Whispers of Wealth: Red-Teaming Google's Agent Payments Protocol via Prompt Injection

arXiv:2601.22569 · cs.CR, cs.AI · Submitted 2026-01-30 · Read on arXiv

cs.CR, cs.AI

Submitted: 2026-01-30

Updated: 2026-05-18

Journal ref: 2026 International Conference on Intelligent Multimedia, Networking, and Security (IMNS), Atlanta, GA, USA, 2026

DOI: 10.1109/IMNS67862.2026.11655291

Code: https://github.com/google-agentic-commerce/AP2

License: http://creativecommons.org/licenses/by/4.0/

The gist: Large language model (LLM) based agents are increasingly used to automate financial transactions, yet their reliance on contextual reasoning exposes payment systems to prompt-driven manipulation.

Terminology

Abstract

Large language model (LLM) based agents are increasingly used to automate financial transactions, yet their reliance on contextual reasoning exposes payment systems to prompt-driven manipulation. The Agent Payments Protocol (AP2) aims to secure agent-led purchases through cryptographically verifiable mandates, but its practical robustness remains underexplored. In this work, we perform an AI red-teaming evaluation of AP2 and identify vulnerabilities arising from indirect and direct prompt injection. We introduce two attack techniques, the Branded Whisper Attack and the Vault Whisper Attack which manipulate product ranking and extract sensitive user data. Using a functional AP2 based shopping agent built with Gemini-2.5-Flash and the Google ADK framework, we experimentally validate that simple adversarial prompts can reliably subvert agent behavior. Our findings reveal critical weaknesses in current agentic payment architectures and highlight the need for stronger isolation and defensive safeguards in LLM-mediated financial systems.

Sources

Related papers