Cloudflare launched Wallets for AI agents this week, a stablecoin-based payment product built on the x402 protocol, which recently moved under Linux Foundation stewardship. The pitch is straightforward: instead of an agent holding a human's credit card or API key, it holds its own funded balance with programmable spending rules. According to reporting, Cloudflare's Wallets offer stablecoin balances with programmable per‑payment limits and merchant whitelists via x402, and more than 20 companies are already participating in agent‑initiated payment flows. That's a real number for something this new — it means the pattern of an agent autonomously paying a vendor, an API provider, or a contractor is already in production at more than a handful of shops, not just a demo booth item. The detail worth sitting with is the gap in the controls. Coverage notes that current controls cap individual payments but not sequences — meaning an agent that stays under the per-transaction limit can still rack up unlimited total spend across many small payments. That's the exact failure mode every fraud team has seen before with card-not-present transactions, except here the buyer is a piece of software that can iterate through purchase attempts far faster than a human ever could. This matters for the orchestration layer specifically because payment is often the last step in a multi-agent handoff: one agent negotiates, another executes, a third settles. If the settlement leg has a hole in its rate-limiting, the whole chain inherits that risk regardless of how well-scoped the upstream delegation was. x402 sitting under Linux Foundation governance now gives this a neutral home rather than a single-vendor lock-in, which is the right instinct — but governance of the spec doesn't automatically close a design gap like sequence-level limits. The practical takeaway for anyone actually deploying this: treat per-transaction caps as necessary but not sufficient. Aggregate spend ceilings over a rolling window, anomaly detection on transaction frequency, and mandatory human approval for new merchants or limit changes are the near-term mitigations until the protocol itself grows sequence-aware controls. Agent-driven spending is moving from pilot to production faster than the guardrails around it are maturing, and this is a clean, documented example of that gap rather than a hypothetical one. None of this is really about whether agents should be allowed to pay for things — that ship has sailed. It's about whether the infrastructure tracks the difference between an agent authorized to make one $50 purchase and an agent that's made two hundred of them in an hour.