Dead Code and Living Precedent: The AI Agent Liability Vacuum, Private Governance, and the Race for the Machine-Pay Rail

On August 4, 2026, two events occurred in the same hour. The Ninth Circuit Court of Appeals vacated an injunction against Perplexity AI, effectively ruling that a consumer who deploys an AI agent is legally responsible for that agent’s actions, not the platform that produced it. And on that same morning, Cloudflare shipped a wallet product. One event was a legal ruling. The other was a commercial product. But they are the same artifact. Both are responses to a structural vacuum — the absence of a governance layer for machine-initiated commerce. In my years of auditing smart contracts, I have learned to spot a vulnerability not when code breaks, but when it silently accommodates a new threat model. This is what the Ninth Circuit just did to the law: it accommodated a threat model that does not yet have a name. The court’s browser analogy — comparing Perplexity’s AI shopping agent to a browser that a user directs — is a legal abstraction that fails to account for the most important variable in any system: who holds the private key. The case is Amazon v. Perplexity AI. Amazon alleged that Perplexity’s Comet AI shopping agent violated the Computer Fraud and Abuse Act (CFAA) by accessing Amazon’s site in an unauthorized manner, alongside trademark and state law claims. The Ninth Circuit ruled that the CFAA claim was legally groundless — accessing a public website, even with an automated agent, does not constitute a CFAA violation absent a clear revocation of permission. But the court left the trademark and state law claims alive, and in dicta, the court said something more revealing: it suggested that the user who deploys the agent, not the agent provider, is the legally responsible party, just as a person who asks a friend to browse Amazon on their behalf is responsible for what that friend does. This is the browser analogy. This is also the moment the market began pricing in the vacuum. In the six weeks between the oral argument and the decision, Mastercard had already launched Agent Pay for Machines, a verifiable intent system that cryptographically binds AI agents to credentialed principals. Visa had already announced Intelligent Commerce and its Trusted Agent Protocol, with claims of 100+ partners. Cloudflare’s wallet launch was not accident. They were shipping solutions to a legal problem before the court had finished describing the problem. Let me be precise about what Verifiable Intent actually is, because the industry’s press materials have a way of converting engineering into marketing. Traditional payment authorization is designed for humans. Three-Domain Secure, tokenization, even biometric authentication — they all assume a human at the keyboard who can read a screen, enter a code, and ultimately be sued. Verifiable Intent is different. It is a credential identity system. It binds an AI agent to a verified principal via cryptographic credentials, and it enforces programmatic spending authorization. The agent does not “ask” for money. It proves that it is authorized to spend money on behalf of a particular entity, up to a configurable limit, under a revocable scheme. From my audit perspective, this is not a cryptographic innovation. It is a deployment innovation. The cryptographic primitives — public key infrastructure, digital signatures, tokenization — are decades old. What is new is the systemic integration: classifying AI agents as first-class participants in the payment network’s trust root. The Mastercard solution treats “agent identity” as a formal, certified object. Visa’s protocol appears to do something similar, though the technical details remain undisclosed. And Cloudflare’s approach is different: it ships a wallet with hard-coded guardrails — spending limits, merchant whitelists, maximum transaction sizes — at the edge of the network, where the agent meets the user. The legal question is not really about agents at all. It is about whether a person can be held liable for a system whose behavior they do not, and cannot, fully observe or control. Logic does not bleed, but it does break. And the logic of the browser analogy breaks precisely at this point. The court assumes the user has supervisory control. The data say otherwise. From the survey cited in the underlying analysis: only 14% of consumers trust an AI to execute a purchase autonomously. 86% say they always verify what the AI recommends before buying. 42% have hard-set rejections for anything over $25. If these numbers are even — and they are from one survey, one moment in time — they tell a devastating story: users do not trust agents to act, and yet they are legally responsible for what the agents do. The law has assigned liability to the party least capable of exercising technical control over the system. This is the classic bug of a legal system that operates at the abstraction layer of analogy rather than the execution layer of code. In 2017, I spent three weeks auditing an ERC-20 token sale contract that had been reviewed by fifteen senior developers. The vulnerability I found — an integer overflow in the claimRewards function — was not visible to anyone who read the function in isolation. It only emerged when the function’s state mutations were analyzed against the entire transaction flow. This is the same class of error. A judge reading a statute cannot see the dependency graph of a modern AI agent any more than a developer reading a single function can see the exploit that lurks in its interaction with another contract. So what is actually being built? The three private-sector trust layers differ in their fundamental assumptions. Mastercard deploys a centralized trust root. The agent is authenticated against Mastercard’s infrastructure, and every transaction is traceable to a legal entity via KYC-bound credentials. Visa is building a similar centralized structure, but it is ahead on ecosystem penetration — 100+ partners, though the article does not disclose how many of those are deep integrations versus proof-of-concept pilots. Cloudflare’s wallet is technically the most flexible and architecturally the most honest. It does not pretend to solve all the problems. It is a human-configured guardrail: limits, whitelists, ceilings. This is similar to the pattern of smart contract wallet — Safe, Argent — but deployed at