In India, an AI agent can now reach the checkout. Only a second channel can say yes

Facts are attributed and linked to their sources. The analysis and opinions are the author's own.

What happened

On 6 November the payments company Cashfree made its hosted checkout readable by AI agents. Cashfree says the page now publishes six named tools through WebMCP, an emerging web standard that lets a page tell browser agents what actions they can take. An agent can read the order and the offers, list the payment methods, open one, show a UPI QR code and check whether the payment went through. It cannot change the order. The tools never accept card numbers, CVVs or OTPs. The QR tool is marked as "consequential", and the payment completes only when the shopper scans the code and approves it with their UPI PIN.

Cashfree says the tools can cut the tokens an agent spends on a checkout by more than 40%, that merchants need to change nothing, and that the usual offer, fraud and risk checks still run. The browser marks actions taken through the tools as agent actions, so merchants can tell agent-assisted payments from direct ones. Business Standard reported that the feature is being rolled out to all of Cashfree's merchants. The limits matter: it works only on redirect checkout, UPI QR works only on the desktop layout, and the agent needs a Chromium browser that supports WebMCP, such as Chrome 149 or later.

The regulator was moving at the same time, though less publicly. According to MediaNama, citing a report by Head and Tale, the RBI met banks that week and issued a confidential advisory dated 3 November on the APIs lenders use to move money. As reported, banks must add maker-checker or out-of-band confirmation to API debit requests through a separate channel, for all transactions or for those above a risk-based threshold. Verified beneficiaries must be pre-registered, and additions allowed only through a separate channel protected by multi-factor authentication. Per-transaction and daily limits apply immediately, intra-day velocity limits within a month, and existing integrations have until 3 December 2026. The advisory is not public, so these details are as reported.

MediaNama also reported that CERT-In's 4 November advisory described attackers sending ₹1 test transfers before larger ones and getting around IP allow-listing through shared third-party IP pools. CERT-In's Director General, Sanjay Bahl, told the publication that what worries the agency is "delegated authority without commensurate guardrails", and AI agents "being trusted faster than they are being secured".

Why it matters

In my view these are two halves of the same design. Cashfree lets the agent do the clicking but keeps the authority with the customer, on a phone, behind a PIN that the agent never sees. The RBI, as reported, is asking banks to do the same for machine-to-machine payouts: a debit request that arrives over an API is not enough on its own, and something outside that channel has to confirm it. In both cases the safeguard is not a smarter model. It is a second channel the machine cannot reach.

The safeguard is not a smarter model. It is a second channel the machine cannot reach.

Issue 04 reported that the RBI had moved from warning banks to asking for proof after a partner-API loss. These reported requirements are what that proof looks like in practice: an inventory of API clients, limits, whitelisted beneficiaries and an out-of-band yes. They were written against attackers, but they apply just as well to a customer's own agent acting with too much delegated authority.

For a bank, payment aggregator or merchant, I would take three things from this week. First, decide which actions an agent may take and keep the final authorisation in a channel the agent does not control. Second, label agent-assisted traffic and give it its own fraud baselines, because an agent paying at 3 AM looks different from a person doing so. Third, treat the 40% token saving as Cashfree's own figure until someone measures it independently. The control design is the part to copy now.

What I'd watch

• Whether the RBI publishes the advisory, or a version of it, and how it treats agents acting for customers rather than attackers.
• How many agent-marked payments merchants actually see on Cashfree's checkout, and whether other payment aggregators follow.
• Whether UPI itself adds a flag for agent-initiated payments, so banks can see them as well as merchants.