Alfonso Gómez-Jordana on Why Every AI Agent Will Need a Wallet

Transcript

We're here with Alfonso of Crossmint. Alfonso, welcome back to the show, man. It's a pleasure. Uh it's a pleasure. Thank you for for having me again. Absolutely, man. Well, uh I know we we've, you know, talked about several things. You guys at Crossmint are doing doing great work. Uh most recently, believe you guys have a a partnership with MasterCard uh and and also around this AI agent payment framework. So, we want to talk all about it. Uh before we get into the MasterCard partnership, just give us a little bit of how you know, is this pri- you've been your primary focus? Get us caught up on on what's been going on in your world since the last time we had you on the show.

>> [clears throat] >> Yeah, absolutely. Um I think just uh 10 seconds about Crossmint is a uh infrastructure company in the programmatic finance space. Most of the work we do is on stablecoins, actually. Stablecoin enablement. And I would say uh still the majority of the things that we see going on are like company like fintechs on the remittance space or nearby things like that that are starting to enable stablecoins. However, uh a lot of our product development and where we see the future going is is on agentic finance. And so, yeah, on our end the since last we spoke, we've been rolling out uh better support for what's called like scope cards or agentic cards. MasterCard announcement,

we also announced something with American Express recently. Um and yeah, lots of things to talk about there. But, I would say uh we're seeing progress all over the all over the place. Uh not only not only agentic finance, but I think there's also a lot of stablecoin enablement happening in the world and trying to somehow do all those things together. Very cool, man. Very cool. So, before we get into some of the nuts and bolts about how this integration works, just what is it like, you know, you're you're going in, you're talking to MasterCard, you're talking to American Express? I'm sure they get pitched a million times, you know, AI payments, a- a- AI agents like stablecoins or something that they've been talking about.

Why are they taking you serious? Like what what is it about Crossmint that American Express and MasterCard what what is it that you bring to the table for these companies? >> [clears throat] >> Well, I think in a way what I would say is like a every major financial player is trying to uh make sure they're up to date and remain relevant with all these transitions that are happening. And there's one on the stablecoin side and another one is on on agentic payments. And uh on the Crossmint side, we've just been doing specifically agentic payments now for around 2 years.

Um and we've been gathering a lot of developer attention. So, we've been useful to these companies to help help them bring last mile the the thoughts and technologies they have into the hands of of developers. So, we've been a good partner in terms of giving them developer feedback, actually getting uh the like, let's say, first payment outs and and things like this. And in a way, we're we're basically the glue between ultimately indie developers or the developer on the the street and uh uh the the card network companies.

Very cool. Very cool. And so, yeah, how how does this integration work? You know uh I I believe Open Claw, you know, something that you guys are helping to enable the payment network between Open Claw, Near, you know, our our sponsor of this AI show, uh has has announced Iron Claw, which helps tighten up a lot of the security uh around these agents. And so, yeah, talk us through uh talk us through Lobster Cash, talk us through the MasterCard Agent Pay. Tell us how this integration works. >> [clears throat] >> Yep.

Um so, uh let's see. So, maybe for folks to to help understand different ledgers and what's happening, first I'll explain the the end thing that the end experience that MasterCard and all these card companies are trying to achieve. The the problem everyone is trying to solve is if in the future the majority of your purchases online are intermediated by an AI agent. Uh let's say you tell an agent automatically "Do the groceries for me every week based on my nutrition plan or what have you." or "Figure out a a uh my trip to Europe and buy everything on my behalf." is how can an agent securely uh take

payment method, specifically your your credit card, and go and purchase online without screwing up, causing a lot of uh you know, incorrect purchases, leaking the data, etc. So, this is the problem that everyone is trying to solve. Now, how is this problem getting solved? At the card network layer, uh each of these companies Visa MasterCard uh American Express, Discover, are rolling out initial protocols or standards that allow an AI agent to request a scope card based off a your existing credit card.

