Rebuilding AI agents with cryptographic trust: payments, proofs, and the truth gap
Google, Mastercard, Mina, and Chainlink are shipping protocols that make AI agents auditable first-class actors on crypto rails—but ZKML proves computation, not truth.
The infrastructure stack for AI agents is getting rebuilt with cryptographic guarantees. Google’s Agent Payments Protocol (AP2) defines an open, payment-agnostic protocol that supports both traditional rails and stablecoins, using cryptographically signed Mandates as tamper-proof digital contracts for user payment instructions.[^claim_1321] Mastercard’s Agentic Token Framework goes further: it registers and verifies AI agents before they transact, then assigns each agent dynamic, cryptographically secure credentials built on Web Bot Auth (IETF RFC 9421), so merchants can authenticate agent traffic at scale.[^claim_1325]
On the compute side, two models are emerging for verifiable AI inference. Mina Protocol’s zkML library lets developers generate zero-knowledge proofs from AI inference jobs on private inputs and settle those proofs directly on the Mina blockchain, letting on-chain verifiers check integrity without learning data or model parameters.[^claim_1322] Chainlink’s verifiable AI stack takes a layered approach: off-chain AI models produce outputs with cryptographic proofs, which get verified on-chain by smart contracts before any state transition.[^claim_1323] Both approaches trust-minimize AI consumption, but there’s a critical caveat: Zero-Knowledge Machine Learning (ZKML) proofs attest only to computational correctness, not to the semantic truth of the AI’s answer.[^claim_1324] A valid proof means the model ran correctly—not that its output is factually right.
Agent-to-agent coordination is standardizing under the Linux Foundation’s Agentic AI Foundation (AAIF), which consolidates Anthropic’s Model Context Protocol (MCP) for tool connectivity, Block’s goose framework, and OpenAI’s AGENTS.md spec.[^claim_1326] IBM’s Agent Communication Protocol (ACP) adds RESTful HTTP interfaces for task invocation and lifecycle management, using capability-based security tokens for fine-grained authorization.[^claim_1327] These standards are building an “HTTP for agents” that will likely become the substrate for multi-chain AI agent meshes.
Crypto-native agent platforms are already live. Virtuals Protocol has enabled approximately 14,000 AI agent tokens, each tied to on-chain autonomous agents that hold their own tokens and execute strategies, contributing to a reported $5.01 billion market cap by early 2026.[^claim_1328] Tooling is catching up: Composio’s Crypto-Kit exposes exchange, wallet, and DeFi protocol integrations as unified tools for AI agents, so developers can build trading, portfolio, and governance agents without bespoke integrations.[^claim_1329] Meanwhile, code sandboxes from E2B, Daytona, Morph, Runloop, and Together provide isolated execution environments for AI coding agents, reducing the risk of hallucinated or malicious actions on local systems.[^claim_1330]
The key tension is that ZKML proves computation, not truth—DeFi protocols consuming AI scores or pricing must embed economic incentives and circuit design to guard against confidently-wrong but validly-proven outputs. Watch for agent-to-agent payment flows using AP2 or Mastercard’s tokens, and for the AAIF standards to enable cross-chain agent coordination. The agent launchpad model (Virtuals) raises new mechanism-design questions about collusion and governance as thousands of tokenized agents interact on-chain.
Provenance ledger
10 claims web-citedEvery claim below cites a source URL, and each URL was checked for validity before publish. The excerpt shown is the researcher's own summary of the page — it is not re-derived from the source, so it is not a verified verbatim quote. Follow the link to confirm any claim against the original. Citation markers in the text jump here.
[1] Google’s Agent Payments Protocol (AP2) defines an open, payment‑agnostic protocol for agent‑led transactions that supports traditional rails (credit/debit, bank transfers) and stablecoins/cryptocurrencies, using cryptographically signed Mandates as tamper‑proof digital contracts for user payment instructions. web-cited
AP2 is an open, shared protocol that provides a common language for secure, compliant transactions between agents and merchants, helping to prevent a fragmented ecosystem. It also supports different payment types–from credit and debit cards to stablecoins and real-time bank transfers. AP2 builds trust by using Mandates—tamper-proof, cryptographically-signed digital contracts that serve as verifiable proof of a user's instructions.
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[2] Mina Protocol’s zkML library allows developers to generate zero‑knowledge proofs for AI inference jobs on private inputs and settle those proofs directly on the Mina blockchain, so on‑chain verifiers can check the integrity of the model computation without learning the underlying data or model parameters. web-cited
We’re excited to announce the first developer release of Mina’s zkML library—a powerful tool for generating zero knowledge proofs (ZKPs) from AI models and settling those proofs on the Mina blockchain. Mina’s zkML library enables anyone to generate a zero knowledge proof from an AI inference job using private inputs. This means you can trust the output has not been tampered with and you can keep your private data private.
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[3] Chainlink’s "verifiable AI stack" introduces a layered architecture where off‑chain AI models produce outputs accompanied by cryptographic proofs, which are verified on‑chain by smart contracts before any state transition, enabling trust‑minimized consumption of AI inferences in DeFi and other on‑chain applications. web-cited
The verifiable AI stack combines artificial intelligence with cryptographic proofs and blockchain infrastructure. This framework allows smart contracts to securely consume AI outputs while guaranteeing the integrity of offchain model execution. This stack ensures that when an AI model makes an inference or generates data, the result can be mathematically verified onchain before triggering any smart contract state changes. The contract verifies the proof before executing any state changes.
