Protocol-Level Attacks on Agentic Commerce Platforms: A Cross-Platform Taxonomy, AIP-Bench, and Unified Defense

2026-07-23

AI Summary

This study addresses a critical gap in existing research on AI agent-based e-commerce security, which has predominantly focused on AI models while overlooking structural vulnerabilities at the protocol layer between agents and services—vulnerabilities that are deterministically exploitable and independent of the underlying model. Through systematic analysis of protocol interactions across three major platforms, this work proposes the first attack taxonomy tailored to agent-based e-commerce protocols, identifies 33 distinct vulnerabilities, and uncovers cross-platform commonalities. Building on these findings, the authors introduce AIP-Bench, the first deterministic security benchmark for this domain, and devise PCAT, a universal defense mechanism requiring no platform modifications. Empirical evaluation demonstrates 100% success rates for all identified attacks; upon deploying PCAT, four out of five structural attack categories are fully mitigated, while the fifth is downgraded to trigger only warnings, substantially enhancing protocol-layer security.

Abstract

Agentic commerce platforms let AI agents autonomously discover services, move payments, and wield user credentials on their users' behalf, and they already handle real money. Their security has so far been studied almost entirely at the level of the AI model, through prompt injection and misalignment. We show that the more consequential risks lie one layer down, in the protocol between agents and commerce services. There, vulnerabilities are structural : exploitation is deterministic and ndependent of which model an agent runs, so no model improvement removes them. Across three leading platforms we identify 33 such vulnerabilities, each succeeding deterministically regardless of the deployed model, at a 100% attack-success rate (ASR) wherever live-measured. The same failure modes recur across independently built codebases, a systemic pattern rather than isolated bugs. Three of them chain into an end-to-end payment hijack. We contribute a taxonomy separating these structural attacks from model-dependent semantic ones. We also build two artifacts: AIP-Bench (Agent Interaction Protocol Benchmark), to our knowledge the first deterministic benchmark for agentic commerce security, and PCAT (Protocol-level Commerce Agent Trust), a platform-agnostic defense that drives the structural attack-success rate to zero for four of the five structural classes (RC-1, RC-2, RC-4, RC-5), with RC-3 (observable credential channels) reduced to warn-only, without modifying any platform. Agentic commerce must be secured at the protocol layer, not only the model.

Problem

• protocol-level attacks
• agentic commerce
• structural vulnerabilities
• security
• AI agents

Innovation

• protocol-level attacks
• agentic commerce
• structural vulnerabilities
• AIP-Bench
• PCAT