Beyond the Mandate: A Systematic Security Analysis of the Agent Payments Protocol (AP2)

• URL: http://arxiv.org/abs/2608.23858v1
• Date: Mon, 24 Aug 2026 22:05:00 GMT
• Title: Beyond the Mandate: A Systematic Security Analysis of the Agent Payments Protocol (AP2)
• Abstract summary: AP2 enables large language model (LLM)-driven shopping agents to authorize and execute payments on behalf of users.<n>Prior work identified replay and prompt-injection attacks in AP2 v0.1.<n>We present a systematic security analysis of AP2 v0.2 based on its roles, transaction lifecycle, deployment architectures, and trust boundaries.
• Score: 13.020998549537874
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: The Agent Payments Protocol (AP2), introduced by Google, enables large language model (LLM)-driven shopping agents to authorize and execute payments on behalf of users. Its signed Checkout and Payment Mandates protect the integrity of transaction data after signing. Agent interactions and external inputs that shape a transaction before authorization remain outside that protection, including Agent-to-Agent Protocol (A2A) messages and Model Context Protocol (MCP) tool calls. Prior work identified replay and prompt-injection attacks in AP2 v0.1. AP2 v0.2 addresses some of these issues but adds capabilities and deployment assumptions that require renewed analysis. We present a systematic security analysis of AP2 v0.2 based on its roles, transaction lifecycle, deployment architectures, and trust boundaries. We divide the lifecycle into five phases and identify five deployment architectures. Using MAESTRO (Multi-Agent Environment, Security, Threat, Risk, Outcome), we model four threat actors, eleven attack surfaces, eighteen adversary capabilities, and six attacker goals. The resulting catalog contains 48 threats spanning five attack families. We score these threats with the Artificial Intelligence Vulnerability Scoring System (AIVSS), identifying eight that reach the High band in at least one architecture. Because no complete public AP2 deployment was available, we build a testbed spanning all five architectures and develop five proof-of-concept demonstrations covering all eight High-risk threats and their mitigations. We also develop a deployment-aware scanner that maps applicable threats to static, cross-role consistency, and adversarial checks. Our analysis shows that valid mandate signatures alone do not ensure that an agent-mediated transaction reflects the user's intent when its pre-authorization context is manipulated.

