Related work: where agent-payment security stands

A 2026 scan of benchmarks, protocol attacks, standards and products, and the gap between them that our lab targets.

No existing work runs a real LLM agent against a production-style control stack (an MPC wallet, a wallet policy engine, x402 spend controls and human approval) with real testnet settlement, and then judges each payment against the user’s intent rather than against the policy. The pieces exist on either side of that line. The middle is where our contribution sits.

Benchmarks for agent prompt injection: real LLM, fake money

AgentDojo (Invariant Labs): banking, workspace, travel and Slack suites with injected tasks. The tools are mocked, so a simulated send_money moves no real funds and passes through no policy engine. It measures whether the model calls the tool. A good source of injection payloads.
Agent Security Bench (ASB), AgentDyn and WASP: the same shape. Real models, simulated tools, no settlement and no wallet-side controls.

Protocol-level attacks on payment rails: real protocol, no LLM

“Five Attacks on x402” (Li, Wang, Wang; arXiv 2605.11781, May 2026): revert-grant, settlement pre-emption, replay and idempotency, HTTP cache leakage, and discovery or Sybil steering. Mostly no agent involved. Attack IV (server selection) is the one that steers an agent, and it is relevant to our selection-steer goal.
AIP-Bench / PCAT (arXiv 2607.21824, July 2026): 33 structural vulnerabilities across CoralOS, Fetch.ai and AP2. Deterministic and explicitly model-independent: protocol flaws, not agent manipulation. PCAT is a published defence that could already close a class we find, so we track it.
“Hardening x402” (arXiv 2604.11430): personal data in x402 metadata, and filtering metadata before execution. Adjacent to our exfiltration goal.

Closest to us

“Whispers of Wealth” (University of Georgia; arXiv 2601.22569): a real AP2 shopping agent (Gemini) where injected product descriptions changed which product the agent bought, despite AP2’s cryptographic mandates. It concludes that cryptographic guarantees alone don’t secure agent payments. This is the most relevant prior result. It supports our S2 hypothesis, and it means “selection and intent manipulation beat mandates” is already published. Our contribution is to test whether the gap survives the full wallet, policy and approval stack on x402, and to measure which goals survive which controls.
SoK: Security of Autonomous LLM Agents in Agentic Commerce (arXiv 2604.15367) and “Beyond the Mandate” (an AP2 analysis, arXiv 2608.23858): surveys that explicitly call for a benchmark like ours, without building one.

Standards and products aimed at the same gap

Google AP2: Intent, Cart and Payment Mandates that bind a payment to a user-signed intent. It is the most direct attempt to check intent, not just shape. Our C9 lock implements real AP2 mandates so we can measure whether they close the S2 gap.
Mastercard Verifiable Intent, Visa Trusted Agent Protocol and the FIDO agent work: intent and identity binding, still emerging.
Coinbase Agentic Wallets, Crossmint, Skyfire and Stripe Shared Payment Tokens: spend caps, allowlists and scoped tokens. All of these check the shape of a payment, like our C3, C5 and C7 locks. The spending-limit space is crowded. The intent-match space is not.

Defences worth measuring