PaperlayerView exact revision on arXiv

Source-linked AI summary

SoK: Security of Autonomous LLM Agents in Agentic Commerce

Qian'ang Mao, Jiaxin Wang, Ya Liu, Li Zhu, Cong Ma, Jiaqi Yan

arXiv:2604.15367v2cs.CRcs.MA

TL;DR

Autonomous LLM agents are moving financial activity toward transactions without per-transaction human oversight, while the maturity and deployment status of agent-payment protocols vary. This SoK curates a public corpus to organize threats and analyze their cross-layer propagation; it concludes that secure deployment requires coordinated controls across agent integrity, authorization, trust, markets, and regulation.

  • Problem

    Autonomous financial agents combine LLM reasoning with financial transactions, while protocol deployment varies and the paper identifies no existing end-to-end coverage of the resulting threat surface.

    Source: §1 · p. 1, §2.2.10 · p. 4, §6 · p. 13

  • Method

    The paper synthesizes a curated public corpus and organizes autonomous-agent threats into a five-dimensional taxonomy.

    Source: §1 · p. 2

  • Results

    The SoK concludes that autonomous financial-agent security is cross-layer: threats can originate in reasoning, tools, identity, or inter-agent interaction and produce harm in custody, settlement, markets, or compliance.

    Source: §6 · p. 12

  • Takeaways & Limitations

    Secure deployment requires coordinated controls across agent integrity, authorization, trust, market structure, and regulation rather than point defenses alone.

    Source: §6 · p. 12

    Vectors with fewer released direct-support papers are more speculative and are priorities for future empirical work.

    Source: §3.3 · p. 5

Abstract

from arXiv · show

Autonomous large language model (LLM) agents such as OpenClaw are pushing agentic commerce from human-supervised assistance toward machine actors that can negotiate, purchase services, manage digital assets, and execute transactions across on-chain and off-chain environments. Protocols such as the Trustless Agents standard (ERC-8004), Agent Payments Protocol (AP2), OKX Agent Payments Protocol (APP), the HTTP 402-based payment protocol (x402), Agent Commerce Protocol (ACP), the Agentic Commerce standard (ERC-8183), and Machine Payments Protocol (MPP) enable this transition, but they also create an attack surface that existing security frameworks do not capture well. This Systematization of Knowledge (SoK) develops a unified security framework for autonomous LLM agents in commerce and finance. We organize threats along five dimensions: agent integrity, transaction authorization, inter-agent trust, market manipulation, and regulatory compliance. From a systematically curated public corpus of academic papers, protocol documents, industry reports, and incident evidence, we derive 12 cross-layer attack vectors and show how failures propagate from reasoning and tooling layers into custody, settlement, market harm, and compliance exposure. We then propose a layered defense architecture addressing authorization gaps left by current agent-payment protocols. Overall, our analysis shows that securing agentic commerce is inherently a cross-layer problem that requires coordinated controls across LLM safety, protocol design, identity, market structure, and regulation. We conclude with a research roadmap and a benchmark agenda for secure autonomous commerce.

1. Introduction

Autonomous LLM agents combine financial decision-making with the ability to negotiate and execute transactions, while emerging payment protocols enable machine-to-machine commerce. The paper addresses fragmented security research with a cross-layer analysis, protocol assessment, threat taxonomy, curated corpus, and layered defense framework.

Motivation

  • LLM agents differ from rule-based automated trading systems by using reasoning, planning, and natural-language understanding to negotiate and adapt strategies in real time.The introduction cites OpenClaw as an example of agents that can manage cryptocurrency portfolios, execute DeFi trades, and interact with smart contracts.Source: §1 · p. 1
  • Security research remains fragmented, and no existing framework addresses the full stack of LLM, payment-network, financial, and multi-agent concerns.The paper describes failures such as prompt injection, malicious integrations, and coordinated agent attacks as capable of cascading across layers.Source: §1 · pp. 1–2

Unified Threat Taxonomy

  • The paper organizes autonomous-agent threats across five dimensions: agent integrity, transaction authorization, inter-agent trust, market manipulation, and regulatory compliance.The taxonomy frames financial-agent security as a connected problem rather than a concern limited to one technical layer.Source: §1 · p. 2

