Mastercard scores 175 billion transactions per year in under 100 milliseconds. For decades, that scoring system was built to block bots. Greg Ulrich, the company's chief AI and data officer, told the VB Transform 2026 audience on July 14 that the entire risk framework now has to invert: agents are becoming legitimate buyers, and the rules written to stop automated activity are the same rules that will strangle agentic commerce. Generative AI already lets Mastercard detect 300 to 400 percent more fraud at high-risk transaction bands without adding friction. Its Safety Net system has stopped more than 70 billion fraudulent transactions. A third of the company's services business, which itself represents 40 percent of total revenue, runs on AI and is growing faster than everything else.
The fix Ulrich described is a five-layer stack: identity verification extended to agents through a 'know your agent' framework, cryptographic verifiable intent that travels with each transaction as a tamper-proof record of the original instructions, merchant and spending controls, execution through Mastercard Agent Pay, already live with Microsoft, OpenAI, and Google, and an intelligence layer that includes Recorded Future for threat actor monitoring. The verifiable intent layer is worth reading closely. It solves a concrete problem: if an agent buys non-returnable shoes that do not match the original instructions, the cryptographic record settles the dispute. That same architecture scales to B2B procurement, where a manufacturer's agent, a supplier's agent, and a banking agent all have to exchange trust signals autonomously.
Ulrich also disclosed that Mastercard participated in early access to Anthropic's Mythos model through Project Glasswing and worked with OpenAI's GPT-5.5-Cyber. His assessment was blunt: powerful new models find previously undetectable vulnerabilities, but the security motion stays the same. His three lessons from 14 months of production agentic work are equally direct: embed guardrails at the front end, build for scale from day one, and treat observability and accountability as non-negotiable. The full session transcript shows how those principles connect to the multi-party trust infrastructure Mastercard is now building for others to use.
[READ ORIGINAL →]