Search papers, labs, and topics across Lattice.
This paper conducts a comprehensive security analysis of the Agent Payments Protocol (AP2) v0.2, focusing on its transaction lifecycle, deployment architectures, and trust boundaries. By employing the MAESTRO framework, the authors identify 48 distinct threats across five attack families, with eight threats classified as High-risk under the Artificial Intelligence Vulnerability Scoring System (AIVSS). The findings reveal that valid mandate signatures do not guarantee that transactions align with user intent when pre-authorization contexts are compromised, highlighting critical vulnerabilities in agent-mediated transactions.
Valid mandate signatures can't protect against manipulated transaction contexts, exposing critical vulnerabilities in LLM-driven payment systems.
The Agent Payments Protocol (AP2), introduced by Google, enables large language model (LLM)-driven shopping agents to authorize and execute payments on behalf of users. Its signed Checkout and Payment Mandates protect the integrity of transaction data after signing. Agent interactions and external inputs that shape a transaction before authorization remain outside that protection, including Agent-to-Agent Protocol (A2A) messages and Model Context Protocol (MCP) tool calls. Prior work identified replay and prompt-injection attacks in AP2 v0.1. AP2 v0.2 addresses some of these issues but adds capabilities and deployment assumptions that require renewed analysis. We present a systematic security analysis of AP2 v0.2 based on its roles, transaction lifecycle, deployment architectures, and trust boundaries. We divide the lifecycle into five phases and identify five deployment architectures. Using MAESTRO (Multi-Agent Environment, Security, Threat, Risk, Outcome), we model four threat actors, eleven attack surfaces, eighteen adversary capabilities, and six attacker goals. The resulting catalog contains 48 threats spanning five attack families. We score these threats with the Artificial Intelligence Vulnerability Scoring System (AIVSS), identifying eight that reach the High band in at least one architecture. Because no complete public AP2 deployment was available, we build a testbed spanning all five architectures and develop five proof-of-concept demonstrations covering all eight High-risk threats and their mitigations. We also develop a deployment-aware scanner that maps applicable threats to static, cross-role consistency, and adversarial checks. Our analysis shows that valid mandate signatures alone do not ensure that an agent-mediated transaction reflects the user's intent when its pre-authorization context is manipulated.
