Six Banks Set Consumer Standards for Agentic Commerce as Mastercard Completes Denmark's First AI Agent Payment

Six global banks published a joint set of voluntary principles for agentic commerce on September 22 ¹. NatWest Group, Bank of America, Capital One, Commonwealth Bank of Australia, ING Group, and ASB Bank released the paper — five principles covering transparency, safety, privacy and data, choice, and interoperability. On transparency, the principles require AI agents to disclose that they are artificial intelligence at the point of any transaction. On safety, fraud protections that apply to human-initiated payments must apply equally to agent-initiated ones. On choice, consumers must be able to revoke an agent’s access to their payment credentials at any time ¹. These are voluntary and non-binding, addressed to banks and merchants rather than regulators. On September 21, Mastercard and Danske Bank completed Denmark’s first AI agent payment ². A consumer asked an agent to book a coffee tasting through Priceless.comMastercard's curated experiences booking platform, used as the merchant surface in the Denmark AI agent payment pilot. (Mastercard’s curated experiences booking platform); the agent completed both the booking and payment using a Danske Bank-issued Mastercard, with PayOSThe payment orchestration provider that handled technical execution of the Mastercard and Danske Bank AI agent transaction from authorisation through settlement. (the payment orchestration provider that handled execution from authorisation through settlement) managing the transaction end to end ².

The six-bank principles paper sits alongside — but does not overlap with — the Agentic Payments Alliance (APAAgentic Payments Alliance — the 26-member industry consortium founded in August 2026 by Rain, Visa, and Mastercard to develop agentic commerce infrastructure standards., the 26-member consortium founded in 2026-w34 by Rain, Visa, and Mastercard). The APA focuses on infrastructure: token standards, interoperability protocols, and settlement rails. The six banks address what happens to the consumer: disclosure, fraud liability, and the right to revoke. The Mastercard and Danske Bank transaction extends a pilot sequence that began in 2026-w25 with Agent PayMastercard's credential framework that binds cardholder identity, a registered AI agent, and a purchase scope into a single tokenised payment credential. for Machines, then moved to the Trip.com cross-border travel pilot with Network International in 2026-w38. The Denmark transaction adds a regulated Northern European retail bank to that sequence — the first in which a consumer-facing deposit-taking institution issued the credential and retained account liability. Mastercard has now run live Agent Pay transactions across three distinct deployment types in four months.

Google released Gemini 3.8 Live with Live Avatar as generally available on September 24 ³. The model takes speech in and returns speech and video out in a single rendering pass — no separate lip-sync step. Enterprise customers choose pre-built avatars or custom personas from a single reference photo and audio sample, with output in 97 languages. Pricing adds a third cost dimension: $1 per million video output tokens on top of existing audio costs ³. Gemini 3.8 Live shipped in Search Live at 68.6% on τ-Voice in 2026-w38. This release moves the same model into the Gemini Enterprise console and API with avatar output, extending the commerce surface to enterprise customer service and product walkthrough agents. Google also added 14 Connected Apps to Gemini on September 23 ⁶ — including Squarespace, Webflow, and SeatGeek — the second expansion in six weeks, making commerce-adjacent tasks available to the Gemini agent without switching applications.

Google disclosed PageBreakGoogle's autonomous AI security agent, built on Gemini, that discovers and confirms exploitable XSS vulnerabilities using live application replicas. on September 24 — an autonomous AI security agent built on Gemini that found over 500 XSSCross-site scripting — a web vulnerability where injected scripts execute in other users' browsers; the attack type PageBreak was trained to discover and verify. (cross-site scripting — a vulnerability where injected scripts execute in other users’ browsers) vulnerabilities in Google’s first-party web applications ⁴. PageBreak submits hypotheses to verifier agents that attempt real exploitation on live application replicas, reporting only confirmed exploits. Two of the 500-plus bugs appeared in Google’s high-assurance frameworks, both in internal endpoints. Confirmed vulnerabilities will arrive with draft fixes when PageBreak connects to CodeMender, a patch generation agent. Stripe published a four-year fraud analysis of billions of transactions through March 2026, documenting how 3D Secure 2 (3DS23D Secure 2 — the card authentication protocol that implements SCA at checkout, including risk-based exemptions for low-risk transactions., the card authentication protocol that implements SCAStrong Customer Authentication — the EU and UK regulatory requirement that online payments be verified with two or more authentication factors to reduce card-not-present fraud.) mandates redistribute card-not-present fraud across markets ⁵. Mandated markets see lower fraud rates as attackers shift volume elsewhere. For agentic checkout — where the cardholder is absent at the moment of payment — the authentication gap 3DS2 creates under delegated purchasing remains unaddressed.