Whispers of Wealth: Red-teaming Google's Agent Payments Protocol via prompt injection
Whispers of Wealth: Red-Teaming Google's Agent Payments Protocol via Prompt Injection
Quick read
Based on 论文全文 （AI 生成）; refer to the original
The researchers red-team Google's Agent Payments Protocol (AP2) and find that prompt injection can manipulate Agent decisions without breaking cryptographic signatures. The team implemented an AP2 shopping flow with Gemini-2.5-Flash and the Google Agent Development Kit (ADK), involving four agents: Shopping, Merchant, Merchant Payment Processor, and Credentials Provider. The Branded Whisper Attack embeds instructions in product descriptions, and the injected product was ranked first 100% of the time across 10 trials; the Vault Whisper Attack induces cross-account data leakage through direct prompt injection, succeeding 2 out of 10 times (20%). The authors argue that AP2's cryptographic signatures only guarantee correct execution, not protection of the reasoning process that generates transactions, and recommend adding prompt injection detection and post-hoc verification outside LLM reasoning.
- 基于 LLM 的支付代理（如 AP2）用密码学签名 mandate 保证执行正确，但决策推理层是否安全尚不清楚。若推理被操纵，可能生成密码学有效却违背用户意图的交易，带来欺诈与隐私风险。
- 作者用 Gemini-2.5-Flash 和 Google ADK 实现了一个可运行的 AP2 购物代理，进行红队评估，提出两种攻击：Branded Whisper Attack 在商品描述中嵌入间接提示注入以操纵排名；Vault Whisper Attack 用直接提示注入诱导跨用户数据泄露。
- 良性条件下排名攻击成功率 0%；Branded Whisper Attack 在 10 次试验中 100% 把注入商品排到第一，6 次明显违背用户约束。Vault Whisper Attack 在 10 次中 2 次（20%）导致跨账户数据暴露，另有 3 次部分尝试访问。所有交易仍保持密码学有效。
- 评估基于手工构造提示的受控实验，样本规模小；未来需自动化对抗生成与更大规模测试，并研究跨代理消息篡改、mandate 重放、中间代理被攻陷、数据投毒等威胁，以及推理层防护机制。
The paper reproduces the AP2 shopping flow on Gemini-2.5-Flash and quantifies the success rate of prompt injection in manipulating ranking and credential access before cryptographic signing.