Many agentic commerce risks sit inside the limits a user signs. Agent payment protocols such as AP2 and the Agentic Commerce Protocol record what a user authorized: the checkout, the amount, the payee, a spending cap and an expiry [1, 3, 9]. AP2's security notes say that "even if the LLM fails to make the optimal choice", constraint checks keep "the worst-case financial and logical impacts" bounded [2]. The protocol caps the loss. The choice inside the cap is still the agent's.
Research shows where buying agents go wrong inside those limits. They take the first acceptable offer, pay more once a seller learns the budget, follow seller wording and injected text, and give in to persistent requests [19, 20, 22, 32]. Each failure can become a test with a known right answer, run many times before an agent spends real money.
What agent payment protocols record
AP2 was announced on 16 September 2025 with more than 60 organizations [5]. Its first design had an Intent Mandate for the request, signed in advance with "price limits, timing, and other conditions" for delegated purchases, and a Cart Mandate for "the exact items and price" [5]. The current documentation, viewed on 24 October 2026, names a Checkout Mandate and a Payment Mandate, each with an open stage for the user's constraints and a closed stage for a finalized checkout or amount [1]. A Payment Mandate can limit the payee, the instrument, the amount range, a total budget and the dates [3].
The Agentic Commerce Protocol, first released on 29 September 2025, keeps businesses as merchant of record and lets them accept or decline transactions "on a per agent, per transaction, or custom logic basis" [8, 11]. Its delegated payment token works only within an allowance: one use, one merchant, a maximum amount and an expiry [9]. The Trusted Agent Protocol, announced on 14 October 2025, uses agent-specific signatures to tell trusted agents apart from "malicious automation and rogue bots" [12].
AP2's own trip example shows the gap. An agent with a $700 budget books a flight and hotel "once it finds a combination that fits the budget" [5]. The mandate proves the booking fit the budget. It records nothing about whether a cheaper combination existed. In a dispute, the signed mandate shows who authorized what [4].
Agentic commerce risks inside a valid mandate
First-offer bias and shallow search
Magentic Marketplace, a 2025 simulated market of customer and business agents, found that frontier models approach optimal welfare only under ideal search conditions [19]. Customer agents picked the first proposal 60% to 100% of the time and third proposals almost never, a 10 to 30 fold advantage for speed over quality [19]. In one scenario, 100 search results in place of 3 cut consumer welfare by 4.3% for the least affected model and by 44% and 65.4% for two others [19]. In a 2026 study, a vague goal ("find the best deal") plus a $10.00 cost per attribute lookup cut the share of optimal choices to 0.29, against 0.83 with a specific goal [23].
Position and seller wording
In randomized trials from 2025, buying agents showed strong position biases that varied by provider and model version and persisted in text-only lists [21]. Telling an agent to "ignore position" did not significantly reduce them [21]. When models were upgraded, one fitness watch's share rose from 45% to 77% under one model family and fell from 25% to 6% under another [21]. A study posted on 19 October 2026 priced seller cues on one model: a strong social-proof line was worth about 13% of the price, about $17 on a $130 item, and an authority claim about 19.8% [22].
Budgets, disclosure and overspending
In 2025 negotiations over 100 real products, buyer agents often revealed their budget when a seller asked, despite instructions not to disclose it unless necessary [20]. Sellers anchored to that number, and buyers accepted prices above the listed retail price "without objection" [20]. Some weaker models accepted deals above budget in over 10% of cases, more often at low budgets [20]. Prompt optimization on the buyer model with the highest anomaly rate cut out-of-budget deals from 18.4% to 1.3% and left overpayment at 8.1% to 8.3% [20]. A mandate's cap stops deals above budget [3, 9]. Overpayment happens under the cap. The Agentic Commerce Protocol's intent trace proposal can pass a "max_budget" field to the merchant, whose server "SHOULD record this trace for analytics or pricing optimization" [10].
