SoK: Security of Autonomous LLM Agents in Agentic Commerce

Qian'ang Mao; Jiaxin Wang; Ya Liu; Li Zhu; Cong Ma; Jiaqi Yan

cs.CRApr 15, 2026

SoK: Security of Autonomous LLM Agents in Agentic Commerce

Authors: Qian'ang Mao, Jiaxin Wang, Ya Liu, Li Zhu, Cong Ma, Jiaqi Yan

Organizations: Nanjing University · Southern University of Science and Technology · City University of Hong Kong

Abstract

Autonomous large language model (LLM) agents such as OpenClaw are pushing agentic commerce from human-supervised assistance toward machine actors that can negotiate, purchase services, manage digital assets, and execute transactions across on-chain and off-chain environments. Protocols such as the Trustless Agents standard (ERC-8004), Agent Payments Protocol (AP2), OKX Agent Payments Protocol (APP), the HTTP 402-based payment protocol (x402), Agent Commerce Protocol (ACP), the Agentic Commerce standard (ERC-8183), and Machine Payments Protocol (MPP) enable this transition, but they also create an attack surface that existing security frameworks do not capture well. This Systematization of Knowledge (SoK) develops a unified security framework for autonomous LLM agents in commerce and finance. We organize threats along five dimensions: agent integrity, transaction authorization, inter-agent trust, market manipulation, and regulatory compliance. From a systematically curated public corpus of academic papers, protocol documents, industry reports, and incident evidence, we derive 12 cross-layer attack vectors and show how failures propagate from reasoning and tooling layers into custody, settlement, market harm, and compliance exposure. We then propose a layered defense architecture addressing authorization gaps left by current agent-payment protocols. Overall, our analysis shows that securing agentic commerce is inherently a cross-layer problem that requires coordinated controls across LLM safety, protocol design, identity, market structure, and regulation. We conclude with a research roadmap and a benchmark agenda for secure autonomous commerce.

Figures & tables

Vector	Name	Direct	Derived
P2T	Prompt-to-Transaction	Greshake et al. [ 17 ] ; Acharya [ 18 ] ; Nieper-Wisskirchen et al. [ 48 ]	No released derived-support evidence in the current snapshot.
T2R	Tool-to-Reasoning	Model Context Protocol [ 43 ] ; Maloyan and Namiot [ 49 ] ; Zhang et al. [ 50 ]	No released derived-support evidence in the current snapshot.
A2M	Agent-to-Market	Allouah et al. [ 51 ] ; Kapoor et al. [ 52 ]	Liu et al. [ 11 ] ; Chung and Honavar [ 53 ] ; de Paula et al. [ 54 ] ; Cai et al. [ 55 ]
T2T	Tool-to-Transaction	Acharya [ 18 ] ; Shittu [ 56 ] ; Ruan et al. [ 57 ]	Deng et al. [ 58 ]
P2K	Prompt-to-Key	Acharya [ 18 ]	Steinberger [ 3 ] ; Luo et al. [ 4 ] ; Rizinski and Trajanov [ 5 ]
C2E	Collusion-to-Escrow	Virtuals Protocol [ 30 ] ; Crapis et al. [ 35 ]	Liu et al. [ 11 ] ; Yu et al. [ 59 ] ; de Witt [ 60 ] ; Hu and Rong [ 61 ]

TABLE I: Per-vector released supporting works in the current public corpus.

Fig. 1: Five-dimensional threat taxonomy for autonomous financial agents.

Approach	Mechanism	Coverage	Overhead
Input sanitization	Filter malicious prompts from data feeds before model ingestion	Direct injection	Low
Instruction hierarchy	Privilege separation between system and user/data prompts	Direct & indirect injection	Medium
Output validation	Verify proposed actions against policy before execution	All integrity threats	High
Redundant reasoning	Cross-check decisions with multiple independent LLM instances	Model poisoning; subtle injection	Very High
Formal verification	Prove bounded safety properties of the agent pipeline	Broad but partial	Infeasible

TABLE II: Comparison of agent integrity defense approaches.

