FIDO Alliance, Google, and Mastercard launch working groups to develop security standards for AI agent transactions

The FIDO Alliance announced on Tuesday that it will establish two working groups to develop industry standards for validating and protecting payments and transactions carried out by AI agents, with initial contributions from Google and Mastercard.

Google contributed its Agent Payments Protocol (AP2), which cryptographically verifies that a user authorized an agent-initiated transaction, and Mastercard contributed its Verifiable Intent framework (a secure mechanism for users to authorize and control agent actions). The standards will include mechanisms to prevent phishing and unauthorized agent instructions, as well as privacy-preserving frameworks so users, merchants, and service providers can validate agent-initiated transactions.

According to the FIDO Alliance CEO, existing security models were not designed for agent-based actions performed on a user's behalf, and establishing foundational protections is necessary to promote trust in agentic AI and prevent bad actors from exploiting vulnerabilities.