The agentic commerce industry has spent two years standardizing the money layer. Google’s Agent Payments Protocol, AP2, announced in September 2025, extended to v0.2 in April 2026 with autonomous Human-Not-Present flows, and handed to the FIDO Alliance for standards development, is the clearest expression of that effort: a chain of cryptographically signed mandates that lets an AI shopping agent assemble a cart and execute a payment while producing non-repudiable proof of what the user authorized. Visa, Mastercard, and major processors have aligned around it. On paper, it is the most rigorous answer anyone has offered to the question that has haunted agent commerce since the beginning: how do you trust a purchase nobody clicked?

On August 24, 2026, a paper landed on arXiv that reads like the industry’s first serious audit of its own answer. Avital Aviv, Parth A. Gandh, Ron Bitton, and Asaf Shabtai, of Ben-Gurion University of the Negev and Intuit, published “Beyond the Mandate: A Systematic Security Analysis of the Agent Payments Protocol (AP2),” and their conclusion should reorganize how everyone building shopping agents thinks about trust.

The numbers first. The team decomposed the AP2 transaction lifecycle into five analytical phases and identified five deployment architectures. Using the MAESTRO threat-modeling framework, they modeled four threat actors, eleven attack surfaces, and six attacker goals. The resulting catalog contains 48 threats grouped into five attack families, scored with OWASP’s AI Vulnerability Scoring System. Eight threats reach the High band in at least one architecture. Because no complete public AP2 deployment existed, the researchers built a testbed spanning all five architectures and wrote five proof-of-concept attacks that together cover all eight high-risk threats. They validated their catalog against an independent STRIDE-GPT analysis, ran an eight-expert reproducibility study on the severity scoring, and shipped a scanner implementers can run against their own deployments.

That is a serious body of work. And its central finding is one sentence long: “valid mandate signatures alone do not ensure that an agent-mediated transaction reflects the user’s intent when its pre-authorization context is manipulated.”

How AP2 Works, and Where Its Guarantee Ends

AP2’s design is genuinely elegant. Five roles participate: the Shopping Agent that browses and assembles the cart, the Merchant, the Credential Provider that issues scoped payment credentials, the Merchant Payment Processor that settles, and the Trusted Surface that renders the mandate to the user and captures consent. Authorization is encoded in two artifacts, the Checkout Mandate and the Payment Mandate, implemented as Selective Disclosure JSON Web Tokens. A hash of the merchant-signed checkout is embedded in both, so a payment mandate cannot be applied to a different cart. In Human-Present mode the user approves each closed mandate through the Trusted Surface. In Human-Not-Present mode, new in v0.2, the user signs open mandates capturing constraints before leaving the session, and the agent later derives and signs closed mandates itself, within those constraints.

The protocol’s stated philosophy is “Verifiable Intent, Not Inferred Action”: trust is anchored to deterministic, non-repudiable proof of intent rather than to what the model seemed to want to do. Against the classic payment threats, this works. Replay a mandate, it fails hash binding. Tamper with the cart after signing, the hash mismatches. Forge authorization, you break the signature.

The audit’s point is about everything upstream of that machinery. As the paper puts it, “AP2 mainly secures the signed mandates and receipts; the pre-signing context that shapes them, including catalog data, tool results and A2A messages, remains outside the signed mandates.” The checkout_hash binds the mandate to the exact bytes of the cart. It says nothing about whether the cart deserves to exist. If the agent’s context was poisoned before cart assembly, the protocol will faithfully, verifiably, irreversibly execute a manipulated decision. Signed garbage is still garbage.

The specification itself acknowledges the exposure: it treats every LLM-driven agentic role as a potential attacker. What it lacked, until now, was a systematic map of what that exposure amounts to in practice.

The Five Attack Families, and the One That Should Worry Product People Most

The researchers organized the 48 threats by the security object each corrupts. The taxonomy is worth understanding because it shows precisely where the protocol’s guarantees stop.

