Protocol-Level Attacks on Agentic Commerce Platforms: A Cross-Platform Taxonomy, AIP-Bench, and Unified Defense

Yedidel Louck’s study argues that the most dangerous weaknesses in agentic commerce are not necessarily prompt-injection failures inside language models, but protocol-level flaws in how platforms authenticate agents, verify marketplace content, bind payment destinations, and enforce atomic state changes. Examining CoralOS, Fetch.ai uAgents, and Google’s Agent Payments Protocol, AP2, the paper identifies 33 structural vulnerabilities across six root-cause classes; these attacks are deterministic and model-independent, reaching a 100% attack-success rate wherever measured. A three-stage CoralOS chain combines marketplace poisoning, credential leakage, and Solana wallet substitution into a payment hijack. The authors introduce AIP-Bench, a deterministic benchmark whose judges rely on HTTP responses, wallet matches, logs, event counts, and source patterns rather than LLM evaluators. A separate 1,440-trial study shows the semantic impact of poisoned marketplace descriptions varies sharply by model: OpenAI’s GPT-4o reaches 68% attack success, while Anthropic’s Claude 3-Haiku and Claude Sonnet 4.6, Google’s Gemini 2.5 Pro, and Meta’s Llama 3.3-70B show much stronger resistance, demonstrating that alignment affects semantic behavior but cannot repair structural delivery flaws. The proposed defense, PCAT, is a platform-agnostic HTTP sidecar using response signatures, DID-based identity binding, secure-channel policies, atomic payment state, and MCP tool authorization; it reduces structural attack success to 0% for four of five structural classes, while credential exposure is reduced to warn-only. The conclusion is operational: model alignment and protocol security are complementary, and real-money agent systems require both.