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[4] Zero‑Knowledge Machine Learning (ZKML) systems can generate cryptographic proofs that a given output was produced by a specific computation on specific inputs without revealing either the inputs or model weights, making AI inference verifiable on‑chain—but these proofs attest only to computational correctness, not to the semantic truth of the AI’s answer. web-cited
Zero-Knowledge Machine Learning (ZKML) is an emerging technology that combines zero-knowledge proofs (ZKPs) with machine learning algorithms to enable privacy-preserving machine learning and verifiable AI models. A key capability of ZKML is to verify whether specific ML models are generated with particular content without exposing either the input data or the model itself.
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[5] Mastercard’s Agentic Token Framework and Agent Pay Acceptance Framework cryptographically register and verify AI agents before they can transact on its network, then assign each agent "agentic tokens"—dynamic, cryptographically secure credentials compatible with Web Bot Auth (based on IETF RFC 9421)—so merchants can authenticate AI agent traffic at scale. web-cited
Mastercard’s Agent Pay Acceptance Framework begins by registering and verifying AI agents before they are permitted to transact on the Mastercard network. Each agent is uniquely identified and then enabled to initiate transactions using agentic tokens - dynamic, cryptographically secure credentials that ensure every transaction is both traceable and authenticated. Web Bot Auth builds on the IETF RFC 9421 standard and offers a scalable, no-code approach to cryptographically verify agent identity.
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[6] The Linux Foundation’s Agentic AI Foundation (AAIF) standardizes agent infrastructure around three main technical artifacts: Anthropic’s Model Context Protocol (MCP) as a universal standard for connecting AI models to tools/data/apps; Block’s goose as an open‑source, local‑first agent framework with MCP‑based tool integration; and OpenAI’s AGENTS.md as a repository‑level spec that encodes project‑specific rules for AI coding agents. web-cited
MCP is the universal standard protocol for connecting AI models to tools, data and applications; goose is an open source, local-first AI agent framework that combines language models, extensible tools, and standardized MCP-based integration; AGENTS.md is a simple, universal standard that gives AI coding agents a consistent source of project-specific guidance needed to operate reliably across different repositories and toolchains.
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[7] IBM’s Agent Communication Protocol (ACP), developed under the Linux Foundation, defines RESTful HTTP interfaces for agent task invocation, lifecycle management, and synchronous/asynchronous messaging, and uses capability‑based security tokens for fine‑grained authorization across multi‑agent systems. web-cited
IBM’s open, vendor-neutral standard (under the Linux Foundation) for standardizing communication between AI agents. ACP defines RESTful, HTTP-based interfaces for task invocation, lifecycle management, and both synchronous/asynchronous messaging, leveraging capability-based security tokens for fine-grained authorization.
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[8] Virtuals Protocol has become a dominant crypto agent launchpad, enabling approximately 14,000 AI agent tokens to be deployed, each tied to on‑chain autonomous agents that hold their own tokens and execute strategies, contributing to a reported $5.01 billion market cap by early 2026. web-cited
Virtuals Protocol is the dominant agent launchpad with a $5.01 billion market cap as of early 2026. Virtuals has enabled the launch of approximately 14,000 AI agent tokens since inception. Anyone can deploy an agent on Virtuals, give it a persona and strategy, and issue a token tied to that agent's performance.
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[9] Composio’s Crypto‑Kit exposes exchange, wallet, and DeFi protocol integrations as tools for AI agents so developers can build task‑specific crypto agents (for trading, portfolio actions, governance, etc.) using a unified tool API rather than writing bespoke integrations for each protocol. web-cited
Composio Crypto-Kit | Build AI agents for Crypto use cases.
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[10] Contemporary AI development stacks increasingly rely on isolated "code sandbox" environments (from vendors like E2B, Daytona, Morph, Runloop, and Together) that allow AI coding agents to execute code and shell commands for analysis and debugging in hardened, repeatable environments, mitigating the risk of hallucinated or malicious actions on developers’ local systems. web-cited
Execution sandbox vendors such as E2B, Daytona, Morph, Runloop, and Together’s Code Sandbox address this need and have become critical components in the AI dev stack. Testing code and running simple command line tools for analysis and debugging is an important tool for agents. However, due to hallucinations or potential malicious context, executing code on local development systems carries risk.
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
Sources
- https://cloud.google.com/blog/products/ai-machine-learning/announcing-agents-to-payments-ap2-protocol
- https://minaprotocol.com/blog/minas-zkml-library-developer-guide
- https://chain.link/article/verifiable-ai-stack
- https://kudelskisecurity.com/modern-ciso-blog/zkml-verifiable-machine-learning-using-zero-knowledge-proof
- https://www.mastercard.com/us/en/news-and-trends/stories/2025/agentic-commerce-framework.html
- https://www.linuxfoundation.org/press/linux-foundation-announces-the-formation-of-the-agentic-ai-foundation
- https://www.ssonetwork.com/intelligent-automation/columns/ai-agent-protocols-10-modern-standards-shaping-the-agentic-era
- https://www.altrady.com/blog/cryptocurrency/ai-agents-in-crypto
- https://dev.to/composiodev/14-top-developer-tools-to-crack-web3-development-in-2025-5a5a
- https://a16z.com/the-trillion-dollar-ai-software-development-stack/