Protocol Risks in Agentic Commerce

Agentic commerce platforms handle real money, yet security research has focused almost entirely on AI model vulnerabilities. The more consequential risks lie one layer down, in the protocols between agents and commerce services. These structural vulnerabilities are deterministic and independent of which model runs—no model improvement removes them.

Across three leading platforms, researchers identified 33 such protocol vulnerabilities, each succeeding at 100% attack success rate where measured. The same failure modes recur across independently built codebases, a systemic pattern rather than isolated bugs. Three chain into end-to-end payment hijacks.

The most dangerous attacks exploit protocol assumptions about trust boundaries. One example: agents routing payment coordination sessions to attacker-controlled escrow addresses under regulatory audit pretenses. The attack completes with valid signatures and normal-looking audit trails. No model error, no crash, no anomalous log entry.

Model-dependent semantic attacks get attention, but structural protocol attacks are more dangerous. They succeed deterministically regardless of deployed models. Even well-aligned models like Claude 3-Haiku fall victim to these protocol-level manipulations.

The defense requires protocol-level interventions, not model training. Solutions like PCAT (Protocol-level Commerce Agent Trust) drive structural attack success rates to zero for four of five attack classes—without modifying any platform.

Agentic commerce must be secured at the protocol layer. The money flows through the protocols; that's where the real vulnerabilities hide.