Artificial intelligence
Signing the Transaction but Not the Decision: Whisper Attacks and a Binding Defense for AP2
Researchers show that AP2, a protocol for agentic payments, cryptographically validates completed transactions but never checks whether the agent's underlying decision matched user intent. This lets attacker-controlled product text steer a shopping agent into leaking another user's payment credentials, building a mismatched cart, or overpaying for goods — all while passing every protocol signature check. The paper proposes A-VIP, a defense binding credentials and cart lines to the original session/listing, and releases a 1,544-scenario benchmark (AP2-WhisperBench).