the Web2 infrastructure layer, where the actual user traffic lives. And then there is the x402 Foundation, the only Web3 participant mentioned in the article. The name itself suggests a protocol built around HTTP 402 Payment Required, a long-dead HTTP status code that may finally have a use case. I have no information about x402’s technical implementation. But I can reason about its structural position from the outside. It is the only approach that could function without a centralized KYC trust root, the only approach that could even in theory preserve user privacy, and the only approach that the article mentions as “building out to address this gap.” That passive framing — noted but not profiled, mentioned but not evaluated — is the most telling data point in the entire piece. In the mainstream narrative, Web3 is not even a contender yet. It is a footnote. This is the first time I have seen the market respond to a legal vacuum with this kind of speed. The last time I saw something similar was 2022, when Terra-Luna collapsed and I spent several months reverse-engineering the Anchor Protocol to understand whether the yield was ever sustainable. My analysis at the time led me to conclude the whole structure was mathematically doomed, and the market’s validation of that doom is what hardened my professional instincts. The lesson was not that complex systems fail, because complexity is the enemy of security and that was always true. The lesson was that when the underlying incentive model is a Ponzi, no amount of security hardening will save it. Here, the incentive model is inverted. The law is the unstable element. No legislative body has acted. Congress has not passed a new statute. The CFAA was rejected as a catch-all for agent access. The result is that consumers bear the liability burden, and private corporations are racing to sell them protection against a liability they did not choose and cannot fully understand. Aesthetics are often exploits in waiting. The “browser analogy” sounds elegant. It accesses the intuition of a person who uses a tool to browse a website and is of course responsible for what they do with that tool. But an AI agent is not a tool in the way a browser is a tool. A browser is deterministic. Every byte the browser sends is a function of the user’s input. An AI agent is a stochastic systems. It generates outputs based on a trained model, and the model’s behavior cannot be fully predicted by either the user or the manufacturer. The court has put its thumb on the scale of a legal fiction. The market sees the fiction. That is why Mastercard and Visa are not selling “safety” — they are selling accountability as an infrastructure. By binding an agent to a verifiable principal, they create the means to trace any transaction back to a human who can bear the legal consequence. This is not a security service. It is a legal compliance technology. It is a way to convert the court’s liability assignment from a theoretical risk into a commercially manageable one. Trust is a vulnerability vector, and these firms understand that perfectly. The trust is not in the AI. The trust is in the accountability chain. But here is the contrarian angle, and I say this with genuine respect for the Web3 community’s instincts: the centralized players may be the ones who actually get it right, at least for the next phase of this market. I spent years arguing for on-chain verification over conventional auditing. I still believe the code speaks louder than the whitepaper. But the AI agent problem is not simply a code problem. It is an accountability problem. And accountability, at least for now, depends on legally recognized persons — corporations, individuals, licensed entities. Mastercard has KYC infrastructure that predates blockchain. Visa has a partner network of over 100 companies. These are distribution channels. They are not technical advantages. But in a market just entering its first growth cycle, distribution may matter more than decentralization. A system that refuses to exist until the security is perfect will not exist at all. That is the honest trade-off. Privacy-preserving systems solutions — and there is no technical reason a decentralized system cannot implement zero-knowledge proofs to verify identity without exposing it — are facing a KYC friction that the centralized trust roots are already passing through. A Web3 protocol like x402 could, in theory, offer what the payment networks cannot: control without surveillance, permissionless access, and protection against a single point of failure. But the centralized players have the certainty that KYC provides, and for the financial regulators of the year 2027, that certainty is bulletproof. The deeper structural risk is not which vendor wins. It is the permanent fragmentation of the agent identity layer. Mastercard’s verifiable intent, Visa’s intelligent commerce protocol, Cloudflare’s wallets, and the Web3 standards all coexist but none interoperate. From my experience auditing cross-chain bridges, I know that fragmentation is not merely an inconvenience; it is a systemic attack surface. Every identity system becomes a silo, every silo becomes a monument to a compatibility failure, and every compatibility failure becomes an incentive for someone to build a bridge — and bridges, as the history of decentralized finance has shown, are where the most catastrophic exploits happen. So what is the takeaway? The issue is not that the Ninth Circuit made the wrong decision. The issue is that the court’s browser analogy is a legal placeholder for a governance model that does not yet exist. The market has moved fast to fill that vacuum, and the market will keep moving. The private governance frameworks being built today may very well become the trust infrastructure of the next decade—but they will have been built without the accountability of being tested in adversarial conditions, without the transparency of a formal public review, and without the consent of the 86% who still insist on manually verifying their AI’s recommendations. Every artifact is a trace of failure. The Verifiable Intent manifest is a confession that courts are too slow and legislators too careless to define a workable standard. The question that remains is not which rail will win the race. It is whether the race should be run at all when the rulebook is being written by those who profit from the outcome.