important · Research — Agentic payments
Merchant prose can redirect an AP2 agent across both credential and purchase-intent boundaries.
Affects
Agent Payments Protocol (AP2), a protocol and reference implementation for agent-mediated shopping and payments.
A merchant can place instructions or false claims in product text that the agent consumes before it creates the signed checkout artifacts.
Detail and 4 sources
The reported tests produced cross-user credential retrieval, mismatched carts and more expensive purchases across 17 Google models, three frameworks and Google's consumer assistant.
The public benchmark includes reproduction material, and no fix is identified.
This stays secondary because current production adoption and reach are not established.
Sources
Researchanonymos-2321135/ap2-whisperbench · Datasets at Hugging FaceCode / PoCGitHub - google-agentic-commerce/AP2: Building a Secure and Interoperable Future for AI-Driven Payments. · GitHubCode / PoCAP2/docs/ap2/specification.md at main · google-agentic-commerce/AP2 · GitHubSecondaryWhisper attacks make signed agent-payment transactions diverge from user intent