How AI Agents Are Learning to Pay for Web Content

Bot traffic on the open web has already surpassed human traffic, and according to AWS senior solutions architect Anil Nadiminti, 95% of that bot traffic comes from AI agents. Publishers are sitting on an infrastructure problem with no clean exit: block the bots and lose discovery, citations, and licensing revenue; let them in and absorb the server costs while losing attribution for your content. Nadiminti's talk at the AI Engineer conference frames a third path, one where the agent pays its way through.

The math behind why this path hasn't existed yet is pretty stark. Credit card rails carry a 25-cent minimum transaction fee plus roughly 2.5% on top. When an agent is paying a tenth of a cent for a single API call, that floor runs about 250 times the cost of the thing being bought. You can't just bolt a Stripe checkout onto a microservice and call it agent commerce. The subscription model has the same problem: subscriptions assume a human who logs in and reads things. Agents don't browse. They query, extract, and move on, thousands of times per session.

HTTP 402, finally used for something

The x402 protocol is the piece of infrastructure trying to close that gap. HTTP status code 402 was reserved in the original spec for "Payment Required" and then sat unused for decades. Coinbase revived it in May 2025, and it now lives under open governance with the Linux Foundation, backed by AWS, Google, Stripe, Anthropic, Cloudflare, and Circle.

The flow Nadiminti describes works like this: an agent makes a request, the server responds with a 402, the agent resolves its payment method, sends authorization back, and the server uses a facilitator to verify and settle the transaction on-chain. Once settlement confirms, the content comes through. No API keys to set up, no subscription enrollment, no human in the middle. As Nadiminti puts it: "the payment is essentially the credential to be able to get the content."

The Coinbase agentic marketplace reported $50 million in transaction volume over 170 million transactions in the past 12 months, with an average settlement time of 200 milliseconds and cost per transaction at about a tenth of a cent. Those numbers suggest the protocol is moving real volume, though they come from a single source with an obvious stake in making x402 look viable.

What AWS built on top of it

AgentCore Payments, announced as part of the Amazon Bedrock AgentCore suite and detailed on the AWS blog, handles the buyer side. Agents can connect wallets from Coinbase or Stripe (the Stripe integration is currently in preview), and the service manages payment discovery, authorization, and settlement. Developers set a session budget programmatically: maximum spend, time window, expiry. An agent that gets a 402 response hands off to AgentCore Payments, which completes the transaction and signals back that access was granted.

Two security design choices stand out here. First, the wallet's private keys never touch the agent. They're stored in AWS Key Management Service and the agent simply cannot read them. Second, payment execution runs on a separate path from the agent loop. Nadiminti is direct about why: "skills can be poisoned, inputs for the agents can also be poisoned by inputs as well, so by decoupling and making this by design, agents can essentially have a secure path for these transactions."

The reasoning is that an agent loop is nondeterministic by nature. An LLM making multi-step decisions might behave unexpectedly given a crafted prompt. Running financial authorization through that same loop is a risk that AWS apparently decided not to take. Payment authorization lives on a deterministic path, separate from the reasoning engine. That architectural choice has implications beyond just preventing runaway spending; it also means the payment system can be audited independently of whatever the agent was doing.

The agent economy that's emerging around these payment layers doesn't stop at content access. Nadiminti notes that agent e-commerce today covers LLM inference, compute, web scraping, research search, and agent-to-agent transactions. MCP servers (Model Context Protocol, the standard for connecting agents to external tools) are being monetized through this infrastructure as well. AgentCore also includes a gateway service that lets organizations "MCPify" their internal APIs and expose them to paying agents, potentially from outside the organization.

The seller side has its own infrastructure

On the sell side, AWS is shipping something called WAF AI Traffic Monetization, built into AWS CloudFront via the Web Application Firewall layer. Publishers can start charging AI traffic without touching their origin servers or changing their SDKs. The WAF sits at the edge, classifies incoming bots, and routes payment.

The classification is more granular than a simple allow/block. AWS WAF currently identifies over 650 bot types, verifies them by cryptographic signature, and infers intent: is this bot here to scrape training data, or to answer a user query via RAG search? Nadiminti describes the pricing logic: "you have separate paths, so a slash blog can be charging a different rate than a slash research or maybe an API endpoint itself." Verified bots from known partners (say, a publisher that has a deal with Anthropic) get one price; unverified bots get another; training scrapers can be charged at a premium rate.

This is the part I find myself turning over. The ability to charge differently based on why a bot is there is a meaningful shift in how content licensing could work. A news organization charging Perplexity one rate for serving search answers and a different rate for OpenAI scraping training data is a pricing model that never existed before, mostly because publishers had no way to know what was happening on the other side of the HTTP request. Whether publishers will actually get that granular, and whether bot operators will play along with the verification layer, remains an open question.

What hasn't been answered yet

Nadiminti's framing is optimistic and AWS's interest in this infrastructure is obvious: they want to be the platform layer underneath agent commerce, the same way they became the infrastructure layer under web commerce. That's worth keeping in mind when evaluating the projected numbers (a billion agents by 2027, 60% enterprise adoption of agentic workflows).

There's also the publisher side of this that Nadiminti doesn't dwell on. A pricing model that lets a publisher charge training scrapers more than search bots sounds appealing, but it depends entirely on bots accurately identifying themselves and honoring the verification system. Bots that spoof signatures or misreport their intent would undermine the whole pricing model. The WAF's 650-bot taxonomy and signature verification is AWS's answer to that, but how well it holds up against adversarial bots operating outside the verified partner ecosystem is something that will get tested in production, not in a conference demo.

As The Next Web noted, the core problem is real regardless of which solution wins: agents can browse the web, but currently have no standard way to pay for it. x402, AgentCore Payments, and WAF monetization are one stack's answer to that. The protocol being under Linux Foundation governance means AWS doesn't own it even if they're building on top of it, which at least keeps the infrastructure from being a single company's proprietary chokepoint.

The subscription model was built for humans who make deliberate purchasing decisions. Agents make millions of micro-decisions per task. Either the payment infrastructure catches up to that reality, or the web continues to have a traffic problem with no revenue model attached to it.

Yuki Okonkwo, AI & Machine Learning Correspondent