Agents Got Credit Cards This Week. Nobody Checked the Vault.

Ramp just built a literal credit card for AI agents and got valued at $60 billion partly for it. This week's signal is what happens when agents stop advising and start spending — before anyone's finished checking who's watching the register.

That's the thread running through five stories this week: the money-moving infrastructure for agents shipped faster than the governance around it. Ramp, Google, and Stripe all built or extended the plumbing that lets an agent hold a budget, check out on your behalf, or sync your payment data in real time. None of that is hypothetical anymore — it's live, priced, and in customers' hands. Meanwhile the security side of the ledger told a less flattering story: a $42M-funded startup exists purely because unapproved AI tools are already inside your finance and legal teams, and a $1M bug bounty needed two weeks to find a bug serious enough to leak host memory. If you run a business bank account, a storefront, or anything with a payment method on file, the agents showed up with spending power before anyone agreed on the audit trail.

Models + launches

Google's Universal Cart launched in the US this week, letting shoppers save items across any retailer inside Search and Gemini — routed through an open Universal Commerce Protocol rather than a walled-garden checkout [1]. That's a deliberate structural choice: Google isn't trying to own every merchant relationship, it's trying to own the cart that sits in front of all of them. If you sell online, there's now an AI agent with its own persistent memory of what a shopper almost bought, sitting between your product page and your checkout button.

Tooling shifts

Stripe shipped Data Pipeline this week — a free, public-preview feature that syncs your payment data to Postgres in real time [2]. That kills the custom webhook-and-polling integration most SMB stacks still hand-roll just to keep a local copy of Stripe data current. It's not an agent feature on its face, but it's the exact kind of plumbing an agent needs to reason over your transaction history without hitting Stripe's API on every query — infrastructure that makes the next item on this list easier to build, not harder.

SMB angles

Ramp hit a $60 billion valuation this week, up from $44 billion in June, on $2 billion-plus in ARR and 85,000 customers — built in large part around AI agent spend controls and a credit card designed to be held by an agent, not a human [3]. Token-spend management is turning into its own SaaS category before the model vendors themselves got there, which tells you something about where the actual budget anxiety in agentic AI lives: not "is the output good," but "who approved this charge."

That anxiety isn't abstract. Stripe's own research this week found that two-thirds of the Forbes AI 50 now bill on usage instead of flat seats — and when Growth Unhinged's Kyle Poyar had an LLM agent price-check one company's AI add-on with no machine-readable pricing page to read, as Stripe's blog reported, the guesses ranged from $100 to $2,400 per user, per month [4]. A 24x spread. If your AI feature's price isn't published somewhere an agent can actually parse, agents shopping on a customer's behalf aren't estimating your price. They're inventing it.

Source: TechCrunch — Pluto Security raises $42M as AI gives enterprise security teams a new headache

Not every SMB story this week was about agents spending money — some was about automation earning it the old-fashioned way. A veteran-owned HVAC and plumbing outfit scaled from $300,000 to $3.8 million a year running dispatch, invoicing, and scheduling through Zapier automations, with its owner aiming to keep growing without expanding the office at the same pace [5]. Worth holding next to the Ramp story: the back office doesn't need an agent with a credit card to 12x revenue. It needs the plumbing between the tools you already pay for to actually work.

Adjacent to watch

Pluto Security raised that $42 million — $8.5M seed plus $34M Series A — on a single finding worth sitting with: 60% of the risky AI tools it discovers inside a company were brought in by non-developers, finance first, then marketing and legal, and new tools show up in a company's environment within two hours of release [6]. Pluto's CEO put it bluntly: "there was not one POC in which we entered and didn't find malicious stuff." If your AI policy is "IT approves new tools," you don't have a policy. You have a fiction, and finance already knows it.

Vercel's own $1 million sandbox bug bounty closed out this week having paid $242,000 across 57 valid reports in two weeks — and surfaced a Linux kernel networking-stack defect serious enough to leak host memory, crash the host, or achieve code execution [7]. The fix wasn't a patch. It was removing guest-to-host trust from the design entirely — server-derived values, signed keys, one canonicalization routine per data type. If you're running untrusted agent code in any sandbox, that's the reference architecture for what "we take isolation seriously" has to actually look like, not just claim.

Nobody asked if the agent should get a credit card. They asked how fast they could ship one.

Put the money-moving stories next to the trust-gap stories and the shape of the week gets obvious:

flowchart TD
  Start([This week's signal]) --> Spend[Agents got spending power]
  Start --> Gap[Nobody finished the audit trail]
  Spend --> S1["Ramp: $60B valuation,<br/>credit card built for agents"]
  Spend --> S2["Google: Universal Cart,<br/>agents shop any retailer"]
  Spend --> S3["Stripe: real-time Postgres<br/>sync of your payment data"]
  Gap --> G1["Stripe's own data: agents guess<br/>your price within a 24x spread"]
  Gap --> G2["Pluto Security: 60% of risky AI<br/>tools enter via finance, not IT"]
  Gap --> G3["Vercel: $1M bounty needed<br/>2 weeks to find a host-escape bug"]
  S1 --> Verdict[[The spending infrastructure<br/>shipped faster than the audit trail]]
  S2 --> Verdict
  S3 --> Verdict
  G1 --> Verdict
  G2 --> Verdict
  G3 --> Verdict

Sources

[1] TechCrunch — Google's Universal Cart shopping tool launches in the US — techcrunch.com [2] Stripe — Stripe Data Pipeline: real-time Stripe data in Postgres — stripe.com [3] TechCrunch — Ramp reaches $60B valuation as it pushes deeper into AI — techcrunch.com [4] Stripe — The economics of AI monetization — stripe.com [5] Zapier — How 3R Plumbing scaled with next-gen Zaps — zapier.com [6] TechCrunch — Pluto Security raises $42M as AI gives enterprise security teams a new headache — techcrunch.com [7] Vercel — Findings from the $1 million Vercel Sandbox Challenge — vercel.com

None of this means refuse an agent a payment method until some standard body finishes a spec. It means the same thing it's meant every week this signal has run: decide your agent's spending and access boundary on purpose, in writing, before a vendor's default decides it for you. That's the exact audit I run at the start of every agentic automation engagement — the same question I asked when I rebuilt The Hub's stack: not "can this tool do the job," but "what happens the one time it's wrong, and who notices first." Ramp's $60B says the market already agrees agents need a wallet. Pluto's $42M says nobody agreed on who's watching it spend.

The short version

• Ramp hit a $60B valuation (up from $44B in June) building AI agent spend controls and a credit card designed to be held by an agent
• Google's Universal Cart launched in the US — agents can now shop across any retailer via an open Commerce Protocol
• Stripe shipped free real-time Postgres sync for payment data, and separately found agents guessing a company's AI pricing across a 24x spread with no machine-readable price to check against
• A Zapier case study showed a plumbing company hit $300K-to-$3.8M on dispatch and invoicing automation — no agent spending power required
• Pluto Security raised $42M on a single stat: 60% of the risky AI tools inside a company arrive via finance and legal, not IT
• Vercel's $1M sandbox bug bounty needed two weeks to find a bug serious enough to leak host memory or achieve code execution
• The bottom line: the infrastructure for agents to spend your money shipped faster this week than the infrastructure to audit what they spent it on