Agentic Payments Security Risks: The Full Threat Model for AI Agent Transactions

In February 2026, Darwinium surveyed 500 fraud, risk, and security leaders across the US and UK and found that 97% had seen AI-facilitated attacks increase over the previous 12 months, with average direct losses of $4.5 million per organization.

Growth Centr publishes evergreen, research-backed analysis on business growth, marketing, AI, and software, written for operators who have to make the call rather than watch the trend.

Agentic payments, where an AI agent researches, decides, and completes a transaction with delegated authority, are moving from pilot to production across retail, B2B procurement, and financial services, and the security model underneath them was not designed for a buyer that is not human.

This article breaks down the complete threat model for AI agent transactions: the attack surfaces, the real-world exploits already documented, the liability gaps, and the controls that actually reduce exposure.

Key Takeaways

• Prompt injection is the top agentic risk, redirecting agents into attacker-controlled payments.
• 97% of organizations report rising AI-facilitated attacks, averaging $4.5 million in annual losses.
• Merchants absorb agent-initiated chargebacks by default because no liability framework exists yet.
• Legacy fraud signals like device fingerprints and session behavior fail on agent traffic.
• Cryptographic mandates and scoped agent identity are the highest-leverage controls available today.

The Agentic Payments Market Is Scaling Faster Than Its Security Layer

The adoption curve is steep enough that security debt compounds quickly. Grand View Research values the global agentic commerce market at $7.7 billion in 2026, growing toward $65.5 billion by 2033 at a 35.7% CAGR. eMarketer, using the narrowest definition of checkout completed inside an AI platform, forecasts $20.57 billion in US retail spend for 2026, roughly 1.5% of total ecommerce.

The B2B picture is larger by orders of magnitude. Gartner projects 90% of B2B buying will be agent-mediated by 2028, routing more than $15 trillion through agent exchanges, and that 20% of monetary transactions will be programmable by 2030. Recurring procurement, license renewals, and materials ordering are rule-based and repetitive, making them the ideal first target for automation and for abuse.

Merchant readiness is already there in intent. The 2026 Global eCommerce Payments and Fraud Report, produced by the Merchant Risk Council with Visa Acceptance Solutions from a survey of more than 1,100 merchants, found 63% actively exploring or planning to implement agentic AI payments.

Payment fraud already consumes 3.2% of global ecommerce revenue annually before agent-specific attacks are factored in. If you are still mapping the underlying stack, our breakdowns of the Agent Payments Protocol, the A2A protocol, and the Model Context Protocol cover the plumbing this threat model sits on top of.

Why Legacy Fraud Controls Break on Agent Traffic

Traditional fraud detection runs on human behavioral telemetry: mouse movement, typing cadence, device fingerprint, session duration, navigation path, and IP reputation. An agent-initiated transaction produces none of that in usable form. The agent may run from a cloud IP, check out in under two seconds, and present a clean credential attached to a legitimate customer history.

The measurement gap is the real problem. Darwinium's research found only 36% of organizations can stop fraud at any point in the customer journey, and just 52% can explicitly track or label AI-assisted fraud. That attribution gap produces roughly $3 million in annual blind-spot cost per organization, split between fraud that gets through and good customers blocked by static rules.

Volume is arriving regardless of readiness. Akamai's State of the Internet report found that 47.9% of all AI bot traffic across its global network between July and December 2025 hit the commerce vertical, making commerce the most targeted industry for agentic attacks. Visa reported a 25% spike in malicious bot-initiated transactions over a six-month window, with a 40% surge in the US, tied to fraudsters automating account takeover, inventory manipulation, and checkout abuse.

The Full Threat Model: Ten Attack Surfaces

The OWASP GenAI Security Project released the Top 10 for Agentic Applications in December 2025, developed by more than 100 practitioners and designated ASI01 through ASI10. Mapped to payments, it produces a working threat model.

The pattern across all ten is identical. An agent holds credentials, memory, tools, and the autonomy to chain actions, so a single compromise converts into a completed financial transaction with no human checkpoint.