F1: Semantic Manipulation (10 threats). The largest family aimed at the decision itself: attacks that cause the agent to accept, construct, or execute mandates whose effective meaning differs from the user’s intent. The sub-families read like a menu of the modern agent stack. Context poisoning arrives through catalog content, A2A replies, retrieval corpora, or cross-zone tool-result fan-out, and under shared MCP infrastructure the same fan-out both injects content and leaks transaction state. MCP metadata poisoning exploits the fact that tool descriptions persist and carry high instruction weight. Mandate-content divergence includes an over-broad mandate the agent filled in on its own, a user-facing summary that differs from the signed fields, and a selective-disclosure split where one value is shown to the user and a different signed value is consumed by the verifier. The flagship threat here, T-1 pre-signing context poisoning, carries a CVSS base score of 8.3 and an AIVSS score of 7.2, solidly in the High band.

F2: Authority Spoofing (9 threats). Making verifiers attribute a mandate to the wrong signing authority: exfiltrated signing keys, unscoped key identifiers, sub-agent attestation gaps, and consent-surface hijacking where the user approves a decoy while the real mandate signs underneath.

F3: Supply-Chain and Trust-Root Subversion (13 threats, the largest family). Forcing the system to trust illegitimate dependencies: compromised builds, malicious MCP server images, unverified model substitution, and, notably, AgentCards that are unsigned by spec and can be tampered with at origin, in transit, or in cache. Discovery itself, the moment an agent decides whom to trust, is unguarded.

F4: State-Binding Failures (9 threats). Breaking the link between what was authorized and what is consumed: mandate replay and fan-out (CVSS 8.9), cart mutation between user review and signing, races in shared MCP state, and unsigned risk-data fields that can bias fraud decisions.

F5: Accountability Failures (7 threats). Hiding who is actually responsible: marketplace fronting, where a single visible merchant identity conceals the sub-merchant that shaped the transaction, and multi-tenant isolation failures at payment platforms.

Two structural findings deserve emphasis. First, risk is architecture-dependent: the single-agent baseline is dominated by trust-root and state-binding threats, while the shared-MCP architecture amplifies the largest number of semantic manipulation threats. The industry is visibly converging on shared MCP infrastructure, which means it is converging on the architecture where context poisoning is most dangerous. Second, the independent STRIDE-GPT comparison covered only 32 of the 48 catalog threats. A third of the threat surface was invisible to a standard structured methodology, which tells you how novel the agentic attack surface really is.

The Attacker’s Arithmetic

Step back from the taxonomy and look at the economics, because that is where the audit’s implication becomes concrete for anyone building or operating shopping agents.

Forging an AP2 mandate requires defeating SD-JWT signatures, hash binding, and key anchoring. Poisoning the agent’s context requires writing a good product description. The paper’s own prior-work section cites a red-team study of AP2 v0.1, “Whispers of Wealth,” in which prompt injection through malicious content manipulated product rankings and leaked user data despite fully valid signed mandates. Nobody broke a key. The catalog did the work.

This inverts the security model the payments industry is used to. In card fraud, the asset is the credential, and everything else is context. In agent commerce, the credential is becoming the hardest thing to steal, and the context is the cheapest thing to corrupt. The product information layer, star ratings, review counts, “best seller” badges, sponsored placement, seller claims, tool outputs that summarize them, is simultaneously the richest attack surface and the least defended. An attacker who can bias which seven products an agent considers never needs to touch the mandate for the seventh one; the agent will sign it itself, and every verifier in the chain will confirm the signature is perfect.

Yesterday’s FTC lawsuit against Amazon over alleged shill bidding in its ad auctions is the human-scale version of the same lesson: the marketplace’s presentation of itself is the output of mechanisms with interests. The AP2 audit shows that agentic payments, as currently specified, cryptographically certify the checkout while treating that presentation as trusted input.

