2026-W44 market review — 1 new deployment, 1 status change, 1 protocol update

Weekly automated review. Changes this run:

• Stripe MPP (status change, beta → live): Stripe's official changelog lists "Accept payments on x402 and Machine Payments Protocol (MPP)" as General availability. SPT availability expanded to all US states and internationally (previously "US, Canada, and select European countries"). Stablecoin payments available in 30+ countries. October 2026 added session-based streaming payments (pre-authorize a max, pay per unit of work in sub-cent increments) and dynamic pricing as public previews. Status updated from beta to live.
• Visa TAP B2B Pilot — BILL + Billtrust (new deployment, pilot): Visa, BILL, and Billtrust launched the first live pilot for trusted AI agents to complete approved B2B invoice payments end-to-end through supplier portals. BILL's Payment Agent is registered via Visa's Trusted Agent Protocol and Agentic Directory, uses tokenized credentials, and replaces manual portal logins and CAPTCHAs. Announced October 20; currently processing real transactions.
• Mastercard AP4M (protocol update): Mastercard opened Early Access to Agent Pay for Machines at Cloudflare Connect on October 20, providing first buyer/seller-side APIs, toolkit, sandbox, and developer documentation. Demonstrated live with 9 payments across 2 merchants (AIsa and Cloudflare AI Gateway) on a single approved budget, settled via Coinbase, Base, and BVNK. Pilot partners include Cloudflare, Ant International, AIsa, Base, BVNK, Coinbase, and Hype. Still in pilot and not commercially available.

Also noted this week:

• Stripe Treasury for agents (October 21): Stripe launched Treasury for agents (public preview), letting AI agents check balances, pay invoices, transfer funds, and convert currencies via Stripe's MCP server, with human approval for money movement. A product feature, not a new protocol.
• x402 SDK security vulnerabilities (October 22–23): Security firm V12 disclosed 25 vulnerabilities in the x402 SDKs, including 3 critical flaws (unlimited payment signing, Solana no-token-payment bypass, cross-site login signing). All 3 critical issues were fixed in August 18 releases, but the x402 Foundation published no security advisory; npm audit and PyPI show no warnings. Developers should upgrade to @x402/core 2.28.0+ (TypeScript), v2.28.0 (Go), 2.25.0 (Python).
• EMVCo Agentic Payments Framework (Q3 2026 newsletter, Oct 9): EMVCo's draft framework introducing "Intent Services" for card-based agentic payments completed public comment on September 30. It is a conceptual framework, not a specification (no APIs, message formats, or conformance requirements). EMVCo may develop KYA and Agentic Transaction Indicators next.