Attacks

Adversarial text placed in reviews, ratings, product metadata or product images redirects a shopping agent's behaviour.

3,168 runs across 12 objectives; no objective was reliably resisted.

Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking · arXiv · 2026-06-11

Dark patterns in a live storefront, such as targeted ads, redirects and manipulated shopping state, steer an autonomous agent with no injected instruction at all.

The paper finds prompt-level constraints insufficient against these.

Benchmarking Web Agent Safety under E-commerce Deceptive Interfaces · arXiv · 2026-04-26

Content returned by a tool carries instructions; the agent treats them as part of the task and acts on them.

ReAct-prompted GPT-4 was vulnerable in about a quarter of cases.

InjecAgent: Benchmarking Indirect Prompt Injections · arXiv

Hidden text in a Reddit comment drove an agentic browser to open the user's account page, extract their email, trigger a one-time code, read it from their mail and post both to the attacker.

Mitigation Separate user instructions from page content, check model output against user intent, confirm sensitive actions, isolate agentic browsing.

Indirect prompt injection in Perplexity Comet · Brave · 2025-08-20

Malicious instructions are placed in a tool's description at registration, where the agent reads them as trusted context.

45 live servers, 353 real tools, 20 agents; success rate up to 72.8%.

MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers · arXiv

An MCP server published fifteen clean versions, then added a line blind-copying every outgoing email to the author's domain.

Roughly 1,600 downloads before it was caught.

First malicious MCP server found stealing emails · The Hacker News · 2025-09-29

Coding tools start project-defined MCP servers automatically at developer privilege, so a repository can execute code by existing.

Mitigation Allowlist servers, treat MCP config changes as code review, scan tool descriptions, grant execution authority gradually.

MCP attack surface: tool poisoning and IDE auto-execution · Cloud Security Alliance Labs · 2026-07-01

A static client id plus dynamic registration lets an attacker register a redirect and collect an authorization code without the user ever seeing a consent screen.

Mitigation Per-client consent stored server side and checked before forwarding; exact redirect matching; single-use state.

MCP specification: security best practices · Model Context Protocol

A server accepts a token that was not issued to it and forwards it downstream, where it is trusted as validated.

Mitigation Servers must reject tokens not explicitly issued for them.

MCP specification: security best practices · Model Context Protocol

A cart id is handed back as an ordinary argument; if the server does not bind it to the caller, whoever holds it can read or change someone else's cart.

Mitigation Never treat possession of a handle as authentication; key state to the verified user id.

MCP specification: security best practices · Model Context Protocol

Four flaws in deployed integrations: a payment for one resource honoured for another, a settlement race, spend past the signed allowance, and blocked settlement after the content is served.

Resource leakage up to 100% against official SDKs and production deployments.

Mitigation The paper proposes a defence framework and reports responsible disclosure.

Free-Riding the Agentic Web · arXiv · 2026-05-29

A payment header reused where no nonce is kept; an observer consuming the authorisation first; intermediaries caching a paid response for unpaid clients.

Mitigation Mandatory nonce and timestamp, atomic binding of payment to resource, two-phase settlement, no-store caching, Sybil-resistant discovery.

Five Attacks on x402 · arXiv · 2026-05-12

A study of the facilitators handling almost all x402 traffic found free shopping, asset theft, denial of service and sponsor-paid gas abuse.

15 facilitators covering 99% of transactions; 49 rule violations, 31 previously unknown vulnerabilities; every facilitator violated at least one rule.

When HTTP 402 Meets the Blockchain · arXiv · USENIX Security 2026 · 2026-07-21

The mandate is signed, but the messages, tool results and catalogue data that produced it are not, so a valid signature can still carry a corrupted intent.

48 threats across 5 families and 11 attack surfaces; 8 rated high, each with a proof of concept.

Mitigation Per-threat mitigations plus a scanner that maps threats to a deployment.

Beyond the Mandate: A Systematic Security Analysis of AP2 · arXiv · 2026-08-24

A mandate is replayed, or applied in a context other than the one it was signed for.

Mitigation The spec binds mandates to a merchant-signed checkout by hash, treats the shopping agent itself as a potential attacker, and requires a non-deterministic signature scheme.