Threat Surface 1: Prompt Injection and Goal Hijack

Goal hijack ranks as ASI01 because agents cannot reliably separate instructions from data. Anything the agent reads, a web page, a PDF invoice, an email, a product listing, a search result, is a potential instruction channel.

This is no longer theoretical. In July 2026, Zscaler's ThreatLabz documented two live indirect prompt injection campaigns: a payment scam concealed inside fake API documentation for a nonexistent Python library, and a typosquatting operation impersonating the DeBank crypto platform.

In both, attackers used SEO poisoning to rank the malicious pages so agents would find them during ordinary research. Researchers have also observed payloads embedding fully specified transaction details, including recipient, amount, and description, aimed directly at agents with payment capability.

Scale is the concern. Google researchers tracking web content recorded a 32% increase in malicious prompt injection payloads between November 2025 and February 2026. In one public red-teaming exercise against deployed agents, roughly 1.8 million injection attempts produced more than 60,000 successful policy violations. Applied to payments, a success rate in that range is not an acceptable residual risk.

Controls that help: treat all retrieved content as untrusted input, enforce spending policy outside the model rather than inside the prompt, require deterministic approval for any new payee, and cap per-transaction and per-window value.

Threat Surface 2: Agent Identity and Privilege Abuse

Payments assume you can answer three questions: who is paying, who authorized it, and within what limits. Agentic transactions break all three. The IMF's 2026 analysis of agentic AI in payments notes that autonomous agents interact with multiple external systems, tools, and APIs, expanding the attack surface into data exfiltration, tool misuse, and cross-system privilege escalation.

The specific failure mode is the confused deputy. An agent granted broad OAuth scopes for convenience becomes a reusable authorization primitive: an attacker who influences the agent inherits every permission it holds. Delegation chains compound this, because a downstream agent frequently cannot verify whether the authority it received was properly scoped upstream.

Regulators are converging on a shift from Know Your Customer to Know Your Agent, requiring verifiable identities for financial bots linked to a legal entity. In practice that means short-lived scoped credentials per task, distinct agent identities rather than shared service accounts, and per-transaction attestation of delegated authority.

Our guides to AI security platforms for fintech applications and enterprise AI security platforms cover the tooling layer for this.

Threat Surface 3: Memory Poisoning and Supply Chain Compromise

Memory poisoning (ASI06) is dangerous because it persists. A single fraudulent entry written into an agent's long-term memory, such as a spoofed supplier bank detail, influences every subsequent transaction rather than one. In multi-tenant deployments, cross-tenant context leakage can also expose one customer's data to another. Detection is hard because the poisoned state looks like legitimate learned preference.

Supply chain compromise (ASI04) targets the layer beneath. Agents load models, tools, plugins, MCP servers, and skill definitions at runtime, often from third parties. A compromised tool sitting between the agent and a payment API can alter amounts or recipients while returning a plausible confirmation to the agent.

Controls that help: segment memory by tenant, session, and sensitivity; record provenance for every memory entry; run periodic integrity checks; pin and verify tool versions; maintain an inventory of every tool an agent can invoke. The discipline covered in our AI governance checklists for fintech compliance applies directly here.

Threat Surface 4: Inter-Agent Communication and Cascading Failures

Multi-agent payment pipelines introduce lateral movement. Where agents exchange messages without strong mutual authentication, an attacker can register a fake peer in a discovery service using a cloned schema and intercept privileged coordination traffic, or replay a delegation message to reauthorize spend.

Cascading failure (ASI08) is the amplification mechanism. A single poisoned upstream input propagates automatically: a procurement agent given inflated approval thresholds passes them to an execution agent, which transacts at scale while compliance tooling registers everything as valid activity.

Nothing in the chain is technically a violation, which is exactly why detection fails. If you are designing these pipelines, our guide to autonomous agents in B2B finance and accounting workflows covers the orchestration patterns worth constraining.

Threat Surface 5: Deepfakes and Human-Agent Trust Exploitation

The human in the loop is a target, not a control. Darwinium found that 93% of organizations encountered deepfake-style attempts in the past 12 months, with 45.4% seeing them multiple times. Citi has estimated that roughly half of all fraud today involves some form of AI.

