Technical Summary: Whispers of Wealth – A Systematic Red-Teaming Study of the Agent Payments Protocol (AP2)

1. Problem Statement

Large Language Model (LLM) based agents are increasingly deployed in high-stakes financial domains to automate transactions. While protocols like the Agent Payments Protocol (AP2) have been introduced to secure these interactions through cryptographically signed mandates (ensuring authorization, authenticity, and accountability), a critical security gap remains. AP2 guarantees the integrity of execution (i.e., that a signed transaction is valid and unmodified) but does not secure the integrity of reasoning (i.e., how the agent constructs the transaction mandate from contextual inputs).

The paper identifies that adversarial instructions embedded in contextual inputs—via prompt injection—can manipulate the agent's decision-making process before a mandate is ever signed. Consequently, the system may produce transactions that are cryptographically valid but fundamentally misaligned with the user's true intent. This creates a vulnerability where execution correctness is preserved, but decision correctness is compromised.

2. Methodology

The authors conducted a systematic red-teaming evaluation of a functional AP2-based shopping agent.

• System Implementation: The target system was built using the Google Agent Development Kit (ADK) and powered by the Gemini-2.5-Flash model. It consists of a distributed architecture with four agents:
  1. Shopping Agent: Captures user intent and orchestrates the workflow.
  2. Merchant Agent: Provides product discovery and pricing.
  3. Merchant Payment Processor Agent: Verifies and processes payments.
  4. Credentials Provider Agent: Manages user credentials and payment data.
• Workflow: The system follows the standard AP2 human-present workflow: generating an Intent Mandate, a Cart Mandate, and finally a Payment Mandate, each requiring user approval and cryptographic signing.
• Attack Vectors: Two specific reasoning-layer attacks were designed to target distinct trust boundaries:
  1. Branded Whisper Attack (Indirect Prompt Injection): Adversarial instructions are embedded within product metadata (e.g., product descriptions) provided by a malicious Merchant Agent. The goal is to manipulate the Shopping Agent's ranking logic to prioritize the attacker's product.
  2. Vault Whisper Attack (Direct Prompt Injection): A malicious user submits crafted prompts during interaction to override identity constraints and induce the system to disclose sensitive data belonging to other users.
• Evaluation Metrics: The study utilized Attack Success Rate (ASR) for ranking manipulation and the rate of high-risk data exposure for credential attacks. Experiments were conducted over 10 independent trials per condition in an isolated environment using synthetic data.

3. Key Contributions

The paper introduces two novel attack techniques and provides the first systematic evaluation of prompt injection vulnerabilities within the AP2 framework:

• Branded Whisper Attack: Demonstrates that adversarial content in external data (product descriptions) can override semantic relevance and user constraints, forcing the agent to rank a specific product first.
• Vault Whisper Attack: Demonstrates that direct user prompts can bypass reasoning-layer access controls, leading to cross-user data disclosure (e.g., retrieving another user's credentials).
• Threat Model Refinement: The authors clarify that in AP2-style architectures, the separation between execution integrity (protected by cryptography) and reasoning integrity (vulnerable to prompt injection) constitutes a fundamental attack surface.

4. Results

The evaluation yielded the following quantitative findings across 30 total trials:

• Baseline Performance: Under benign conditions, the system exhibited 0% attack success, correctly aligning product rankings with user intent.
• Branded Whisper Attack: The attack achieved a 100% success rate (10/10 trials). In all cases, the injected product was ranked first, regardless of its relevance to the user's query. In 60% of these trials, the ranking explicitly contradicted user constraints (e.g., brand preferences).
• Vault Whisper Attack: The attack resulted in 20% high-risk data exposure (2/10 trials), where the system retrieved sensitive data associated with a different user. In an additional 30% of trials, the system partially attempted unauthorized data access, indicating inconsistent enforcement of identity constraints at the reasoning layer.

Key Observation: All successful attacks produced transactions that remained cryptographically valid. The cryptographic signatures verified the execution of the mandate, but the construction of the mandate had been subverted by adversarial reasoning.

5. Significance and Claims

The paper claims that its findings reveal a fundamental limitation of current agent-mediated payment systems: cryptographic guarantees ensure execution correctness but do not protect decision-making.

• Core Argument: Securing agent-mediated commerce requires more than just cryptographic mandates. The reasoning process itself must be protected, as adversarial inputs can influence decisions (ranking, data access) before any cryptographic verification occurs.
• Implications: The study argues that existing defenses are insufficient because they focus on execution verification rather than input filtering and reasoning constraints.
• Proposed Mitigations: The authors suggest a layered defense strategy, including:
  • Filtering external/retrieved content using dedicated prompt-injection detectors (e.g., PIGuard, DataSentinel).
  • Implementing independent, post-reasoning validation (guardrails) for sensitive tool invocations to enforce least-privilege access outside the LLM's reasoning loop.
  • Separating reasoning from security-critical decision logic.

The paper concludes that while AP2 provides a robust framework for transaction verification, the safe deployment of autonomous financial agents depends on developing mechanisms that constrain how contextual inputs influence agent reasoning.