Loading story…
World launched AgentKit, a developer toolkit that allows a verified human to cryptographically delegate their World ID to an AI agent so the agent can prove it is backed by a unique real person without disclosing that person’s identity. Reporting says the product is aimed at agentic commerce, where automated agents make purchases, bookings, or other transactions on a user’s behalf, and it integrates with Coinbase and Cloudflare’s x402 protocol to combine identity verification with payment workflows for AI agents.
The launch extends World’s original proof-of-human model into automated systems, but it also revives longstanding privacy and regulatory concerns tied to the company’s biometric data collection practices. Coverage notes that World, formerly Worldcoin, built its identity system through iris scans and has faced investigations, suspensions, and legal action in multiple jurisdictions, including findings in Kenya and Spain over unlawful or inadequate handling of biometric data. The reporting frames AgentKit as an attempt to solve trust and bot-abuse problems in AI-driven online activity, while highlighting that the company’s expansion into AI-agent identity will likely intensify scrutiny of how it collects, stores, and governs sensitive identity data.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
On March 17, 2026, World announced a limited beta of AgentKit, a developer toolkit that lets verified humans cryptographically delegate their World ID to AI agents. The system is designed to allow agents to prove they are backed by a unique real person without revealing that person's identity.
As the project expanded, regulators in multiple countries including Kenya and Spain took actions such as suspensions, investigations, and legal challenges tied to privacy and biometric data collection concerns. Coverage says these issues have affected at least ten countries.
The Defiant reported that activity by on-chain AI agents using ERC-8004 rose sharply from the start of 2026. This growth helped create the trust and accountability problems World says AgentKit is meant to address.
World's token launched in 2023 as part of the broader Worldcoin ecosystem. Later reporting noted the token had fallen substantially in value, contributing to the company's shift toward AI-related identity use cases.
World, then known as Worldcoin, launched in 2019 with a model centered on biometric identity verification and cryptocurrency. The project used iris-scanning hardware to verify unique human users.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
qz.com
Open sourcethedefiant.io
Open sourcego.theregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Major identity and access management vendors are introducing new platforms and making strategic acquisitions to address the security challenges posed by the rapid adoption of autonomous AI agents in enterprise environments. Ping Identity has launched "Identity for AI," a platform designed to register, manage, and monitor AI agents as non-human identities, providing features such as agent authentication, authorization, least-privilege enforcement, real-time monitoring, and threat detection. This solution aims to ensure accountability and compliance as organizations scale their use of agentic automation, with general availability expected in early 2026. Meanwhile, Twilio has acquired Stytch to develop an intelligent identity layer that verifies trust between humans and AI agents in real time. Additional industry developments include Nuggets' release of a privacy-preserving verification plugin for ElizaOS and Akeyless' expansion of its security suite with identity provider and privileged access management features tailored for AI agents. Industry leaders warn that unsecured AI agents could become a major source of enterprise breaches, highlighting the urgent need for robust identity and security controls as AI-driven automation becomes ubiquitous.
Jun 29, 2026
Cloudflare announced **Cloudflare Wallets**, a forthcoming service designed to let AI agents make payments for APIs, content, and online services using programmable digital wallets tied to Cloudflare accounts. The offering includes **Account Wallets** for individuals and organizations and **Virtual Wallets** for AI agents, alongside human-readable wallet identities through **`cloudflare.pay`** so websites and services can verify which person or organization an agent represents. The company said the wallets will include owner-defined guardrails such as spending caps, approved merchants, and transaction limits, aiming to let agents transact without requiring manual approval for every purchase. Cloudflare also said the service is built to work with its **x402-based Monetization Gateway** and support micropayments, allowing agents to buy low-cost services without creating separate accounts, while handle reservations are open ahead of broader availability in the coming months.
Aug 27, 2026
As commerce increasingly shifts from human-initiated transactions to autonomous, AI-driven interactions, the payments industry is developing new frameworks to ensure security, trust, and compliance. Industry leaders, including Mastercard and Checkout.com, are focusing on agentic payments that leverage tokenization, biometric authentication, and advanced data-sharing standards to address the unique challenges of machine-led transactions. These innovations aim to establish robust identity verification for AI agents, known as 'Know Your Agent' (KYA), to distinguish between trusted digital agents and malicious bots. Emerging protocols such as agent-to-agent (A2A) communication and new merchant API interfaces are being introduced to support secure interactions among developers, issuers, and acquirers. Mastercard’s Agent Pay model exemplifies the integration of tokenization, biometric authentication, and intent capture to provide transparency and user control. Enhanced intent-level data is expected to reduce fraud, chargebacks, and disputes, supporting compliance and trust in the evolving machine economy.
Jul 12, 2026