Related papers

• Delegation Without Trust: An Empirical Gap Analysis of Identity, Authorization, and Runtime Governance in Multi-Agent LLM Systems [0.0]
  We present a threat model for multi-agent delegation centered on four adversaries.<n>We show a default runtime modeling common practice fails all four threats.<n>We implement and adversarially evaluate an authorization broker that closes the gap.
  arXiv  Detail & Related papers  (2026-08-31T19:09:34Z)
• Poisoning Agentic Alpha: Adversarial Vulnerabilities Across Roles and Architectures in Multi-Agent Trading Systems [103.90831279037094]
  LLM-based multi-agent trading systems are moving rapidly from research prototypes to live deployments that control real assets.<n>A corrupted signal can propagate to the final decision and translate into realized financial loss.<n>We present the first systematic empirical study in the financial domain to characterize how an adversarial signal enters a multi-agent trading system.
  arXiv  Detail & Related papers  (2026-08-25T05:07:37Z)
• SecRespond: Benchmarking AI Agents for Real-World Post-Compromise Incident Response [38.89333299127352]
  We introduce SecRespond, the first benchmark for evaluating Large Language Model (LLM) agents on the post-compromise incident-response workflow.<n>We instantiate this task across 10 cyber ranges, each constructed from a distinct compromised cloud host.<n> Experimental results show that although current agents can reliably uncover the problems exposed by alerts, they struggle to proactively investigate the disk for silent intrusions.
  arXiv  Detail & Related papers  (2026-07-29T11:32:23Z)
• A New Framework for Cybersecurity Refusals in AI Agents [52.94784168139071]
  We present the first framework for establishing refusal boundaries in offensive security contexts.<n>We apply this framework to assess how current LLM-powered agents adhere to appropriate refusal boundaries across a range of web-based offensive security scenarios.
  arXiv  Detail & Related papers  (2026-05-31T15:39:39Z)
• Caging the Agents: A Zero Trust Security Architecture for Autonomous AI in Healthcare [0.0]
  This paper presents a security architecture deployed for nine autonomous AI agents in production at a healthcare technology company.<n>We develop a six-domain threat model for agentic AI in healthcare covering credential exposure, execution capability abuse, network egress exfiltration, prompt integrity failures, database access risks, and fleet configuration drift.<n>All configurations, audit tooling, and the prompt integrity framework are released as open source.
  arXiv  Detail & Related papers  (2026-03-18T06:54:47Z)
• Whispers of Wealth: Red-Teaming Google's Agent Payments Protocol via Prompt Injection [0.0]
  Large language model (LLM) based agents are increasingly used to automate financial transactions.<n>Their reliance on contextual reasoning exposes payment systems to prompt-driven manipulation.<n>Agent Payments Protocol (AP2) aims to secure agent-led purchases through cryptographically verifiable mandates.
  arXiv  Detail & Related papers  (2026-01-30T05:10:16Z)
• Cuckoo Attack: Stealthy and Persistent Attacks Against AI-IDE [64.47951172662745]
  Cuckoo Attack is a novel attack that achieves stealthy and persistent command execution by embedding malicious payloads into configuration files.<n>We formalize our attack paradigm into two stages, including initial infection and persistence.<n>We contribute seven actionable checkpoints for vendors to evaluate their product security.
  arXiv  Detail & Related papers  (2025-09-19T04:10:52Z)
• BlockA2A: Towards Secure and Verifiable Agent-to-Agent Interoperability [8.539128225018489]
  BlockA2A is a unified multi-agent trust framework for agent-to-agent interoperability.<n>It eliminates centralized trust bottlenecks, ensures message authenticity and execution integrity, and guarantees accountability across agent interactions.<n>It neutralizes attacks through real-time mechanisms, including Byzantine agent flagging, reactive execution halting, and instant permission revocation.
  arXiv  Detail & Related papers  (2025-08-02T11:59:21Z)
• Security Challenges in AI Agent Deployment: Insights from a Large Scale Public Competition [101.86739402748995]
  We run the largest public red-teaming competition to date, targeting 22 frontier AI agents across 44 realistic deployment scenarios.<n>We build the Agent Red Teaming benchmark and evaluate it across 19 state-of-the-art models.<n>Our findings highlight critical and persistent vulnerabilities in today's AI agents.
  arXiv  Detail & Related papers  (2025-07-28T05:13:04Z)
• OpenAgentSafety: A Comprehensive Framework for Evaluating Real-World AI Agent Safety [58.201189860217724]
  We introduce OpenAgentSafety, a comprehensive framework for evaluating agent behavior across eight critical risk categories.<n>Unlike prior work, our framework evaluates agents that interact with real tools, including web browsers, code execution environments, file systems, bash shells, and messaging platforms.<n>It combines rule-based analysis with LLM-as-judge assessments to detect both overt and subtle unsafe behaviors.
  arXiv  Detail & Related papers  (2025-07-08T16:18:54Z)
• DoomArena: A framework for Testing AI Agents Against Evolving Security Threats [81.73540246946015]
  We present DoomArena, a security evaluation framework for AI agents.<n>It is a plug-in framework and integrates easily into realistic agentic frameworks.<n>It is modular and decouples the development of attacks from details of the environment in which the agent is deployed.
  arXiv  Detail & Related papers  (2025-04-18T20:36:10Z)
• On the Resilience of LLM-Based Multi-Agent Collaboration with Faulty Agents [58.79302663733703]
  Large language model-based multi-agent systems have shown great abilities across various tasks due to the collaboration of expert agents.<n>The impact of clumsy or even malicious agents--those who frequently make errors in their tasks--on the overall performance of the system remains underexplored.<n>This paper investigates what is the resilience of various system structures under faulty agents on different downstream tasks.
  arXiv  Detail & Related papers  (2024-08-02T03:25:20Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.