AP2 specification · AP2

Unsigned registry content, payment destination from an untrusted source, credentials in logs and URLs, non-atomic check-then-execute, authentication without scope enforcement, and poisoned agent descriptions.

33 vulnerabilities, all model-independent, at 100% success where measured live.

Mitigation A sidecar that removes four of the six classes without touching platform code.

Protocol-Level Attacks on Agentic Commerce Platforms · arXiv · 2026-07-23

Where per-message signing is optional, SDK deployments ship without it and inherit integrity and confidentiality flaws.

Mitigation Make per-message integrity mandatory rather than opt-in.

Security Analysis of Agentic AI Communication Protocols · arXiv · 2025-11-05

Hidden instructions on a deals page add gift cards to a cart mandate out of the buyer's view, or push an agent to skip shipping checks and issue refunds.

Presented as threat scenarios, not observed incidents.

Mitigation Mandates for authorisation and accountability, know-your-agent, reputation.

Who's really shopping? Retail fraud in the age of agentic AI · Unit 42, Palo Alto Networks · 2026-03-20

Order events accepted without a signature, or a checkout retried without an idempotency key, let an attacker forge or duplicate state.

Mitigation Both specs already require signatures, timestamps and idempotency keys; UCP mandates signed webhooks with published keys. The attack is the absence of what the specs ask for.

Agentic checkout specification · OpenAI

A payment token whose allowance, expiry or bindings are not enforced becomes reusable value in whoever's hands it lands in.

Mitigation Single use, maximum amount and currency, expiry, binding to merchant and checkout session, risk signals, signed requests.

Delegated payment specification · OpenAI

A fraudulent storefront passes automated checks and undercuts the market; once the agent checks out, the stored credentials are harvested.

Mitigation Agent identity and intent validation at transaction time, challenge flows, monitoring for sudden operational change.

Agentic commerce: threats and risks · Visa · 2025-11-20

A malicious server points metadata discovery at a cloud metadata address and the client hands over machine credentials.

Mitigation Require HTTPS, block private and link-local ranges, validate redirect targets.

MCP specification: security best practices · Model Context Protocol

Rewriting genuine products into fakes inside retrieved pages makes a model recommend products that do not exist.

One polluted page fooled models up to 27% of the time; replacing the top three results reached 73.8%.

Mitigation Credibility re-ranking was tested and removed only about a sixth of them.

One Polluted Page Is Enough · arXiv · EMNLP 2026 Findings · 2026-06-11

A prefilled prompt writes a persistent instruction into the assistant's long-term memory, biasing every later recommendation.

Mitigation Separate user instructions from external content, give users visible memory controls, hunt for prefilled memory-writing links.

Manipulating AI memory for profit · Microsoft Security · 2026-02-10

Bots masquerade as well-known agents by copying a user-agent string; where signatures are used, the next problem is replaying one.

Mitigation Signed requests with timestamp and nonce, uniqueness checks, short expiry, re-signing every request.

Securing agentic commerce · Cloudflare · 2025-10-24

Agent infrastructure allowed agent sessions to be created without strong authentication.

CVE-2026-30970 · NVD · 2026-03-10

An attacker drives transaction fees that the operator has agreed to sponsor, without buying anything.

Named the dominant practical risk in that study.

When HTTP 402 Meets the Blockchain · arXiv · USENIX Security 2026 · 2026-07-21

Injected context distorts the agent's sense of being finished, so it loops, burning tokens and paid calls on every pass.

Average 3.6× more steps, peaking above 20×.

LoopTrap: Termination Poisoning Attacks on LLM Agents · arXiv · 2026-05-07

One untrusted tool call plants an instruction in long-term memory that stays inert until the conversation turns to something worth stealing.

85–100% success against frontier models; payloads survived 100 benign sessions.

Mitigation Memory defences cut it to near zero, at a cost in usefulness.

Trojan Hippo: Weaponizing Agent Memory for Data Exfiltration · arXiv · 2026-05-03

An ordinary-looking email carried instructions in hidden markup; the assistant merged trusted and untrusted content and leaked data with no user action.

Rated 9.3 critical; fixed server side, with no evidence of exploitation.

CVE-2025-32711 (EchoLeak) · NVD · 2025-06-11