Cross-Layer Analysis

  • The analysis characterizes 12 cross-layer attack vectors, tracing how vulnerabilities such as prompt injection can propagate into harms such as unauthorized token transfers.It also identifies adversary preconditions and mitigations for these vectors.Source: §1 · p. 2

Protocol Security Assessment

  • The protocol assessment examines ERC-8004, AP2, OKX APP, x402, and MPP for weaknesses that are more dangerous under autonomous deployment than human operation.The protocols support the shift toward agents that can hold or transfer tokens, pay for services, and transact with minimal human oversight.Source: §1 · pp. 1–2

Defense Framework

  • A proposed layered defense architecture spans prompt hardening, payment authorization, tool provenance, decentralized identity, and market-level safeguards.The framework relates its controls to the paper’s threat taxonomy.Source: §1 · p. 2

Corpus-Grounded Synthesis

  • The analysis is grounded in a systematically curated public corpus of academic papers, protocol documents, industry reports, and incident evidence.The corpus informs the threat taxonomy, protocol assessment, and comparative analysis.Source: §1 · p. 2

2. Background and Terminology

The paper defines autonomous financial agents by their persistent financial state, independent transaction execution, lack of per-transaction approval, and external-system interactions. It situates these agents within emerging payment and commerce protocols, then states the autonomy levels and deployment scope considered.

2.1. Defining Autonomous Financial Agents

  • An autonomous financial agent maintains financial assets or payment instruments, independently plans and executes transactions without per-transaction approval, and interacts with external systems.The definition includes wallets, accounts, and delegated payment credentials; it excludes human-confirmed trading tools, fixed-rule bots, and non-executing advice chatbots.Source: §2.1 · p. 2

2.2.1. OpenClaw and Clawdbot.

  • OpenClaw is an open-source framework connecting LLM reasoning to blockchain transaction execution through plugins, with agents controlling private keys or delegated signing authority.It exemplifies an “agent-as-wallet-holder” design.Source: §2.2.1 · p. 2

2.2.2. ERC-8004.; 2.2.3. Agent Payments Protocol (AP2).

  • ERC-8004 provides a smart-contract interface for agent-controlled token operations, including agent identity verification, spending limits, and revocation mechanisms.AP2 adds payment intents: machine-readable descriptions of desired payment outcomes for agents to negotiate before committing.Source: §2.2.2 · p. 2, §2.2.3 · pp. 2–3

2.2.4. OKX Agent Payments Protocol (APP).

  • OKX APP describes agent communication and commerce flows, with four payment intents and a Broker role that verifies credentials, submits settlements, and exposes status.Its escrow and dispute-handling descriptions are inconsistent across launch materials and implementation documentation, so its security properties require specification-level validation.Source: §2.2.4 · p. 3

2.2.5. Virtuals Protocol and Agent Commerce Protocol (ACP-Commerce).; 2.2.6. ERC-8183: Agentic Commerce Standard.

  • ACP coordinates negotiation, escrowed payment and deliverables, evaluator review, and settlement; its evaluator supports subjective tasks but creates an attack surface if compromised.ERC-8183 defines Client, Provider, and Evaluator roles around a Job state machine; its stated transaction-volume motivation is unaudited.Source: §2.2.5 · p. 3, §2.2.6 · p. 3

2.2.8. Tempo and Machine Payments Protocol (MPP).; 2.2.10. Protocol Deployment Status and Maturity.

  • MPP standardizes a challenge–credential–receipt flow over HTTP 402, supporting one-time charges and session-based, escrow-backed pay-as-you-go channels.The paper distinguishes payment protocols by deployment maturity: MPP has a live Tempo mainnet deployment, while several others remain proposals, drafts, or platform-specific deployments.Source: §2.2.8 · p. 3, §2.2.10 · p. 4

2.2.9. Model Context Protocol (MCP).

  • MCP standardizes agent access to tools, data, and services, and its security properties affect financial operations conducted through it.The paper notes older agent-payment research, while identifying open-ended LLM reasoning, untrusted tool use, and natural-language attack surfaces as new features of the current setting.Source: §2.2.8 · p. 3, §2.2.9 · p. 4

2.3. Levels of Agent Autonomy; 2.4. Scope and Boundaries

  • The paper focuses on Level 2 and Level 3 agents, which execute broad or fully autonomous financial operations with periodic or no per-transaction human oversight.Its primary scope is blockchain- and API-based agentic commerce; traditional payment rails and cross-chain operations are out-of-scope extensions.Source: §2.3 · p. 4, §2.4 · p. 4

3. Methodology

The methodology combines a targeted, multi-source literature review with structured selection and coding, then derives attack vectors through layer-pair analysis. It organizes the synthesis around five security dimensions and positions the finance-specific focus relative to broader LLM-agent surveys.

