Sunday, June 14, 2026

— A weekly publication —

The Agentic Commerce Report

A weekly read of everything that moved in agentic commerce — protocols, payment rails, retailer pilots, regulation. Summarised, sourced, and stitched to what came before.

Worldline, ING and Mastercard Complete Europe's First Live Agentic Payment; Anthropic Files IPO

Issue 26June 1–7, 2026Synthesised from 5 sources

Edited by Reviewed against primary sources

Worldline, ING and Mastercard executed Europe’s first live agentic payment in production on June 2, at Money 20/20 Europe in Amsterdam 1. An ING cardholder in the Netherlands searched for a wedding anniversary gift. A merchant AI agent identified concert tickets within the defined budget and completed the purchase only after the consumer gave explicit approval. Worldline processed the transaction end-to-end across its issuing and acquiring platforms in both the Netherlands and Belgium, running on the Mastercard network. Mastercard’s Verifiable IntentMastercard's framework attaching a tamper-resistant consumer-authorisation record to each agent-initiated transaction, giving issuers audit visibility. (a framework attaching a tamper-resistant record of the cardholder’s authorisation to each agent transaction) provided the traceability layer. A companion Mastercard Europe post confirmed all issuers across Europe are now enabled at network level for Agent PayMastercard's infrastructure suite for authenticating, routing, and settling card payments initiated by AI agents on behalf of cardholders. (Mastercard’s infrastructure suite for agent-initiated card payments). On June 1, Anthropic submitted a confidential draft S-1 registration statement to the US Securities and Exchange Commission for a proposed initial public offering 2.

June 2’s production transaction marks the seventh regional Agent Pay deployment to reach live status. Prior Mastercard Agent Pay pilots covered Australia (January 2026), India and New Zealand (February 2026), South Korea and Latin America (March 2026). Those earlier pilots ran in markets outside the EU regulatory perimeter. Europe’s deployment adds PSD2 (the EU’s second Payment Services Directive) compliance and strong customer authentication requirements to the Agent Pay workflow for the first time. ING served as the regulated EU issuer and Worldline as the regulated EU payment processor. Mastercard’s Verifiable Intent framework, which first appeared in the Latin America pilot (2026-w13), now operates within this EU-regulated infrastructure stack. Alongside the announcement, Mastercard disclosed a Lisbon Centre of Excellence for Innovation to develop next-generation agent-driven payment experiences. Stripe’s agent bot-score layer, added to Radar in May (2026-w22), provides the fraud-detection capability sitting downstream of agent-initiated card payment flows.

Anthropic filed a confidential draft S-1 with the SEC on June 1, joining SpaceX and OpenAI in the 2026 AI IPO window 2. $47 billion in annualised revenue and a $965 billion post-money valuation accompanied the filing (2026-w22). Under the JOBS Act, a confidential S-1 submission starts the SEC review without committing to an offering date or price. Anthropic builds and maintains the Model Context Protocol (MCPModel Context Protocol — Anthropic's open standard for connecting AI agents to external tools, APIs, and data sources via a common interface., the open standard connecting AI agents to external tools, APIs, and data sources). Following the Stainless acquisition (2026-w21), Anthropic generates the official SDK and MCP server implementations distributed to hundreds of API providers. Google extended Google Pay on June 4 with a direct checkout feature for retailers and expanded digital IDs in Google Wallet to select EU member states, both announced at Money 20/20 Europe 3. Secure Payment Authentication (SPASecure Payment Authentication — the European regulatory authentication flow for online card payments designed to meet PSD2's strong customer authentication rules., the European strong-authentication flow for online payments) reduced authentication time by 50% and raised conversion by 3%.

Stripe reported $18.4 million in annualised savings from Visa’s DCAPDigital Commerce Authentication Program — Visa's US program rewarding merchants for sharing device and billing data during checkout with a five-basis-point interchange reduction. since April 18 4. DCAP (Digital Commerce Authentication Program) rewards US merchants for sharing device and billing data during checkout in exchange for a five-basis-point interchange reduction — the first card-network program structured around data enrichment rather than authentication outcomes. Authorization Boost, Stripe’s intelligent transaction router, directed qualifying transactions through Data Only 3DSVisa's frictionless 3D Secure mode that sends device-risk signals to issuers without requiring a consumer-facing authentication step., a frictionless authentication path that sends device-risk signals to issuers without a consumer-facing step. An 8x increase in DCAP-eligible transactions followed from Stripe’s data-collection integration across its merchant base. Claude Mythos PreviewAnthropic's most capable model, currently restricted to verified security partners for cyberdefense and vulnerability-scanning tasks. for large-scale codebase vulnerability scanning." tabindex="0" aria-describedby="gloss-project-glasswing">Project GlasswingAnthropic's initiative granting critical-infrastructure operators access to Claude Mythos Preview for large-scale codebase vulnerability scanning. expanded on June 2, extending Anthropic’s programme to 150 new organizations in more than 15 countries for access to Claude Mythos Preview (Anthropic’s restricted-access codebase-scanning model) 5. Initial Glasswing partners — around 50 organisations — had already identified more than 10,000 high- or critical-severity security flaws; the expanded cohort adds power, water, and healthcare operators not in the first group.