ASI09 covers the inverse risk: agents exploiting anthropomorphism and authority bias to get humans to approve harmful actions. When an agent presents a confident, well-formatted transaction summary, approval fatigue sets in fast and the human checkpoint becomes a rubber stamp. Approval interfaces should surface only the delta that matters, a new payee, an unusual amount, changed bank details.

The Liability Gap Is the Largest Unpriced Risk

Security failures become financial losses through the dispute system, and that system has no agentic framework yet. Merchants absorb agent-initiated chargebacks by default because the traditional evidence used to defend a dispute, device fingerprint, IP address, navigation path, time on site, was generated by an agent rather than a person.

The regulatory picture is forming but incomplete. The CFPB's January 2026 advisory on autonomous-agent purchases under Regulation Z established that consumer dispute rights survive delegation to an agent, and are narrowed only where the mandate is appropriately scoped and documented.

For most current deployments that documentation does not exist, which creates a durable friendly fraud claim: "I did not authorize that, my agent did." In the EU, the AI Liability Directive in its post-trilogue form places a rebuttable presumption of fault on the deploying party unless mandate, audit-trail, and consent evidence can be produced.

There is no industry consensus on who pays. In Darwinium's survey, 39% said the AI or agent provider should be liable, 20% said the customer, and only 15% supported a shared model. Meanwhile Datos Insights projects global chargeback volume rising 24% between 2025 and 2028 to roughly 324 million disputes annually.

Under the Agentic Commerce Protocol's delegated payment specification, settlement, refunds, chargebacks, and compliance remain with the merchant and its payment service provider.

Protocol-Layer Defenses: What Mandates Actually Solve

The payments industry's answer is cryptographic proof of intent. Google's Agent Payments Protocol, launched in September 2025 with more than 60 partners including Mastercard, PayPal, American Express, Adyen, and Coinbase, and shipped at v0.2.0 in April 2026, uses signed verifiable credentials called mandates.

AP2 defines three artifacts. An Intent Mandate captures the user's constraints and goals before a cart exists, which governs human-not-present execution.

• A Cart Mandate captures explicit authorization for a specific cart, items, and price.
• A Payment Mandate is shared with the network and issuer to signal agent involvement and user presence so the issuer can risk-score accordingly.

Each is tamper-evident: any modification invalidates the credential, producing dispute-grade evidence.

The card networks are building parallel infrastructure. Mastercard's Agentic Tokens bind a tokenized credential to a specific agent and commerce policy. Visa's Trusted Agent Protocol creates cryptographically authenticated records for agent-initiated payments.

In March 2026, Mastercard and Santander completed Europe's first live end-to-end agent-executed payment, and American Express pledged to cover erroneous purchases made by verified agents on its network.

The honest caveat: mandates prove authorization, not correctness. A cryptographically valid mandate signed by a hijacked agent is still a valid mandate. Protocol-layer proof reduces dispute ambiguity; it does not stop goal hijack.

A Practical Control Framework

Treat agentic payment security as three independent layers, each of which must hold on its own.

Layer 1: Constrain the agent

Scoped, short-lived credentials per task. Distinct identity per agent, never shared service accounts. Hard limits on transaction value, frequency, and payee scope enforced outside the model. Allowlisted payees with out-of-band verification for any addition.

Layer 2: Verify every transaction

Signed mandates for intent, cart, and payment. Provenance tracking on retrieved content and memory writes. Deterministic approval gates for high-value or novel actions. A full audit trail linking each transaction to the mandate that authorized it.

Layer 3: Monitor behavior over time

Baseline each agent's normal tool usage, spend pattern, and counterparties, then alert on deviation. Rogue agents and poisoned memory look legitimate in any single transaction and only surface as drift. Run adversarial testing against your own agents, including injection fuzzing and memory-poisoning regression, before production and on a recurring schedule.

