Plaid Highlights a New Risk in Agentic Payments

A customer asks an AI agent to purchase a product for $150. The agent finds the right item, confirms the price and prepares to complete the purchase.

The customer has a credit card, a debit card and a linked bank account available. Which one should the agent use?

It may identify the card with the best rewards or the payment method with the lowest apparent cost. But the most financially attractive option is not necessarily the one the customer has authorized.

Authorizing an AI agent to make a purchase does not automatically authorize it to choose any available payment method. Purchase approval, payment-method selection and transaction execution can involve different permissions. An agent may complete the requested purchase while disregarding a restriction on how it should be paid for. Financial institutions therefore need evidence that the application respects delegated payment authority, not simply that transactions succeed.

This distinction is becoming more relevant as payment companies prepare for AI agents to influence checkout decisions.

In an October 30, 2026 Payments Dive interview, Brian Dammeir, Plaid's head of payments and financial management, discussed how agents could select payment methods according to consumer preferences rather than established checkout habits.

His comments were forward-looking. They did not identify a vulnerability at Plaid or establish that autonomous payment selection is already changing payment-method usage at scale.

But they raise an important question for banks, payment platforms and companies building agentic commerce applications: who determines how an AI agent is allowed to pay?

Plaid's Prediction: Payment Choice Could Become a Software Decision

Consumers typically choose payment methods based on convenience, familiarity, rewards, available options and personal preferences.

Someone may repeatedly use the same credit card because it is saved at checkout. Another customer may prefer bank payments or prioritize a particular account for managing expenses.

AI agents could approach these decisions differently.

Dammeir suggested that agents may increasingly evaluate payment options against objectives established by consumers, such as maximizing rewards or selecting an efficient way to pay.

Rather than relying on habitual choices, an agent could compare available payment methods and recommend or select the option that best matches those objectives.

For payment providers, this could change how payment methods compete.

Card issuers may need to consider how agents interpret rewards and other card benefits. Bank-payment providers could encounter new opportunities where customers permit agents to compare payment options. Merchants and payment platforms may need to present payment information in ways that automated applications can interpret.

The outcome remains uncertain. Payment costs, protections, rewards and availability vary by transaction, and it is too early to conclude which payment methods would benefit most.

The more immediate implication concerns the decision itself.

If software increasingly chooses how consumers pay, institutions need to establish the authority under which that choice is made.

Three Decisions That Require Different Permissions

Agentic commerce is often described as a single process: a customer gives an instruction, and an AI agent completes a purchase.

In practice, three decisions may be involved.

1. Authorizing the purchase

The customer defines what the agent may buy, potentially including restrictions on the product, merchant, price and timing.

For example, a customer might permit an agent to purchase office equipment for no more than $150.

That establishes the scope of the purchasing task. It does not necessarily grant permission to use every payment instrument available to the application.

2. Selecting the payment method

The customer may designate a specific card, prohibit particular accounts or allow the agent to choose among approved instruments.

These arrangements grant different levels of discretion.

An instruction to minimize costs may guide the selection among permitted methods. It should not be interpreted as permission to disregard an explicit restriction.

Where preferences conflict or an approved method is unavailable, the application may need to request clarification or follow a defined fallback process.

3. Executing the transaction

Selecting a payment method is not the same as being authorized to execute a transaction.

The payment must still proceed through the relevant authentication, authorization, permission and transaction controls.

An agent may be permitted to recommend a method without initiating payment. Another application may have broader execution capabilities within defined limits.

These distinctions matter because an agent can make an inappropriate payment-method decision even when the surrounding infrastructure prevents the transaction from proceeding.

When Payment Optimization Conflicts With Customer Instructions

Consider a business customer who instructs an AI agent to purchase office equipment using a designated corporate credit card.

The agent finds the correct product at an acceptable price. During checkout, it identifies an alternative payment method that appears to offer lower transaction costs.

If the agent prioritizes cost optimization without respecting the customer's restriction, it may select the alternative method.

The purchase would meet the product and price requirements, but the payment-method decision would conflict with the customer's instructions.

This is a hypothetical scenario, not an incident reported by Plaid.

It illustrates a specific behavioral risk: an AI agent may optimize for one objective while disregarding a more important restriction.

The distinction becomes more complicated when customers express preferences rather than explicit rules.

A customer might ask an agent to maximize rewards, minimize fees and prioritize convenience. Those objectives can conflict, and the application needs a defined way to determine which preference takes precedence.

A preference describes an outcome the customer would generally like to achieve. A restriction defines what the application is not permitted to do.

For an AI agent operating with delegated authority, confusing the two can produce decisions that appear commercially reasonable but fall outside the user's instructions.

Why Payment Controls Cannot Rely on AI Instructions Alone

An AI agent may be capable of comparing payment options and selecting an instrument. That does not mean it has permission to use the selected instrument.

A payment method might be visible within an application but unavailable for a particular transaction. A business might allow an agent to prepare payment instructions while requiring separate approval before execution.

These boundaries cannot depend solely on the model following written instructions.

An application-level instruction telling an agent not to use a particular account is not equivalent to an infrastructure-level control preventing that account from being used.

The relevant financial systems must enforce authentication, authorization and payment permissions.

This creates two complementary assurance questions:

• Application behavior: Does the agent follow the customer's instructions, payment-method restrictions and escalation requirements?

• Financial controls: Do the surrounding systems prevent transactions that are not permitted to proceed?

An agent may attempt to select or invoke a prohibited payment method, only for an external control to block the action.

