Stripe documented how an AI agent can send money with a single CLI call, stripe pay, that moves an instant transfer from a financial account to another business by its Stripe handle.
It's real money, not a simulation.
Stripe Treasury for agents is built around financial accounts, which are API-accessible accounts that hold funds inside Stripe. The pay command lists your eligible open accounts, and if more than one is eligible you must pass --financial-account fa_... . In an interactive terminal you can enter recipient, amount and currency at a prompt. With --agent or --json you must supply all three up front, for example stripe pay @recipient 10.00 usd --agent, and Stripe says the command returns confirmation_required first so nothing moves until you confirm.
That review is the security boundary. Stripe says to run stripe whoami to verify the authenticated account, then check the returned source account, recipient, amount, currency, fee, delivery timing, internal note and memo. Only then do you rerun the exact command with --yes and an explicit --financial-account. If policy demands it, the result is approval_required. Stripe then either gives you an approval_url plus a next_step.command to run after a human approves, or an approvals_dashboard_url where the team must approve in the dashboard before Stripe sends the transfer automatically.
Approvals are not pollable and they expire fast. A resume command checks once, and if the request is still pending you must wait. Resumable approvals expire after 5 minutes, and a rejected or expired request cannot be reused with --approval-id. You must start over from the review step. To test without risk, Stripe provides --dry-run, which resolves the profile, account, recipient and rail but creates no profile, approval or payment. Even a dry run needs --yes to finish validation.
Stripe today announced Stripe Treasury for agents, giving startups a faster, more informed way to manage financial operations with agents, including ChatGPT and Claude, per its newsroom announcement. That launch frames stripe pay as the execution layer for agent-driven treasury.
The impact lands on teams deploying agents with money movement. You must add a human confirmation gate, route the approval_url into Slack or the dashboard, and pin the source fa_... and supported currencies usd, gbp and usdc in code. An agent can't invent a handle or switch accounts without failing validation. The attacker requirement stays local. Without a valid stripe login session, the command fails authentication, so remote abuse hinges on stealing CLI credentials, not on hitting an open endpoint.
The guardrails Stripe discloses are narrow but explicit. Internal notes are limited to 50 ASCII characters and memos to 22, and agent mode will not move funds silently. Watch for who can click the approval link and how you enforce that second --yes in automation.
