# Protocol-Level Attacks on Agentic Commerce Platforms: A Cross-Platform Taxonomy, AIP-Bench, and Unified Defense arXiv: https://arxiv.org/abs/2607.21824 ยท HTML: https://mlsanity.com/paper/2607.21824/ ## Key facts - Cited by 2 papers in the map (data through 14 Oct 2026). - Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. - Builds on 25 of its 32 references that are in the map. - First posted on arXiv 23 Jul 2026. ## Placed in - LLM agents and tool use / [Agent threats, guardrails and governance](https://mlsanity.com/agents/agent-threats-guardrails-and-governance/) ## Builds on (most cited first, 25 of 25) - [Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection](https://mlsanity.com/paper/2302.12173/) (2023) - [Are aligned neural networks adversarially aligned?](https://mlsanity.com/paper/2306.15447/) (2023) - [Prompt Injection Attack to Tool Selection in LLM Agents](https://mlsanity.com/paper/2504.19793/) (2025) - [Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale](https://mlsanity.com/paper/2601.10338/) (2026) - [The Attack and Defense Landscape of Agentic AI: A Comprehensive Survey](https://mlsanity.com/paper/2603.11088/) (2026) - [Formal Analysis and Supply Chain Security for Agentic AI Skills](https://mlsanity.com/paper/2603.00195/) (2026) - [Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guarantees](https://mlsanity.com/paper/2606.24322/) (2026) - [Before the Tool Call: Deterministic Pre-Action Authorization for Autonomous AI Agents](https://mlsanity.com/paper/2603.20953/) (2026) - [Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain](https://mlsanity.com/paper/2604.08407/) (2026) - [Coral Protocol: Open Infrastructure Connecting The Internet of Agents](https://mlsanity.com/paper/2505.00749/) (2025) - [Security Analysis of Agentic AI Communication Protocols: A Comparative Evaluation](https://mlsanity.com/paper/2511.03841/) (2025) - [SoK: Security of Autonomous LLM Agents in Agentic Commerce](https://mlsanity.com/paper/2604.15367/) (2026) - [Zero-Trust Runtime Verification for Agentic Payment Protocols: Mitigating Replay and Context-Binding Failures in AP2](https://mlsanity.com/paper/2602.06345/) (2026) - [A402: Binding Cryptocurrency Payments to Service Execution for Agentic Commerce](https://mlsanity.com/paper/2603.01179/) (2026) - [MCP-38: A Comprehensive Threat Taxonomy for Model Context Protocol Systems (v1.0)](https://mlsanity.com/paper/2603.18063/) (2026) - [AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization](https://mlsanity.com/paper/2604.24118/) (2026) - [Free-Riding the Agentic Web: A Systematic Security Analysis of x402 Payments](https://mlsanity.com/paper/2605.30998/) (2026) - [Fetch.ai: An Architecture for Modern Multi-Agent Systems](https://mlsanity.com/paper/2510.18699/) (2025) - [RAILS: Verification-Native Clearing For Agentic Commerce](https://mlsanity.com/paper/2606.08790/) (2026) - [Who Governs the Machine? A Machine Identity Governance Taxonomy (MIGT) for AI Systems Operating Across Enterprise and Geopolitical Boundaries](https://mlsanity.com/paper/2604.06148/) (2026) - [SUDP: Secret-Use Delegation Protocol for Agentic Systems](https://mlsanity.com/paper/2604.24920/) (2026) - [Give Them an Inch and They Will Take a Mile:Understanding and Measuring Caller Identity Confusion in MCP-Based AI Systems](https://mlsanity.com/paper/2603.07473/) (2026) - [Cryptographic Registry Provenance: Structural Defense Against Dependency Confusion in AI Package Ecosystems](https://mlsanity.com/paper/2605.03309/) (2026) - [Trust Without Trusting: A Recomputable Trust Protocol for Autonomous Agents](https://mlsanity.com/paper/2605.06738/) (2026) - [Infrastructure for the Agentic Web: Gap Analysis and Architecture from the Agentverse Platform](https://mlsanity.com/paper/2606.20570/) (2026) ## Built on by (most cited first, 2 of 2) - [A Formal Analysis of Agent Payment Protocols](https://mlsanity.com/paper/2609.00060/) (2026) - [Agent-Canary-Mas: End-to-End Evaluation of Protocol Risk in Long-Horizon Multi-Agent Systems](https://mlsanity.com/paper/2610.15529/) (2026) ## Abstract (arXiv) Agentic commerce platforms let AI agents autonomously discover services, move payments, and wield user credentials on their users' behalf, and they already handle real money. Their security has so far been studied almost entirely at the level of the AI model, through prompt injection and misalignment. We show that the more consequential risks lie one layer down, in the protocol between agents and commerce services. There, vulnerabilities are structural : exploitation is deterministic and ndependent of which model an agent runs, so no model improvement removes them. Across three leading platforms we identify 33 such vulnerabilities, each succeeding deterministically regardless of the deployed model, at a 100% attack-success rate (ASR) wherever live-measured. The same failure modes recur across independently built codebases, a systemic pattern rather than isolated bugs. Three of them chain into an end-to-end payment hijack. We contribute a taxonomy separating these structural attacks from model-dependent semantic ones. We also build two artifacts: AIP-Bench (Agent Interaction Protocol Benchmark), to our knowledge the first deterministic benchmark for agentic commerce security, and PCAT (Protocol-level Commerce Agent Trust), a platform-agnostic defense that drives the structural attack-success rate to zero for four of the five structural classes (RC-1, RC-2, RC-4, RC-5), with RC-3 (observable credential channels) reduced to warn-only, without modifying any platform. Agentic commerce must be secured at the protocol layer, not only the model.