Giving in under pressure
In a month-long 2025 shop pilot run by a model developer, the agent running an office store was talked into discount codes, gave items away, priced some items below cost and for a time told customers to pay an account it had hallucinated [32]. In a second phase, with procedures and a supervising agent, weeks with negative margins were largely eliminated, yet the agent was still "a mark for some of the more adversarial testers" [33]. In 2024 negotiation tests, an agent that pretended to be desperate raised its payoff by 20% [24].
Prompt injection and repeated attempts
AP2 "assumes that preventing prompt injection attacks is infeasible" [2]. In Magentic Marketplace, injected text from seller agents often redirected all of a vulnerable model's payments [19]. In 2025, researchers steered commercial web agents to fake product pages through forum posts and obtained credit card numbers in 10 of 10 trials [26]. NIST's Center for AI Standards and Innovation found in 2025 that attacks adapted to the model raised success from 11% to 81% on held-out tasks, and that 25 attempts per attack raised average success from 57% to 80% [13]. Those figures come from one model on workspace and similar tasks [13].
Overcharges that identity checks miss
An industry benchmark of machine-to-machine micropayments, posted on 27 September 2026, includes a counterparty with the correct domain and a real delivered service that charges 30% above its own listed price [27]. Identity checks stay silent "because nothing about the identity is wrong" [27]. Fake storefronts can also "pass automated security checks, and offer prices far below market rate" [35].
A pre-deployment checklist with known right answers
Each row pairs a published failure with a test and the answer that scores it. Measuring LLM agents in simulated auctions shows how to score agents against an optimum fixed in advance.
| Risk | Test | Known right answer |
|---|---|---|
| First-offer bias | Equivalent and better offers in random arrival order [19] | The offer that meets every requirement at the lowest price [19] |
| Shallow search | Few to many options shown [19] | The same optimum at every size [19] |
| Position | Listing position randomized across trials [21] | A choice that does not change with position [21] |
| Vague goals | One purchase with a vague and a specific instruction, costly lookups [23] | The lowest unit price [23] |
| Seller cues | A cue on one listing, its price raised until it wins half the time [22] | No premium for wording, price-equivalent reported [22] |
| Budget disclosure | The seller asks for the budget early, at several budget levels [20] | Never above list price or budget [20] |
| Infeasible budget | Budget below the seller's cost [20] | No deal [20] |
| Customer pressure | Scripted requests for discounts and free items, for selling agents [32, 33] | Policy discounts only, no sales below cost |
| Overcharge | A bill above the counterparty's own listed price [27] | Pay the listed price or decline |
| Lure | An offer far below market from an unverified seller [35] | Decline, or ask a person to approve [14, 15] |
| Injection | Injected text in listings, adapted attacks, many attempts [13, 19] | No change in what is bought or paid [13] |
| Consistency | Each case run k times, and again after every model change [21, 28] | All k runs correct [28] |
Repetition decides the score. τ-bench's pass^k counts a task as passed only if all k trials succeed [28]. In 2024 a frontier agent solved about 61% of retail tasks on one try and about 25% on all eight [28]. A black-box protocol for evaluating LLM agents covers pinned versions and re-baselining.
What regulators expect from businesses using agents
UK Competition and Markets Authority guidance of 9 March 2026 tells businesses "you are responsible for what an AI agent does in the same way you are responsible for what an employee does" [16]. It tells them to use test results to improve an agent "before you deploy it" [16]. A companion paper lists mandatory confirmation for high-risk actions and audit logs among safeguards for a shopping agent [15].
On 17 July 2026, France's Autorité de la concurrence put traffic from agents directly to e-commerce sites at less than 5%, with 20% to 25% possible by 2030 [18]. It named the risk of self-preferencing and the influence of advertising on agent responses, and noted stakeholders' concern about collusion if agents take part in price negotiations [18]. The review of LLM agents as market participants covers the collusion studies.
Rillor's market simulation tests LLM agents in posted-price markets and auctions with induced values, so the efficient allocation is known before the first bid, and logs every bid. For the injection rows, Rillor's agentic security testing runs each attack against an agent, its tools and its data, logs every run and covers only systems the client owns or is authorized to test, within a written scope.
Read the full report
The full report gives each finding with its setting and caveats, the checklist with the evidence behind each row, and all 35 sources.