Spend7 blog
Keeping agent payments inside the leash
Guides and analysis on agent payment fraud detection, x402 and AP2 spend limits, and keeping an autonomous agent's spending inside what you actually authorised.
Agent payment fraud detection: what actually goes wrong
Agent payment fraud detection needs different signals to card fraud. Here are the failure modes that matter, and how to score them before money moves.
Read the article →
When a prompt injection attack ends in a payment
A prompt injection attack used to leak data. Now agents hold payment credentials. Here is how the attack reaches your money, and where to stop it.
7 min read
AI agent spending goes wrong in four minutes, not four weeks
AI agent spending rarely fails slowly. A minute-by-minute anatomy of a runaway, the four points it could have been stopped, and what to set.
6 min read
How to set x402 spend limits your agent cannot argue with
A step-by-step guide to x402 spend limits: per-agent caps, rolling windows, quote checks and the deny path. Wire it in about ten minutes.
6 min read
HTTP 402 Payment Required: reserved for 25 years, now in use
HTTP 402 sat unused since 1997. Agents and x402 gave it a job. What the status code does, how the flow works, and where it goes wrong.
6 min read
How to add a payment MCP server without handing over the keys
A payment MCP server lets an agent check spend limits natively. Here's how to wire one in, and why tool descriptions are untrusted input.
6 min read
Which agent commerce protocol should you build on?
An agent commerce protocol comparison: x402, AP2 and ACP side by side. What each one solves, what it ignores, and how to pick without regretting it.
6 min read
AP2 payment safety starts with checking the mandate
AP2 payment safety depends on mandates you actually verify. What intent and cart mandates prove, what they don't, and the five checks that matter.
6 min read
Autonomous agent payment monitoring: what to watch, and when
Autonomous agent payment monitoring done properly: the six signals worth alerting on, why post-settlement logs are too late, and how to tune.
6 min read
Why Spend7 does not offer a liability backstop for AI agents
A liability backstop for AI agents sounds reassuring. Here's why we don't sell one, what we ship instead, and how to judge anyone who does.
6 min read
AI agent security: 12 checks before you give an agent a credential
An AI agent security checklist for agents that spend money. Twelve checks, ordered by what actually bounds the loss, with the reasoning for each.
6 min read
Merchant risk scoring: the patterns one customer can never see
Merchant risk scoring works better across accounts than within one. The four cross-merchant patterns worth detecting, and why your own logs miss them.
6 min read
AI agent governance stops being theoretical when agents can pay
AI agent governance needs teeth once agents hold payment credentials. Mandates, spend authority, evidence and the four questions auditors ask.
6 min read
AI fraud detection has an inversion problem
AI fraud detection was built to score human buyers. When the buyer is an agent, the training data inverts. Why rules beat models in this niche.
6 min read
Payment fraud prevention for agents: three approaches compared
Payment fraud prevention for agent buyers: extend your card vendor, build in-house, or use an agent-native layer. Honest trade-offs for each.
6 min readPut a leash on it
Every article here describes something the API actually does. Score a payment intent in the browser on the home page, or take a key and wire the check into your agent in about ten minutes.