That attempted violation may reveal a behavioral vulnerability, but it is not equivalent to a completed unauthorized transaction.

Institutions need to distinguish between what the agent recommends, what it attempts and what the payment infrastructure actually executes.

This distinction is especially important when assessing agentic payment applications that combine AI decision-making with connected financial services.

What Payment Providers Need to Evaluate

Payment platforms already measure transaction completion, processing performance and failure rates.

These metrics remain important, but they do not establish whether an AI agent respected the authority delegated to it.

An application could complete purchases successfully while occasionally selecting payment methods that conflict with customer restrictions.

For institutions evaluating payment-selection agents, the assessment should address the behaviors that matter to the application's responsibilities.

Payment-method restrictions: Does the application avoid prohibited instruments even when they appear more attractive because of cost, rewards or convenience?

Conflicting preferences: Does the agent apply defined priorities and request clarification when instructions cannot be reconciled?

Approval and escalation: Does it recognize when selecting an alternative payment method requires additional permission?

External information: Can manipulated merchant or checkout content influence the agent to disregard customer restrictions?

Tool-use boundaries: Does the application attempt actions outside its assigned permissions, and how do connected systems respond?

The relevant testing scope depends on the application.

An agent that only recommends payment methods presents different risks from one that can select instruments or initiate transactions.

Assessment findings should therefore describe the tested configuration, observed behavior and relevant limitations. They should also distinguish application-level weaknesses from failures of the financial controls responsible for transaction execution.

The objective is not to establish that every payment-selection decision requires a new assessment. It is to identify consequential behaviors that existing evaluations or controls may not adequately cover.

Why This Matters for Banks and Payment Platforms

Plaid's prediction is commercially significant because payment-method selection could become part of an automated decision process.

For banks, that raises questions about how customers grant and restrict access to payment instruments.

For card issuers and bank-payment providers, it creates a potential shift in how payment options are compared and selected.

For agentic-commerce platforms, it introduces the need to distinguish customer preferences from enforceable restrictions and to determine when an agent must seek additional authorization.

The industry is already confronting related questions about agentic payment authority and accountability.

In October 2026, Payments Dive reported concerns from banking and payments executives about consumer intent, authorization, liability and the information needed to reconstruct agent-driven transactions.

Those concerns are broader than payment-method selection, but they reinforce why institutions need to understand the decisions AI applications make on behalf of customers.

The immediate requirement is not to predict which payment method AI agents will favor.

It is to define what those agents are permitted to decide, how restrictions are enforced and what evidence demonstrates that the application behaves within those boundaries.

Where AetherLab Fits

AetherLab supports independent, scoped assessment of generative and agentic AI applications.

Through AdversarialScan, AetherLab can evaluate defined application-level behaviors involving payment-method restrictions, conflicting instructions, manipulated checkout information and escalation requirements.

For example, testing may examine whether an agent attempts to select a prohibited payment instrument when another option appears financially preferable, or how it responds when an authorized method becomes unavailable.

Where relevant, Guardrails may support mitigation of identified application-level behavioral vulnerabilities.

Evidence Pack can document the assessment scope, observed findings, relevant control responses, mitigation measures, retesting and remaining limitations.

These capabilities provide evidence about application behavior under specified conditions. They do not authenticate customers, grant delegated payment authority, authorize transactions or enforce account permissions.

Those responsibilities remain with the relevant financial institutions and payment infrastructure.

AetherLab's role is to help institutions understand application-level behavioral risks that may affect the reliability of AI-enabled payment workflows.

The Next Payment Risk Is Not Just Whether an Agent Can Pay

Plaid's comments point toward a future in which payment choices may increasingly be influenced by software acting on behalf of consumers.

That could create opportunities for payment providers and more personalized purchasing experiences.

But it also introduces a question that cannot be answered through transaction success alone.

An agent may buy the correct product at the correct price while choosing a payment method the customer did not permit.

It may optimize for rewards or cost while overlooking a higher-priority restriction. Or it may attempt an inappropriate action that the payment infrastructure ultimately blocks.

These outcomes represent different risks and require different evidence.

Institutions need evidence that an AI agent made the payment-method decision it was authorized to make, not merely that it completed the transaction.

As agentic commerce develops, the distinction between purchasing authority, payment-method selection and transaction execution will become increasingly important.

Explore AetherLab's AdversarialScan for application-level AI risk assessment.

Frequently Asked Questions

Does authorizing an AI agent to make a purchase also authorize it to choose the payment method?

Not necessarily. Purchase authority and payment-method selection are distinct. The agent's discretion depends on the customer's instructions, permitted payment instruments and applicable controls. General purchasing permission should not be treated as unrestricted authority to use any available payment method.

Can an AI agent choose the cheapest payment method without additional approval?

It depends on the authority granted to the application. An agent may be permitted to select among approved payment methods according to cost or rewards. However, a preference for lower costs does not override restrictions on which instruments may be used.

Why isn't transaction success enough to evaluate an agentic payment application?

A successful transaction does not establish that the agent respected every instruction governing the purchase. An application might select an inappropriate payment method while still completing the transaction. Assessment should consider the agent's decisions, attempted actions and adherence to defined operating boundaries.

How does application-level AI assessment differ from payment-control validation?

Application-level assessment examines how the configured AI system responds to instructions, restrictions and operating conditions. Payment-control validation examines whether financial systems correctly enforce authentication, authorization, permissions and transaction execution requirements. Both may be necessary, but they answer different assurance questions.