ID	Name	Layer Path	Core Mechanism
P2T	Prompt-to-Transaction	LLM $\to$ Blockchain	Injected prompt triggers signed tx
T2R	Tool-to-Reasoning	Tool $\to$ Reasoning	False data poisons decision
A2M	Agent-to-Market	Inter-agent $\to$ Market	LLM bias exploited in negotiation
R2I	Reg-to-Integrity	Compliance $\to$ Market	Regulatory gap enables laundering
T2T	Tool-to-Transaction	Tool $\to$ Blockchain	Tool modifies tx params post-reasoning
P2K	Prompt-to-Key	LLM $\to$ Custody	Injection bypasses key custody boundary

TABLE III: Summary of 12 cross-layer attack vectors for autonomous financial agents.

Protocol / Interface	Agent Integrity	Transaction Authorization	Inter-Agent Trust	Market Manipulation	Regulatory Compliance
Virtuals/ACP [ 30 ]	GAME framework	Escrow settlement	Evaluator agents	Token caps	On-chain logs
ERC-8183 [ 35 ]	N/A (standard)	Job state machine	3-role trust model	Hook-based	Reputation
ERC-8004 [ 10 ]	N/A (protocol level)	On-chain guardrails	Token-based ID	Spending caps	Audit logs
AP2 [ 11 ]	N/A (protocol level)	Intent verification	Payment attestation	N/A	Payment logs
OKX APP [ 12 , 29 ]	N/A (protocol level)	Challenge/credential auth	A2A escrow/dispute	N/A	Status queries
x402 [ 10 ]	N/A (protocol level)	Per-request auth	HTTP-level auth	Rate limiting	Request logs

TABLE IV: Security property comparison of representative agent-commerce protocols and execution interfaces. ‘N/A’ denotes a dimension outside the artifact’s intended scope.

Explore similar work

SoK: Trading Agents or Market Crashers? Dissecting Robustness and Security Failures in Academic Financial LLM Trading Schemes
Sep 17, 2026Mengxiao Wang, Nitesh SaxenaLLM Agent Security AI Agent Security Benchmarks
Texas A&M University
Security Attack and Defense Strategies for Autonomous Agent Frameworks: A Layered Review with OpenClaw as a Case Study
Apr 30, 2026Luyao Xu, Xiang ChenAI Agent Security LLM Agent Security
School of Artificial Intelligence and Computer Science, Nantong University, Nantong, China · State Key Lab. for Novel Software Technology, Nanjing University, Nanjing, China
Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation
Jun 9, 2026Yuchen Ling, Shengcheng Yu, Zhenyu Chen +1Prompt Injection LLM Agent Security
State Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China · Technical University of Munich, Heilbronn, Germany

Sep 17, 2026J/K move · Enter open · S save

SoK: Trading Agents or Market Crashers? Dissecting Robustness and Security Failures in Academic Financial LLM Trading Schemes

Mengxiao Wang, Nitesh Saxena

Texas A&M University

LLM Agent Security AI Agent Security Benchmarks LLM Agents LLM Agent Reliability

Open paper AskPDF arXiv

Autonomous large language model (LLM) agents are moving rapidly into high-stakes domains, yet existing agentic-AI security studies remain largely domain-agnostic and overlook the distinctive, high-consequence attack surface such settings create. We examine this gap through financial trading agents, a representative case of high-stakes agentic security, where a single compromised agent has direct execution authority over real capital in an adversarial, reflexive market. To this end, we present FARSIGHT (Financial Agent Robustness and Security Investigation and Global Holistic Testing), a framework that performs scheme-level evaluation of financial LLM agents on two axes: robustness under market turbulence (including flash-crash-like scenarios), and security against three attack types: attacks on information sources, attacks on agents, and agent-as-attacker behaviors. Applying FARSIGHT to 15 representative academic schemes, we find that most overlook robustness and realistic adversarial threats: 80% fail at least one core robustness metric and 100% exhibit security vulnerabilities. These two failure modes are inseparable: a small misjudgment can cascade into a market-wide crash on its own, while an adversary can deliberately trigger the same collapse at minimal cost.

Abstract

Explore similar work

SoK: Trading Agents or Market Crashers? Dissecting Robustness and Security Failures in Academic Financial LLM Trading Schemes

Security Attack and Defense Strategies for Autonomous Agent Frameworks: A Layered Review with OpenClaw as a Case Study

Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation