Pre-Authorization Context Manipulation in Agent Payments Protocol (AP2) v0.2

Technical Analysis

AP2's trust model anchors integrity guarantees to cryptographically signed mandates, but the pre-signing pipeline — A2A messages between shopping agents, merchants, and payment processors, and MCP tool calls used to gather product/pricing data — sits outside the cryptographic boundary and is treated as trusted context by the LLM agent. An attacker who can inject or tamper with A2A messages or MCP tool responses (e.g., poisoned product data, spoofed merchant identity, replayed intermediate messages) can steer the agent's reasoning so that the final mandate it signs encodes an attacker-favorable transaction, even though the signature itself remains cryptographically valid. This crosses the human-intent-to-cryptographic-commitment boundary: the signature verifies data integrity but not that the data reflects genuine user authorization, effectively enabling authorization-goal-hijack via untrusted upstream context. The analysis maps this across 11 attack surfaces and 5 deployment architectures, with the highest-risk threats occurring where MCP tool outputs or A2A messages directly populate mandate fields without independent verification or cross-role consistency checks.

Affected Systems

AP2 reference implementation, MCP servers, A2A-compliant agents; protocols: AP2 (Agent Payments Protocol), A2A, MCP

Detection Signatures

• Anomalous divergence between MCP tool-call output and displayed/confirmed transaction details prior to mandate signing
• A2A messages arriving out-of-order or duplicated relative to expected transaction lifecycle phase (possible replay)
• Mandate fields (amount, merchant identity, item) populated from unvalidated upstream agent or tool responses without cross-role consistency check
• Missing or weak binding between user-confirmed intent artifact and final signed Payment/Checkout Mandate content
• Deployment architectures lacking independent verification step between MCP/A2A data ingestion and mandate construction

Remediation Steps

1. 1

   Bind user intent to mandate content cryptographically

   Ensure the exact transaction details the user reviewed and approved are hashed/bound into the mandate itself, so any divergence introduced during the A2A/MCP phase is detectable before signing.

2. 2

   Cross-role consistency checks

   Implement independent verification comparing merchant, pricing, and item data across multiple A2A/MCP sources before allowing mandate construction, as recommended by the paper's deployment-aware scanner.

3. 3

   Treat MCP/A2A inputs as untrusted

   Apply input validation, provenance checks, and anomaly detection to all tool call results and inter-agent messages feeding into payment-relevant context, not just the final signed artifacts.

4. 4

   Replay protection

   Enforce nonces, timestamps, and strict lifecycle-phase ordering on A2A messages to prevent replay-based mandate manipulation.

5. 5

   Adopt AIVSS-based threat scoring in deployment review

   Use the paper's threat catalog and scanner to assess which of the five deployment architectures apply to a given AP2 integration and prioritize mitigation of the eight High-band threats.