Cloudflare, which routes roughly 20% of global web traffic, launched Cloudflare Wallets and the x402 protocol on August 4, 2026, giving AI agents a funded, capped way to pay for APIs and data without a human clicking checkout. More than 20 companies are already participating in these agent-initiated payment flows. The infrastructure isn’t fully live yet, but the spend-governance policy question is already overdue.

AI agent payments just moved from a theoretical problem to live infrastructure at internet scale. During a release cycle it called Agents Week, Cloudflare shipped Cloudflare Wallets alongside the x402 protocol, reviving HTTP status code 402, Payment Required, a code that has sat unused in the web standard for roughly thirty years, according to an August 2026 technical breakdown. A server that wants payment now returns a 402 response with machine-readable terms; an AI agent attaches proof of payment in stablecoins and the transaction settles without a checkout page, a login, or a human in the loop.

Cloudflare processes approximately 20% of all web traffic, so when the company builds a payment primitive directly into that infrastructure, it isn’t a startup experiment, it’s plumbing, according to Forkast’s coverage of the launch. The design splits custody from spending: an Account Wallet belongs to a person or company and holds real funds, while Virtual Wallets are capped, delegated allowances handed to individual AI agents, functioning like a corporate checking account issuing restricted debit cards to employees, except the employees are software. AI agent payments under this model inherit spend limits set by a human owner, not by the agent itself.