So, let's say you have a Capital One card that has a $10,000 credit line, uh you they you don't want to give your AI agent the $10,000 to spend and directly their raw card number. Instead, with these new APIs they're releasing, you will uh be able to tell your agent will be able to say, "Hey, I need a a card for 100 bucks only to buy groceries in these five merchants." And then, the agent will get a virtual card number similar to, you know, the one you see maybe in Apple Pay or things like this. And that's the only thing that the agent will will have and be able to use. So, worst case scenario, uh it cannot do more than $100 spend in those merchants.

Okay? So, this is the technology at the network layer that's getting enabled. Yeah, they can request uh like a gift card and you and the the user can approve the gift card for the agent that gives them maybe a a much smaller limit, maybe $100, something like this. That uh that's correct. Uh it is not technically a gift card. It's really like a it's a new instrument, but it's a virtual card that is derived from a your original like Capital One card. You still keep the points. You see it on your statement. Nothing like that changes. Just that the agent can only spend that amount, no?

Um and so, this is being enabled at the network layer. And what at Crossmint we're doing is making APIs so that any agent platform can use these easily and, you know, don't don't have to do an integration with each of the card vendors. And then, in Lobster Cash is a blueprint, is a open-source website where we're basically showcasing all of these things. Showcasing all of these integrations. And also, it you can it's a it's a at the same time it serves as an open-source wallet that you can give to your own independent AI agent if you're building your own Open Claw at home or using Zo computer or uh many of the other ones that that that that exist. So, Lobster Cash in a way is like a package of all these things that

any developer can integrate. It's open-source and it's ultimately a showcase of all of these technologies. Um even though at the end of the day it's not a commercial product on our end. Our commercial product would be working with agent platforms or embedding everything white-label and more natively. Very cool. And so, you're helping a lot of these card companies kind of connect to the agent infrastructure out there. Like Open Claw has got a million agents out there, right? And so, what is, you know, I I I also see here you guys are using verifiable intents, right? So, you're giving agents cryptographic cryptographic authorization. Um like what what are some of the things that you're targeting? How of these a million agents, how many of them are you

targeting with, you know, what would be the success? Is it 100,000 agents, 200,000 agents? Well so >> [clears throat] >> um let me go by pieces. First, the verifiable intent is interesting one. Um Apologies if I get too technical, but I I think it's an interesting thing for people to start to understand cuz this will become uh right now it's all new technology, but down the line like it's a a core primitive of I think how how this entire agentic economy is being set up getting set up, no? But, ultimately the the challenge you have with agents is a bit like the principal agent uh problem that you have in, you know, the real world. Or or you could maybe an analogy is like imagine you have a a a personal assistant and you you want to

give them tell like give them your card to go buy things, no? Uh uh if you you really really really trust your assistant, you will give them your full card. And you know, after you have established that relationship, you'll you'll be like, "Okay, take my card and I know you're not going to do anything weird with it." But, maybe when you hire a new person, the first few months, uh you don't necessarily trust it. So, you don't want to give full unbound access to to all your financial instruments. So, uh when we you do this with AI agents, um um basically, what all these technologies are trying to solve is scoping down the the the access that you give to the credential, uh the the the delegation, to something where

first, the agent cannot break out from it. And if it did, you want to have a cryptographic proof of, "Hey, this is the thing that I had delegated." And then later, if there's a dispute, I had told the agent it can only spend $100 in groceries and it actually spent $200 in something else. And then, who do I go complain against? Let's say I go to ChatGPT or whatever to complain against. So, verifiable intent is a framework co-developed by MasterCard and Google that helps more or less encode what is the original user intent. What what did I actually tell the agent to do? And then, it helps them check when at the time of purchase, is that intent being um you know, uh like is is the agent actually doing

something outside of that original intent, no? So, it's a bit of a framework to encode what did the user want to buy and is the agent aligned with it or not? Um okay. That was the first question. I think your second question was completely different on adoption. Uh let me know if Yeah, yeah, exactly. So, that that makes sense on verifiable intense. And so, out of these a million, you know, agents that Open Claw instances have been deployed, you know, how many are you targeting? What kind of adoption rate do you think is possible here? Yeah so >> [clears throat] >> So, it's interesting. So, I I we do see a future where every agent, almost every agent in the world will be a financial actor, okay?