Events this issue

5 events
Identity
launch

Bringing secure digital identity and payment tools to more people

Google launched Pay direct checkout and EU digital IDs in Wallet, with SPA reducing authentication time by 50%.

Google Pay direct checkout embeds payment options from Google Wallet onto retailer checkout pages, available at launch for Airwallex merchants with Adyen planned. Updated Secure Payment Authentication (SPA, the European strong-authentication flow for online payments) reduced authentication time by 50% and increased conversion by 3% in internal testing; Visa, Checkout.com, Autopay, and Adyen will roll it out in the United Kingdom and Poland. The direct checkout path connects to Universal Cart (2026-w21), giving consumer agents a settlement layer at participating merchants. Digital IDs in Google Wallet expand to select EU member states, adding to existing coverage in Brazil, India, Taiwan, and the United Kingdom. Sparkasse Bank became the first EU national credential partner for age assurance, allowing age verification without disclosing name, address, or date of birth.

  1. Google Blog
Payments
launch

Helping businesses optimize network costs with the Visa Digital Commerce Authentication Program (DCAP)

Stripe reported $18.4M in annualised DCAP savings since April 18 and an 8x increase in eligible transactions.

Visa's Digital Commerce Authentication Program (DCAP) rewards US merchants for sharing richer transaction data — device ID, billing address, IP address, and customer email — during authentication in exchange for a five-basis-point interchange reduction. Stripe's Authorization Boost routed qualifying transactions through Data Only 3DS, a frictionless authentication path that sends device-risk signals to the issuer without triggering a consumer-visible step, preventing DCAP from degrading authorization rates. The $18.4 million in annualised savings accrued from April 18, the rollout date. The 8x increase in eligible transactions reflects the effect of Stripe's data-collection integration across its merchant base. DCAP is the first US card-network program to tie a cost reduction to enriched transaction data rather than to authentication outcomes, adding a financial incentive for merchants to share the cardholder data that also underlies agentic-checkout fraud scoring (2026-w22).

  1. Stripe Blog
Pilots
pilot

Worldline, ING and Mastercard complete a live end-to-end European agentic payment in production

Worldline, ING and Mastercard ran Europe's first live end-to-end agentic payment in production.

The transaction ran between an ING cardholder and a merchant in the Netherlands, with a merchant AI agent identifying concert tickets within a defined budget and completing the purchase after explicit consumer approval. Worldline processed the transaction end-to-end across its issuing and acquiring platforms, covering the Netherlands and Belgium on the same infrastructure. Mastercard's Verifiable Intent framework attached a tamper-resistant authorisation record to the transaction, giving the issuing bank full visibility. A companion Mastercard Europe post confirmed all Mastercard issuers across Europe are now enabled at network level for Agent Pay. Prior Mastercard Agent Pay pilots covered Australia, New Zealand, India (2026-w09), South Korea (2026-w12), and Latin America (2026-w13). This is the first live deployment in European regulated markets, extending the programme from Asia-Pacific and emerging markets to EU-supervised financial institutions.

  1. Mastercard Newsroom
Security
launch

Expanding Project Glasswing

Anthropic extended Project Glasswing to 150 new organizations in 15+ countries to defend critical infrastructure.

Project Glasswing's initial cohort of roughly 50 partners, granted Claude Mythos Preview access in April 2026, identified more than 10,000 high- or critical-severity security flaws in their codebases. The 150 new organizations span power, water, healthcare, communications, and hardware industries not represented in the first group. Anthropic estimates a major attack on any partner's codebase could affect more than 100 million people. Anthropic also released Claude Security, a product using Claude Opus 4.8 (2026-w22) for codebase scanning and patch suggestions, to complement the restricted-access Mythos Preview. Alongside Glasswing, Anthropic published a separate analysis of 832 banned accounts mapping AI-enabled cyberattack tactics to MITRE ATT&CK; the report found the share of medium-risk or higher threat actors rose from 33% to 56% across two consecutive six-month periods.

  1. Anthropic News
Standards
M&A

Anthropic confidentially submits draft S-1 to the SEC

Anthropic submitted a confidential draft S-1 registration statement to the SEC for a proposed IPO.

The S-1 filing follows Anthropic's $65B Series H (2026-w22), which valued the company at $965B post-money and disclosed $47B in annualised revenue. A confidential S-1 submission under the JOBS Act starts the SEC review clock without committing to a public offering timeline. Anthropic is the third major AI company to file an S-1 in the 2026 window: SpaceX submitted a public S-1 on May 20 targeting a June Nasdaq listing, and OpenAI submitted its own confidential draft around May 22. No offering price or share count was set at the June 1 filing date. Anthropic builds and maintains the Model Context Protocol open standard and the Stainless SDK generation platform acquired in May (2026-w21), which generates official client libraries for hundreds of API providers.

  1. Anthropic News