Visa, Mastercard and Ant International Build Framework to Verify AI Payment Agents

·1 views

AI agents are increasingly capable of completing purchases autonomously on behalf of users, but payment systems were not designed to verify whether such agents are genuinely authorized to transact. In September 2026, Visa, Mastercard, and Ant International announced a joint Know Your Agent (KYA) interoperability framework to address this gap. The initiative aims to help payment networks, wallets, and marketplaces identify and authenticate AI agents while letting each participant retain its own risk controls. Each company brings existing technology to the effort — Visa's Trusted Agent Protocol, Mastercard's Verifiable Intent, and Ant International's Agentic Mobile Protocol. Beyond simple agent identification, the framework seeks to verify four distinct layers: agent identity, user-granted authorization, transaction intent, and whether the final transaction stays within approved limits.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

One recurring table-parsing bug hid as data errors across five tools before a fix landed

A developer working on a markdown-heavy specification project discovered the same one-line table-parsing bug independently appearing in five separate tools, each time mishandling escaped vertical bars inside table cells. Because the naive split ignored escape characters, table columns shifted silently, causing downstream checks to report false content failures — including two specification definitions appearing unverified. Each previous encounter had been patched in isolation, with no shared record of how many table-reading tools existed across the codebase. The lasting fix was not an improved regex but a mandatory inventory: every tool that parses a table must be declared in a list, and a automated check verifies each against fixtures covering both escaped pipes and a visually identical Unicode lookalike character. The author concludes that a bug recurring more than twice signals a missing inventory, not just a missing patch.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Five Silent Failures That Exposed the Hidden Cost of Full Automation

A developer running an unmonitored automated system on a remote machine documented five separate failures over two days, none of which produced visible error messages. The failures included duplicate processes running in parallel, a quietly revoked login, a detached component, an event that never fired, and a config that silently reset after a restart. A key finding was that system restarts — commonly assumed to restore a known-good state — were responsible for at least two of the five incidents, often triggering race conditions during startup sequences. The developer has since adopted practices such as heartbeat logging for every scheduled job, hash-verified manifests for updates, and checking response status before contents to catch silent error states. The core takeaway is that automation shifts rather than eliminates operational work, and the harder, underestimated task is building systems that make failures visible rather than silent.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Aave V3 Cross-Chain Bridge Layer Flagged for High-Severity Security Risks

A DeFi security research team published a risk assessment on September 14, 2026, examining the cross-chain bridge infrastructure of Aave V3, which holds approximately $17.5 billion in total value locked across Ethereum and multiple Layer 2 networks. Auditors identified seven vulnerabilities across the bridge layer, including two high-severity issues: a nonce-handling flaw that could allow replay attacks resulting in duplicate aToken minting, and an unprotected single-owner upgrade path on the Polygon bridge custodying over $5 billion in assets. Three medium-severity findings were also flagged, covering relayer denial-of-service risks, a global supply-cap bypass exploitable across multiple L2s, and missing on-chain proof-of-liquidity verification. Researchers warned that while no single flaw is trivially exploitable alone, a coordinated multi-vector attack could potentially result in losses exceeding $1 billion. The assessment noted that these bridge-layer risks fall outside the scope of Aave V3's existing core contract audits.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How SREs Can Win Over Resistant Organisations by Demonstrating Value Before Pitching

A site reliability engineer joining a financial services firm in 2019 found that a detailed SRE adoption roadmap, presented to senior leadership, was politely acknowledged and then shelved. Only after 18 months of hands-on work — including predicting a major production incident and leading its postmortem — did the same VP ask for the practices to be rolled out company-wide. The experience illustrates a core insight: in resistant organisations, credibility must be established before proposals will be taken seriously. Resistance in regulated industries is often rational, rooted in past failed transformation initiatives and the high cost of change-caused incidents. A phased influence playbook therefore recommends mapping value demonstrations to specific stakeholder concerns — such as toil reduction for engineering leads, audit evidence for compliance teams, and downtime costs for finance — rather than leading with comprehensive frameworks.

0 comments Read more at DEV Community