SoK: Security of Autonomous LLM Agents in Agentic Commerce

• URL: http://arxiv.org/abs/2604.15367v1
• Date: Wed, 15 Apr 2026 01:55:40 GMT
• Title: SoK: Security of Autonomous LLM Agents in Agentic Commerce
• Abstract summary: This paper develops a unified security framework for autonomous LLM agents in commerce and finance.<n>We organize threats along five dimensions: agent integrity, transaction authorization, inter-agent trust, market manipulation, and regulatory compliance.<n>We propose a layered defense architecture addressing authorization gaps left by current agent-payment protocols.
• Score: 17.16390433047924
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Autonomous large language model (LLM) agents such as OpenClaw are pushing agentic commerce from human-supervised assistance toward machine actors that can negotiate, purchase services, manage digital assets, and execute transactions across on-chain and off-chain environments. Protocols such as the Trustless Agents standard (ERC-8004), Agent Payments Protocol (AP2), the HTTP 402-based payment protocol (x402), Agent Commerce Protocol (ACP), the Agentic Commerce standard (ERC-8183), and Machine Payments Protocol (MPP) enable this transition, but they also create an attack surface that existing security frameworks do not capture well. This Systematization of Knowledge (SoK) develops a unified security framework for autonomous LLM agents in commerce and finance. We organize threats along five dimensions: agent integrity, transaction authorization, inter-agent trust, market manipulation, and regulatory compliance. From a systematically curated public corpus of academic papers, protocol documents, industry reports, and incident evidence, we derive 12 cross-layer attack vectors and show how failures propagate from reasoning and tooling layers into custody, settlement, market harm, and compliance exposure. We then propose a layered defense architecture addressing authorization gaps left by current agent-payment protocols. Overall, our analysis shows that securing agentic commerce is inherently a cross-layer problem that requires coordinated controls across LLM safety, protocol design, identity, market structure, and regulation. We conclude with a research roadmap and a benchmark agenda for secure autonomous commerce.