Darwinium found 95% of organizations have made agentic AI a top-five security priority for 2026, with 46% placing it in their top three. Accenture's 2026 banking research found 78% of financial institutions expect agent-linked fraud to increase, and 87% of CTOs and heads of payments believe trust will be the biggest barrier to adoption.

Broader governance context sits in our enterprise AI governance frameworks guide.

What This Capability Costs to Staff

Agentic payment security is a hiring problem before it is a tooling problem. As of August 2026, ZipRecruiter puts average US AI security engineer pay at $152,773, with the 90th percentile near $205,000. Glassdoor's self-reported data averages $187,975, with top earners around $290,375.

Specialist market data shows total compensation from roughly $150,000 at junior level to $700,000 and above at staff and principal level, with agentic AI safety specialists commanding a 20% to 30% premium over LLM-only application security hires.

Set against $4.5 million in average annual fraud losses plus roughly $3 million in attribution blind-spot cost, one or two specialist hires is a rounding error. The scarcer input is time: strong candidates routinely hold four to eight offers, which makes a fixed-scope external red team assessment the faster path for most mid-market teams.

Conclusion

Growth Centr exists to give operators reference material that holds up after the news cycle moves on, and agentic payments is a category where the hype and the risk are advancing at the same speed.

Agent-initiated transactions dissolve the behavioral signals fraud systems were built on, expand the attack surface across ten distinct threat categories, and land in a dispute system that still assumes a human clicked buy.

The defensible position combines cryptographic proof of intent at the protocol layer, tightly scoped agent identity and spending limits at the application layer, and behavioral monitoring that catches drift no single transaction reveals.

Merchants and platforms that build that stack now will set the evidentiary precedents everyone else inherits.

Read Next:

• What Is AP2 (Agent Payments Protocol) for B2B SaaS? (2026)
• What Is A2A (Agent-to-Agent Protocol) for B2B SaaS?
• Model Context Protocol Guide for B2B SaaS

FAQs:

1. What are the biggest agentic payments security risks?

The biggest agentic payments security risks are prompt injection and goal hijack, agent identity and privilege abuse, memory poisoning, tool misuse at the payment API layer, insecure inter-agent communication, and supply chain compromise of the tools an agent loads at runtime. OWASP's Top 10 for Agentic Applications ranks goal hijack as the top risk because agents cannot reliably distinguish instructions from data.

2. How do prompt injection attacks target AI agent transactions?

Prompt injection attacks target AI agent transactions by embedding hidden instructions in content the agent reads, such as web pages, invoices, product listings, or API documentation. Zscaler documented live campaigns in July 2026 that used SEO poisoning to rank malicious pages, then used embedded instructions to direct agents toward attacker-controlled payments.

3. Who is liable when an AI agent makes an unauthorized payment?

Liability when an AI agent makes an unauthorized payment is currently unresolved, and merchants absorb the loss by default. The CFPB's January 2026 advisory confirmed consumer dispute rights survive delegation to an agent, while industry opinion splits between the agent provider at 39%, the customer at 20%, and a shared model at 15%.

4. Does the Agent Payments Protocol prevent agentic payment fraud?

The Agent Payments Protocol does not prevent agentic payment fraud outright, but it materially reduces dispute ambiguity. AP2 uses cryptographically signed intent, cart, and payment mandates to create non-repudiable proof of authorization, though a valid mandate signed by a hijacked agent remains valid, so protocol controls must sit alongside runtime defenses.

5. How can merchants secure AI agent transactions today?

Merchants can secure AI agent transactions today by issuing scoped short-lived credentials per agent task, enforcing spending and payee limits outside the model, requiring signed mandates as authorization evidence, tracking provenance on all retrieved content and memory writes, and baselining agent behavior to detect drift that individual transactions do not reveal.

Disclaimer:
This content is provided for informational purposes only and does not constitute legal, financial, or compliance advice. Protocol versions, governance arrangements, and partner counts cited here reflect publicly announced milestones as of August 2026 and are moving quickly. Adoption figures come from vendor and foundation announcements with differing methodologies and should be treated as directional signals rather than guaranteed outcomes.