Security in Agentic Commerce: From Research to Reality

The agentic commerce ecosystem has reached a critical inflection point where security has moved from academic concern to operational imperative. Recent research across three production platforms has identified 33 structural vulnerabilities that succeed deterministically regardless of deployed models.

These attacks exploit protocol-level gaps rather than model weaknesses. The Payment Protocol Hijack attack demonstrates how an agent can be redirected to route payments through attacker-controlled escrow accounts while maintaining valid signatures and audit trails. The attack succeeds against several widely-deployed commercial models while alignment-trained models detect and refuse it.

Four major agentic commerce protocols now dominate the landscape: Agentic Commerce Protocol (ACP) from Stripe and OpenAI, Universal Commerce Protocol (UCP) from Google and retail partners, Agent Payments Protocol (AP2) from payment networks, and machine-native protocols x402 and MPP. These protocols address different layers of the stack but share common security challenges.

Security researchers are responding with layered defenses. Protocol-level Commerce Agent Trust (PCAT) demonstrates that structural attacks can be mitigated without modifying platform code. The approach works by validating protocol semantics at runtime and detecting anomalous request patterns that indicate manipulation. Initial results show success against four of five structural attack classes.

The convergence of security research and protocol development suggests agentic commerce is maturing from experimental to production-grade. The attacks may have surfaced precisely because these systems are now handling meaningful transaction volumes. Protocols that incorporate security primitives early rather than bolt them on later may gain first-mover advantage in the coming market consolidation.