For many different things. Doesn't mean like every agent that everyone that installs Open Claw is going to use it to buy groceries or shoes or things like that online. However, there's a pretty thing that agents are starting to pay for, which is more like micro payments for their own compute, for inference, for the tools they use. This is more on the stable coin and crypto side like for Open Claw, but that one we do expect the majority of agents at some point are basically going to self-fund themselves. They will have a maybe let's say $1 in a wallet and use that to pay for their own bills and whatnot.

So, that side of the ecosystem, you know, I think the total addressable market is like almost any agent. Now, cars that are actually doing e-commerce for their customers, um you know, it remains to be seen. I do think at some point all e-commerce will be done this way. So, the total addressable market is very big. However, in the current uh usages of Open Claw and those million agents that you see out there, I would say e-commerce use cases are still small.

So, on our end, we don't have a concrete target adoption. I mean, ideally we want to serve all these agents in one way or another. Specifically, uh these scope cards from Visa and Mastercard, I would say, you know, maybe 10% of those eventually using them would be a an an awesome target to hit. But I would not expect a million because many of these are more ephemeral or doing a very specific task that that may or may not overlap with with our like e-commerce or travel or those kind of use cases.

Yeah. And so, how how easy is this to set up? Like where where would I go? Let's say I have an Open Claw instance. You know, maybe I have an an American Express card. Do I go to American Express? Do I go to Crossmint? Do I you know, how how how do I start letting my AI agent request these cards? Yeah. Um Look, so so the idea behind all of this and here I'm being maybe a bit technical and getting into the into the weeds, but the idea is that no to think about this at all. Like the idea is your agent, when you ask it, "Hey, can you buy me something online?" it will be like, "Okay, well, I need I need agent cards and I will be able to

automatically discover, "Hey, there's this technology Lobster Card and I'll I'll just go and install it." So, that's the end goal. Today, you can just go to Lobster Card and try to install it. At the same time, this technology is rolling out in beta. So, today we do have a you have to sign in in a form and we need to enable you. So, I would want to be mindful of of that. But yeah, like you want to try it, just go to Lobster Card, lobster.cash and you can try from there. And and so, you know, a lot of people have spoken about stable coins as like the native internet money. Like machine to machine payments are going to need to be done via stable coins. When an agent requests one of these scope cards, you know, from Mastercard or

American Express and it gets that number, that card number isn't stable coins. Maybe there's stable coins somewhere in the in the stack, but what's the pros and cons? Why would an agent use stable coins versus use one of these scope cards? Yeah. Um I think a two things. First of all, um So, when you think of an agentic payment, there's two legs. There's the how does the human fund the agent or delegate a payment to the agent? And then finally, what what does the agent actually use as an instrument to pay, no? And so, it's important to think about this as, you

know, in a regular payment is just what do you use to pay? Here there's how do you delegate and how does the agent actually pay? When you start let's start with the last one. How does the agent actually pay? Um what we are seeing right now in this early, you know, market is that for anything that's micro transactions, for tools, for LLM usage, for paying for its own compute, the majority of those APIs are being paid today in stable coins. And the the bigger the biggest reason behind it is the is the cost structure.

It's a it's prohibitively expensive today with cards to go and pay $0.01 of a dollar a million times, you know? Whereas with a stable coin you can do that much more, you know, with a much lower cost structure. On the other end of the spectrum, if you're trying to buy something on an existing merchant, then again, it's more like e-commerce or travel or things like that. That is where cards are a much better instrument. First of all, because there's uh you know, I think around a million merchants out there that already support cards and that they're not going to adopt stable coins tomorrow. But second, because you also get customer like, you know, you get chargeback protection, you get points and all those good things that people like about cards. So, things are kind of segmenting in in that way,

you know, like service for agents, stable coins. Some service or product for human, cards. Um that's on how the agent pays. Now, how do you delegate the payment for the agent is a separate question. Most people out there don't have a stable coin that they will send to the agent. So, what we see is cards are the primary method on the on the how does the human give payment to the agent? You can save a card on file and the agent can get a scope card, but also the agent can on-ramp and top up their stable coin balance from the same card on file. And this is a bit the vision that we've seen and also what the demand we see in the market is basically human saves a card on file with the

agent and then from that saved card on file, they can both the agent can fund their stable coin balance and the agent can also get scope cards from a single integration solution. And the agent is the one that can figure out the complexity of when do I need a card when I need a stable coin. The user shouldn't need to worry about any of that. That's all happening under the hood. Yeah, incredible. Okay. Yeah. So, we're we're starting to see kind of two different payment use cases evolve for these agents. Like you said, some of the these are services, others are um e-commerce.

