hit harder when money is involved.

  • Payment tokens or session keys for the agent stored insecurely on-device
  • Prompt injection that redirects an authorized purchase to an attacker
  • Missing confirmation steps before an agent commits an irreversible action
  • Over-broad agent permissions that survive past a single transaction

How RASMISER helps teams ship agentic features safely

RASMISER traces where untrusted content meets an agent's decision path and where payment credentials live in the binary. We flag direct client-to-provider calls that should be proxied, insecurely stored agent tokens, and missing transaction confirmation gates, each mapped to OWASP MASVS.

Combined with runtime protection, teams can ship agent-driven commerce with anti-tampering and TLS pinning in place, so the payment paths stay protected after launch.

The takeaway

Letting an AI agent spend money is a powerful feature and a serious responsibility. Scan the agent's payment path the same week you build it, before an attacker finds the gap between intent and authorization.

Scan your app free

Keep reading

Illustration of an AI model generating personalised phishing messages targeting employees on mobile devices
Cyber Threats

AI-Generated Phishing: Why Every Employee Is Now a High-Value Target

LLMs can now write flawless, hyper-personalised phishing messages at industrial scale. The generic mass-phish is dead — what replaced it is far harder to spot and your app is the delivery mechanism.

Illustration of an AI malware strand mutating its code to bypass antivirus detection layers
Cyber Threats

Autonomous AI Malware: The Threat That Rewrites Itself to Escape Detection

A new class of AI-driven malware can observe its environment, modify its own payload, and wait for the ideal conditions to strike. Static signatures are no longer enough, and your app binary is a target.