Consumers Already Priced This In

If the engineering argument feels abstract, the consumer data is not. ACI Worldwide’s June 2026 survey, conducted by YouGov among 2,080 UK adults, found that just 19 percent trust AI assistants to make everyday purchasing decisions, against 55 percent who trust a human adviser. Sixty percent would stop using an AI shopping agent after a single mistake. Sixty-nine percent do not trust AI even when it follows rules they set. Only 17 percent trust agents to keep personal and payment data secure, and 59 percent say they would not trust any organization, bank, tech company, or retailer, to manage AI-powered shopping and payments. Adriana Iordan, ACI’s head of merchant and payments intelligence, framed it precisely: “This isn’t a capability gap; it’s a trust and confidence gap. If the industry wants adoption, it must prioritise control over capability.”

Forrester’s mid-2026 assessment agrees on the shape of the market: most agentic experiences are still conversational, true autonomy is rare, and the firms that will win are those building what Forrester calls machine advantage, structured, comprehensive, trustworthy signals that agents can rely on, plus engagement with emerging standards for trust, identity, and payments. The analysts’ phrase for the requirement is worth repeating: increasing context, fluency, and trust in each interaction with an AI agent.

Read against the BGU-Intuit audit, the consumer instinct and the analyst recommendation converge on the same gap. The payments protocol certifies authorization. Nothing in the stack certifies the inputs to the decision. Consumers say they will abandon an agent after one bad purchase. The audit documents forty-eight ways an adversary can arrange that bad purchase without ever touching a key.

Closing the Gap Between Transaction Security and Decision Security

The fix is not to abandon AP2; the mandate chain is the right foundation for what it covers, and the FIDO Alliance’s stewardship is a genuine step toward standards-grade rigor. The paper’s own mitigations and scanner point the way for implementers: per-request authorization on MCP tools, typed policy objects instead of open schema boundaries, cross-role consistency checks that catch when two roles sign or verify semantically different objects for the “same” transaction. Those should be table stakes.

But protocol hardening only defends the boundary of the signed artifact. The industry also needs an answer for the unsigned context, and that answer has to be independent evidence the agent can consult before the cart exists. This is the layer GoBuy exists to provide:

  • Filtered review evidence, not raw review counts. Smart Score is computed from review quality and authenticity after manipulated reviews are removed, so poisoned rating volume, the cheapest input to corrupt, stops being an input at all.
  • Curation that removes placement from the decision. Returning only the top seven verified products per category, rather than a sponsored-first catalog, means there is no “first screen” for an attacker to own.
  • Sustained verification as a signal. The GoBuy Verified badge requires holding a Smart Score of 80 or above across 90 days, which resists the burst-shaped manipulation patterns that inflate a ranking around a shopping event.
  • Machine-native delivery. Agents query filtered trust data over MCP at gobuy.ai/api/mcp before assembling any cart, so the pre-authorization context that AP2 leaves undefended is at least anchored to a source whose incentives are not the seller’s. Developers can wire it in directly at gobuy.ai/agent-docs.

What to Watch

Three developments will tell you whether the industry absorbs this audit or shelves it. First, the FIDO Alliance’s agentic standards work: if pre-authorization evidence integrity appears in scope alongside interaction trust, the spec-level gap starts closing. Second, AP2 v0.3 and the fate of the scanner: the researchers built it precisely so implementers can check their own deployments, and adoption or silence will be informative. Third, the first publicized case of an agent-mediated purchase that was signed, settled, and wrong: when it comes, the mandate chain will correctly prove the user authorized it, and the dispute will land exactly where the audit says it will, in the unguarded ground between intent and signature.

The protocol people have done their part. The cryptography is sound. What remains open is the question this blog exists to answer: when the agent sits down to decide what to buy, what does it know, and why does it believe it? Until that context is verified, every mandate beneath it is a notarized copy of someone else’s opinion.

The signature guarantees the purchase. Verify what the agent knows before it signs: point it at gobuy.ai, or integrate the GoBuy MCP trust layer at gobuy.ai/agent-docs.