Related papers

• A Formal Analysis of Agent Payment Protocols [21.91506763477032]
  Agent payment protocols are emerging as a key transaction layer for autonomous commerce.<n>We formalize four representative agent payment protocols: x402, MPP, ACP, and AP2 in Tamarin.<n>We use source-backed verification questions and counterexample traces to expose missing bindings, state constraints, and cross-stage correspondences.
  arXiv  Detail & Related papers  (2026-08-30T14:04:15Z)
• Poisoning Agentic Alpha: Adversarial Vulnerabilities Across Roles and Architectures in Multi-Agent Trading Systems [103.90831279037094]
  LLM-based multi-agent trading systems are moving rapidly from research prototypes to live deployments that control real assets.<n>A corrupted signal can propagate to the final decision and translate into realized financial loss.<n>We present the first systematic empirical study in the financial domain to characterize how an adversarial signal enters a multi-agent trading system.
  arXiv  Detail & Related papers  (2026-08-25T05:07:37Z)
• Beyond the Mandate: A Systematic Security Analysis of the Agent Payments Protocol (AP2) [13.020998549537874]
  AP2 enables large language model (LLM)-driven shopping agents to authorize and execute payments on behalf of users.<n>Prior work identified replay and prompt-injection attacks in AP2 v0.1.<n>We present a systematic security analysis of AP2 v0.2 based on its roles, transaction lifecycle, deployment architectures, and trust boundaries.
  arXiv  Detail & Related papers  (2026-08-24T22:05:00Z)
• Blockchain Empowered Trustworthy Agent Networks: Foundations, Taxonomy, and Future Directions [47.65093774088672]
  This survey and tutorial article reviews the literature over the period 1980--2026 on the evolution from classical multi-agent systems to open agent networks.<n>We first review this evolution and show how the trust boundary expands from individual execution to cross-agent, cross-platform, and cross-organizational interaction.<n>We develop a five-dimensional taxonomy covering entity and capability trust, authorization and delegation trust, information and trust, coordination and group-robustness trust, and accountability and settlement trust.
  arXiv  Detail & Related papers  (2026-08-05T09:32:35Z)
• When HTTP 402 Meets the Blockchain: Risks on Emerging x402 Payments [53.795332613020946]
  x402 is an emerging payment protocol for Web APIs and autonomous AI agents.<n>We present the first systematic study of authorization correctness and execution safety in current facilitator-mediated x402 deployments in the wild.<n>We derive four new attack vectors, including Free Shopping, Asset Theft, Service Denial, and Gas Abuse.
  arXiv  Detail & Related papers  (2026-07-21T19:45:13Z)
• Foundation Protocol: A Coordination Layer for Agentic Society [78.01727114524464]
  Foundation Protocol (FP) is a graph-first coordination layer for an emerging human-AI society.<n>FP unifies heterogeneous entities, including agents, tools, resources, humans, institutions, and organizations.<n>The aim is to keep autonomous agency composable while keeping accountability non-negotiable.
  arXiv  Detail & Related papers  (2026-05-22T04:20:35Z)
• When Agents Handle Secrets: A Survey of Confidential Computing for Agentic AI [6.1511441479993225]
  Agentic AI systems that plan, invoke tools, maintain persistent memory, and delegate tasks to peer agents introduce a threat surface that differs materially from standalone model inference.<n> Confidential computing offers a hardware-rooted alternative: Trusted Execution Environments (TEEs) isolate agent code and data from privileged system software.<n>This survey synthesizes the design space in four parts: (i) a unified taxonomy of six TEE platforms covering deployment roles and performance tradeoffs; (ii) an agent-centric threat model spanning perception, planning, memory, action, and coordination layers mapped to nine security goals; (iii) a comparative survey of CC
  arXiv  Detail & Related papers  (2026-05-04T23:09:16Z)
• OMNI-LEAK: Orchestrator Multi-Agent Network Induced Data Leakage [59.3826294523924]
  We investigate the security vulnerabilities of a popular multi-agent pattern known as the orchestrator setup.<n>We report the susceptibility of frontier models to different categories of attacks, finding that both reasoning and non-reasoning models are vulnerable.
  arXiv  Detail & Related papers  (2026-02-13T21:32:32Z)
• AgentDoG: A Diagnostic Guardrail Framework for AI Agent Safety and Security [126.49733412191416]
  Current guardrail models lack agentic risk awareness and transparency in risk diagnosis.<n>We propose a unified three-dimensional taxonomy that categorizes agentic risks by their source (where), failure mode (how), and consequence (what)<n>We introduce a new fine-grained agentic safety benchmark (ATBench) and a Diagnostic Guardrail framework for agent safety and security (AgentDoG)
  arXiv  Detail & Related papers  (2026-01-26T13:45:41Z)
• Towards Verifiably Safe Tool Use for LLM Agents [53.55621104327779]
  Large language model (LLM)-based AI agents extend capabilities by enabling access to tools such as data sources, APIs, search engines, code sandboxes, and even other agents.<n>LLMs may invoke unintended tool interactions and introduce risks, such as leaking sensitive data or overwriting critical records.<n>Current approaches to mitigate these risks, such as model-based safeguards, enhance agents' reliability but cannot guarantee system safety.
  arXiv  Detail & Related papers  (2026-01-12T21:31:38Z)
• Inter-Agent Trust Models: A Comparative Study of Brief, Claim, Proof, Stake, Reputation and Constraint in Agentic Web Protocol Design-A2A, AP2, ERC-8004, and Beyond [1.5755923640031846]
  We study trust models in inter-agent protocol design.<n>We analyze assumptions, attack surfaces, and design trade-offs.<n>We distill actionable design guidelines for safer, interoperable, and scalable agent economies.
  arXiv  Detail & Related papers  (2025-11-05T12:50:06Z)
• When Agents Trade: Live Multi-Market Trading Benchmark for LLM Agents [74.55061622246824]
  Agent Market Arena (AMA) is the first lifelong, real-time benchmark for evaluating Large Language Model (LLM)-based trading agents.<n>AMA integrates verified trading data, expert-checked news, and diverse agent architectures within a unified trading framework.<n>It evaluates agents across GPT-4o, GPT-4.1, Claude-3.5-haiku, Claude-sonnet-4, and Gemini-2.0-flash.
  arXiv  Detail & Related papers  (2025-10-13T17:54:09Z)
• Towards Unifying Quantitative Security Benchmarking for Multi Agent Systems [0.0]
  Evolving AI systems increasingly deploy multi-agent architectures where autonomous agents collaborate, share information, and delegate tasks through developing protocols.<n>One such risk is a cascading risk: a breach in one agent can cascade through the system, compromising others by exploiting inter-agent trust.<n>In an ACI attack, a malicious input or tool exploit injected at one agent leads to cascading compromises and amplified downstream effects across agents that trust its outputs.
  arXiv  Detail & Related papers  (2025-07-23T13:51:28Z)
• The Trust Fabric: Decentralized Interoperability and Economic Coordination for the Agentic Web [7.430263678657935]
  fragmentation of AI agent ecosystems has created urgent demands for interoperability, trust, and economic coordination.<n>We present the Nanda Unified Architecture, a decentralized framework built around three core innovations.<n>System introduces X42/H42 micropayments for economic coordination and MAESTRO, a security framework incorporating Synergetics' patented AgentTalk protocol.
  arXiv  Detail & Related papers  (2025-07-10T16:33:06Z)
• LLM Agents Should Employ Security Principles [60.03651084139836]
  This paper argues that the well-established design principles in information security should be employed when deploying Large Language Model (LLM) agents at scale.<n>We introduce AgentSandbox, a conceptual framework embedding these security principles to provide safeguards throughout an agent's life-cycle.
  arXiv  Detail & Related papers  (2025-05-29T21:39:08Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.