Whisper Attacks Steer AP2 Agents Past Intent

Problem

This paper examines a class of vulnerabilities in agent-mediated commerce where the Agent Payments Protocol (AP2) signs the outcome of a purchase but does not bind the underlying decision process. Merchant-controlled free-text fields can steer a shopping agent into making choices that produce cryptographically valid mandates while diverging from the user’s intent. The authors show three real-world attack families that exploit this gap, demonstrate high success rates across many models and deployments, and argue that protocol-layer controls are required because model-layer fixes are not under a protocol owner’s control.

Approach

The authors define three adversary goals: Vault Whisper (induce the agent to fetch another user’s payment credentials), Branded Whisper (produce a signed cart whose lines, prices, or payee do not match the displayed listing), and Selection Whisper (use factual claims about stock or lineage to steer the agent toward a costlier displayed product). They evaluate attacks end to end on an unmodified AP2 v0.2.0 reference deployment, across seventeen Google builds, multiple cross-vendor models, three agent frameworks, and Google’s consumer assistant. They build and release AP2-WhisperBench, a suite of 1,544 scenarios and deterministic judges, and implement a protocol-layer defence called A-VIP consisting of a credential-binding primitive (DDFC), structural cart bindings, a spending-confirmation rule, and a secondary content-inspection layer.

Key Findings

• Instruction-based leaks succeed at high rates on AP2 sample agents: Vault Whisper reached 90% and Branded Whisper 56% on the Gemini Flash-Lite line used by the reference sample.
• Factual steering is especially potent: Selection Whisper reached 73.3% on the GA Flash-Lite successor and succeeds across all tested Google builds, three agent frameworks, two cross-vendor anchors, and the consumer assistant; one non‑Google reasoning model resisted with a 1.2% rate.
• Resistance does not track vendor, price tier, or model capability; similar-priced models and higher-capability builds can be either vulnerable or resistant, so a protocol owner cannot rely on model choice.
• A protocol-layer defence that treats a signed Intent as a capability grant can block the two forged families without false positives by (i) replacing user identifiers with a session-bound single-use token (DDFC) and (ii) structurally binding each cart line to the recorded listing and payee. The Selection family leaves no structural trace and is surfaced for confirmation rather than silently blocked.
• The AP2-WhisperBench benchmark and the A-VIP code and machine-checked invariants are released to support reproducible evaluation and rollout checks.

Limitations

Some consumer-product measurements use limited trial counts and single-trial observations for some reasoning-tier builds, so percentages carry uncertainty. The content-inspection secondary layer has a nonzero strict false-positive rate reported at 12% on a stress test. Selection Whisper cannot be fully prevented by structural checks; it is mitigated by surfacing unapproved spending or by expressing a machine-readable budget in the Intent.

Implications

Attackers controlling merchant text can induce credential exposure, cart corruption, or silent price escalation while producing cryptographically valid mandates, enabling credential theft, unauthorised spending, and supply of attacker-controlled products or payees. Because model behaviour is inconsistent across builds and vendors, attackers can exploit the weakest deployed models. The protocol-layer defence demonstrates how a protocol owner can materially reduce attack surface by binding credentials and cart lines to session and display context, while selection-driven escalations must be surfaced to users as potential unauthorised spend.