And so, we're we're seeing two different payment methods for two different use cases. Um okay. And so, you know, as you're continuing to develop solutions, you know, a lot of this is agent to agent. And now, you know, you have eight American Express, you have Mastercard with these cards. You know, what is the security practice like? Because a a lot of this was, you know, kind of people were very hesitant to start to implement some of these things, right? Even near, you know, kind of talked about how there's Open Claw vulnerabilities, right? It can just start doing things. I remember there was, you know, when Open Claw was at its like peak, it was like going and

deleting emails cuz it had access to Gmail. Once it starts having access to money, even if it's capped, you know, these things can run pretty pretty wild. And so, maybe this is where verifiable intent comes into play, but generally how how does the security of these things work? And and how do we make sure that that these agents are spending money securely? They're not going to get, you know, that card number is not going to get stolen. Stable coins are not at risk. Generally, what are what is the financial security of these of these agents? Yeah, that's a good question. And so, I think this is precisely what separates the these new standards that are coming online like Mastercard Agent Pay and and and the others

from like just giving an agent a raw card. I would start with we have seen across the industry already a lot of hacks on in the developers we giving their Open Claw raw credit card number or a private key for a stable coin wallet and it it getting like stolen by prompt injection or a malicious skill. So, that's definitely is a very real threat. It's already occurred. And so, yeah, a lot of behind these technologies is how you prevent that. So, with with the scope cards from Mastercard, Visa and Amex, etc., um First of all, what you do is you you minimize the blast radius. Like the

worst that can happen is you lose 100 bucks, but also there's going to be enforcement of, you know, at the merchant level like this card is only allowed for this kind of merchants or intent. So, if you create a card that's for travel and someone were to steal it, like worst case scenario, they can buy maybe a hotel somewhere, but not like take the money and launder it that easily. So, it reduces the the potential it makes, you know, compromising this information much less attractive. That's on the card side. And and also the card number it's a virtual card number, so it's not the raw card number.

So, you revoked it, um it cannot be used again, no? And so, with our solution and if you try it in Lobster Card, you can also revoke the cards, you can set expiration times and all of those things to really like not prevent the problem, but make it so that if it happened, like it won't be a big deal and the attacker probably won't even even target it because they cannot do much with it. On the stable coin side, similar. The solution that we proposed, we we also include wallets as part of the solution. And we do two things. One, the private keys of the wallets, we never store them on disk. There's other solutions out there that store them on disk, encrypted, but then they put the key there as well. We put it on the We always use the secure enclave on the

device. The keychain on iOS and things like this to make sure those keys are not extractable. So, if you get compromised or you get a supply chain attack like the one that happened like a couple of weeks ago with Axius and Light LLM, the keys will never get stolen. And then the other part is on the on the crypto side, we also have the same like spend limits. So, that you can say, "Hey, this agent can only spend 100 bucks per week." And so, worst-case scenario, if someone stole your computer and had your password and could or or can trick the agent into buying things that they shouldn't, they can only be able to spend up to the spend amount, no? So, the idea here is restricting the damage.

Uh uh containing damage so that the attacks are less interesting to do and have lower blast radius. Um but I would also admit that in general agent security is work in progress. So, this is the best thing you can do. You can limit the scope a lot to the point that I think is more than usable for most use cases. Um Um but but there's also other things happening on agentic security uh across the industry that that will also uh you know, make this make all of this like uh pretty likely. Yeah, it you know, it seems like especially with this integration that the payment systems for agents are radically innovative.

Now, the agents themselves, we we kind of had this initial iteration, but with the security vulnerabilities and then also with, you know, kind of the the way that uh these things have been continuing to develop, it feels like now they're lagging behind. Like what what are some of the more creative things that you think we can do? You know, are are Are these agents are they ready to you know, book ourselves flights, book us hotels? Like are they ready to do these sorts of things or is it is it just not quite Maybe they have the payment for it yet, but you know, for some other reason they're not able to do it. What What is the biggest blocker to really making these agents very useful on a day-to-day basis?

