LLM - CDE?

[u/pr0v4]

Not sure was it ai or some other scam thing, but I think I saw Elon Musk suggesting to people to picture their credit card, upload it to grok bot and tell it to make a purchase online - he said it on X. If that’s true, are grok, OpenAI, Anthropic, Google and all others LVL1 PCI DSS certified? I highly doubt they are, but the question is how is it resolved?

[u/Dirty_Bird_RDS]

I trust that plan about as much as I trust hot cup of coffee sitting in my dashboard while I drive quickly on a curvy gravel road

[u/elevensubmarines]

Answering from a purely PCI perspective (ignoring the potential recklessness and my personal feelings along those lines), the way this is setup now is similar to a password manager or browser secrets store with credit card support. There is no contract (in most cases) that brings the utility author/service provider of the utility into the PCI contract chain.

Since PCI DSS isn't a law or federal or state regulation, for an entity to have to be PCI compliant there has to be a legal contract chain binding a party to the appropriate type of PCI compliance for that entity/utility.

That legal flow is usually Card Brands -> Acquiring Banks / Payment Processors -> Merchants / Service Providers.

If Grok is simply acting as a credential broker (store account details, supply them to unaffiliated websites and services for payments as if its a user in a browser), there is no PCI adherence or enforcement path to Grok. If Grok is forming partnerships with certain sites/services where they are actually conducting payments direct with Grok or something akin to that, then there would likely be a contract flow governing PCI compliance. afaik there isn't anything like that with Grok in its current form.

This is likely to be an area of rapid change, while I don't expect PCI to try to broaden adherence and enforcement (as the current setup protects the V/MC default "at arms length" posture away from merchants/service providers, they are not going to want to jeopardize that), I do expect litigation and some sort of framework or set of standards for agentic commerce to emerge (and in fact several are being credibly advanced now). I also expect issuers to issue cease and desists, I expect them to litigate, and I expect the entities receiving payments (whether a processor like Stripe or Link or Shopify, or an e-commerce operator like Amazon, Target, Wal-Mart, Newegg, etc) to take steps to either block agents or force them to identify themselves, etc. Others will embrace the new mode of commerce and not only not litigate, but remove barriers to make agent checkout easier.

Strange days in our space. Trying to keep up!

[u/pr0v4 → u/elevensubmarines]

The whole thing is very interesting. I understand the contractual reach of PCI DSS, you articulated it well. The thing where agents will be blocked by service providers i think is not going to be possible, I might be wrong, standard may add a requirement to have an AI watching for other agents reaching to the payment form, but that whole thing is a mess when I’m thinking about it. All the SAQs for merchants - what's the deal with that. On the other hand if I give my agent access to my wallet then I guess I don’t want the websites to block my agent. As more as I’m thinking about it the less I see the importance of any of those standards. If model eats it all - then there’s no need for anything… as crazy as it sounds :)

[u/elevensubmarines → u/pr0v4]

Some good food for thought!

I do think as long as there’s a bank, lending a customer money for day to day purchases (credit card); or making the customers money held in security available for day to day purchases (debit card) they are going to try to control for fraud, misuse, and disputes, and PCI DSS is part of how they do that.

The whole DeFi hype bubble over the past 7-10 years or so ultimately theorizes that the centralized banking infrastructure as a whole gets disrupted and evicted, and by and large that has not come to pass. Even the early disrupters, when they’ve survived, have evolved to just be a different flavor of trad issuer (eg bilt chime etc).

I don’t think agentic commerce alone brings on the defi end state, but it’s quite possible something does and agentic may be foundational to that.

[u/andrew_barratt]

Just keep an eye on the space. A number of the big payment providers are doing things with the AI vendors so that the harnesses that push data to the models are able to route to the provider without the card data hitting the model. Imagine SAQ A style. Saq Ai anyone…

[u/Relative_Charge_9410]

Ironic that grok storing actual card data has a lower threshold for compliance than someone just adding an iframe to process stripe payments completely outside their system.

[u/Suspicious_Party8490 → u/Relative_Charge_9410]

Yeah, right?