// Research · 2026-09-09

The unchecked channel.

Agentic commerce got its payment rails in about eighteen months. Four protocols, backed by Visa, Mastercard, Google, OpenAI, Stripe, Coinbase and Cloudflare, now answer the questions a payment network has always had to answer: who is this, what did they agree to, and how much can they spend. They answer them well. And not one of them looks at the thing that actually made the agent decide.

What the stack verifies

The 2026 agentic payment stack is not vapourware. ACP issues merchant-bound, single-use payment tokens. AP2 wraps a purchase in three cryptographically signed mandates — intent, cart, payment — so the agent cannot quietly buy something the user never asked for. Visa’s Trusted Agent Protocol signs the agent’s identity into the request itself. x402 settles machine-to-machine in stablecoins over HTTP 402, and has cleared more than a hundred million transactions on Base.

Read that table as a security model and the shape of the gap is obvious. Every row authenticates a party or bounds an amount. Identity: solved. Authorization: solved. Settlement: solved. But an agent does not decide to buy because of a signature. It decides because of text— a product description, an analyst note, a listing, a token’s metadata, a page it fetched. That input is unauthenticated, attacker-writable, and arrives before any mandate exists to sign.

Why text is the channel

A language model has one input channel. Instructions from its operator and content from the world arrive as the same kind of thing: tokens in a context window. There is no hardware boundary between “what I was told to do” and “what I read while doing it”. This is why prompt injection has been the number one entry in OWASP’s LLM Top 10 three years running, and why it is not a bug anyone patches — it is the architecture.

Give that architecture a wallet and the consequence is mechanical. In May 2026 an attacker sent an NFT to a Grok-linked wallet that silently escalated its permissions, then published a message the agent decoded and a trading bot executed as an authenticated instruction. About $175,000 left. SlowMist named the category: AI agent permission chain abuse— one AI’s output treated as another’s authorization, with nothing in between verifying the content. Every mandate in that chain could have been perfectly signed. The signatures were never the problem.

The scale is already here

Akamai’s measurement is the one worth sitting with: nearly half of all AI bot traffic on their global network now lands on commerce, making it the single most targeted vertical — and commerce organizations put over 90% of that AI bot activity in “monitor” mode, letting three-quarters of the rest pass unrestricted. Meanwhile roughly 88% of organizations running agents reported a confirmed or suspected agent security incident in the past year, while only 14.4% said their agents went live with full security approval. Deployment has outrun control by an order of magnitude.

What we measure on the launch surface

We run one instrument on one corner of this problem: token launches, which are the cheapest way in the world to put attacker-written text in front of a trading agent. Anyone can mint a token; the name, symbol, description and links are free-form; and an AI agent evaluating it reads all of them. Here is what the registry holds as of September 9, 2026 — figures anyone can re-fetch:

The flag rate is low — about a third of one percent — and that is the honest headline. This is not a story about a surface that is mostly poisoned. It is a story about a surface where a small, persistent fraction is poisoned, in ways designed to be invisible: 154 tokens carrying zero-width or otherwise invisible characters, the trick that makes a symbol render as “STOCK” to a human while being a different string entirely to a machine. Five carry outright trading imperatives — text shaped as an order to whoever is reading it, sitting in metadata, waiting.

Two of those five were caught by a rule that had existed for less than a day when it first fired. A detection rule that finds something real within twenty-four hours of shipping is not evidence of a clever rule. It is evidence of a surface in active use.

The layer nobody owns

There is a reason this gap persists, and it is not incompetence. The payment protocols are built by payment companies, who correctly scope themselves to payment. Content safety vendors scan enterprise dev stacks — skills, MCP manifests, tool descriptions — because that is where their buyers are. Token-security tools like GoPlus, Blockaid and RugCheck examine contracts, liquidity and holder concentration, for a human deciding whether to buy. Every one of these is a real product doing a real job, and the space between them — is the text this agent is about to read safe to read? — belongs to nobody.

The fix is not a better model or a smarter filter. It is an ordering change: the agent asks about the content before ingesting it, and gets back a structured verdict — checked, changed, findings — rather than the raw bytes. Ask first, read second. An agent that reads a poisoned description in order to decide whether it is poisoned has already lost, no matter what it concludes.

# the ordering that closes it — free, no key
GET /api/v1/token/{chainId}/{address}
→ verdict · codes · mutation count · signed attestation
→ labels withheld entirely when the verdict is findings

# only on clean_by_rules does the agent touch the raw metadata
# and even then, as data — never as instructions

What this does not prove

The rules are the evadable layer and we label them that way. Novel phrasing gets past pattern matching; a determined attacker with a language model does better than our mutation tests. A “clean” verdict is not a safety certificate, and no finding count here says anything about contract code, tokenomics, or teams.

What survives rewording is arithmetic: a hash of the exact bytes observed, a signature over that hash, a mutation counter, and a registry that remembers what a thing looked like the first time anyone saw it. That is why the durable claim is not “we detect attacks” but “if what your agent reads is not what was attested, everyone can tell.” Payment rails made agentic commerce possible. Something still has to check the channel that tells the agent what to buy.

Sources: Akamai State of Apps & API Security 2026 (commerce AI bot traffic, DDoS and API figures) · Gravitee State of AI Agent Security 2026 and AvePoint State of AI 2026 (incident rates) · SlowMist / OECD AI incident record (Grok-linked wallet drain) · Fireblocks and Crossmint protocol comparisons (ACP, AP2, TAP, x402) · Chainalysis (x402 transaction volume). Registry figures from dashboard.agentwormhole.com/api/v1/stats/launches, 2026-09-09.