Yep. Uh that's a great question. So, there's a few things. First, I'm going to be very clear that on the payment side, I think these aren't the right technologies, uh but they're starting to roll out. Um today uh both Visa and Mastercard's solution are in beta. Like uh you can you can start trying these things in Lobster Cash uh with us and but almost nowhere else on the entire internet. And so, as these technologies roll out, there are maybe card issuers that don't support them yet uh like Chase, I believe, and others. So, there's there's still some time for the payment to be at the state where we're like, "Okay, like everyone can use this, no?" I think today, basically, I would say is for the

next 3 months, it's only people who are who are joining betas and things like this. But the second part is is actually when agents go to pay, there's not much inventory of things that that works. You can go and open a browser and try to buy on a on any existing e-commerce website, but that doesn't work that great yet. And the main reason is there's a lot of um CAPTCHAs. There's a lot of like anti-fraud technology that has been deployed to prevent automated abuse that is now blocking automated legitimate cases. So, there's technologies and efforts to fix that, but that's uh lagging behind. So, what you would see is your agent will get blocked in a bunch of places like uh you know, Amazon, for example, blocks

all agents, no? Or or things like that. And on the stablecoin side, um there are more and more services coming online. Uh in particular, Crossmint, we have an API that has more than a billion uh physical items that you could buy directly with stablecoins. There's also Forex 402, you know, hundreds of APIs that you can pay with. But it's still a minuscule amount of, you know, the tools that an agent may need out there. So, I would say inventory is still small. At the same time, I do think this is a very outsize opportunity for for folks to start building apps or or services natively for agents that that have great agent conversion.

Because the moment the payment methods are are, you know, fully rolled out, which is imminent, it may be like end of Q2 or whatnot, uh there's just not that many competing for their dollars. So, you know, I think the market will correct itself, but right now there's a bit of uh payment methods still getting to production readiness and then inventory being uh readily available that that are both improving, but but they're still not at the critical like uh point, I would say. Yeah, you know, I saw ChatGPT 5.5 came out yesterday. I started to play around with it a little bit, and it was able to schedule appointments on my calendar, which felt like a new thing, right? It wasn't just an LLM, it was able to do some take some agentic in you know,

agentic actions. Um you had to connect the apps first. It couldn't just go out and use the browser right? What What do you What is your current stack? Like what is What is your agentic stack looking like these days? Man, it changes by the day, literally. Um uh I'm a user of a lot of agents. I like for more personal use, more managed agents, I use Tasklet. I don't know if you guys have tried it, uh but very very easy to use for agents that spin off of my own inbox.

Uh I also use Zoho Computer for things that are a bit more more advanced. It's a bit like a open claw that requires a bit less maintenance. Then I have my own Mac mini with open claw that has a bit more like heavy it's running a lot of things all the time. Um and then I personally use Devin a lot, not only at the company, but uh Devin from Cognition, but also I have my own Devin personal instance for a year and a half, and it's the one that writes code for the other agents. Um and then in terms of APIs and uh more lower level, I've been playing a lot with Agent SDK from OpenAI, um and uh starting to look into RunLoop for secure sandboxes. Um so, I don't know, but but you ask me

next week and I'll tell you three other tools. The reality is it's changing all the time. Um but but uh it's a it's but it's it's very cool to see the progress. Like basically, one thing that was impossible a month ago, suddenly now it's like super easy this month. It's very cool. Uh Alfonso, thanks for thanks for coming on the show, man. And uh you know, obviously uh very very uh cool to hear about the AI stack and there's things coming out. It's always It's always good to update the mental model, update, you know, what the stack is. And then also congratulations uh on on the partnership with Mastercard and and American Express. Uh feels like payments is just one step closer to becoming actually useful in the real world.

Absolutely. Thank you so much for having me. Um and uh yep. Hope you all have a I hope the audience enjoyed it and hope you all have a uh a great weekend. Absolutely, man. Thanks so much. We'll see you next time.