3.2. Selection Criteria

  • The review includes work on autonomous financial agents, payment and settlement protocols, autonomous-execution attacks and defenses, empirical agent behavior, and trust, identity, and authorization.It excludes generic LLM capability work without financial-security relevance, traditional trading without agent autonomy, and policy discussion without concrete security content.Source: §3.2 · p. 4

3.3. Selection Process and Evidence Base

  • The public corpus contains 37 database-retrieved works and 105 works added through snowballing and targeted inclusion of poorly indexed sources.The search covered five intersecting research communities and 23 phrases; 1,373 records were reduced to 1,237 candidates before screening.Source: §3.3 · pp. 4–5, §3.1 · p. 4
  • On 17 rows with non-empty labels from both coders, agreement was κ = 0.850 for source-layer labels, κ = 0.833 for target-layer labels, and κ = 0.871 for joint ordered pairs.The figures are reported for the released 30-row blinded replication set.Source: §3.3 · p. 5

3.4. Cross-Layer Vector Derivation

  • The 12 vectors were derived by enumerating system layers, testing whether compromise in each ordered pair could induce harm while bypassing the target layer’s defenses, and consolidating evidenced paths.Recurring but previously unnamed paths were generalized into cross-layer vectors.Source: §3.4 · p. 5

3.5. Analysis Dimensions

  • The coding scheme assigns works to topical buckets C0–C5 and organizes the synthesis around security dimensions D1–D5.Sources may receive secondary topical buckets and additional dimension flags when they bridge communities or framework dimensions.Source: §3.5 · p. 5

3.6. Positioning Against Related LLM-Agent Security Surveys

  • Compared with broader LLM-agent surveys, this SoK focuses more narrowly on financial irreversibility, custody, settlement integrity, evaluator-mediated commerce, market manipulation, and compliance exposure.It connects these concerns to deployed or emerging agent-payment protocols and interprets otherwise generic safety and authorization controls in a finance-specific context.Source: §3.6 · p. 5

4. Systematization Framework

The framework organizes autonomous financial-agent security concerns into five distinct dimensions. Table 1 catalogs released supporting works by attack vector.

4. Systematization Framework

  • The proposed framework organizes autonomous financial-agent security concerns into five distinct dimensions.Figure 1 illustrates the taxonomy.Source: §4 · p. 5, Figure 1 · p. 6
  • Each dimension captures a distinct security concern arising from the intersection of LLM-based autonomy and financial operations.Source: §4 · p. 5
  • Table 1 lists released supporting works for each attack vector in the public corpus.Source: Table 1 · p. 6

4.1. Dimension 1: Agent Integrity

Agent integrity concerns whether an agent’s decision-making has been compromised and diverted from its intended financial objectives. The section covers attacks on inputs, models, tools, and persistent memory.

4.1. Dimension 1: Agent Integrity

  • Agent integrity is whether compromised decision-making causes an agent to deviate from its intended financial objectives.The natural-language interface creates attack surfaces absent from traditional automated systems.Source: §4.1 · p. 6

4.1.1. Prompt Injection Attacks.

  • Prompt injection can enter through financial data, on-chain metadata, or inter-agent messages, and successful attacks can trigger irreversible transactions.Financial data injections may be economically motivated; inter-agent injections can cascade across networks.Source: §4.1.1 · p. 6

4.1.2. Model Poisoning and Backdoors.

  • Fine-tuning data can embed backdoor triggers that cause specific financial behaviors while leaving an agent apparently normal on most inputs.The opacity of LLM decision-making can make trigger-specific adversarial trades difficult to detect.Source: §4.1.2 · p. 6

4.1.3. Tool and Plugin Compromise.

  • Compromised tools can provide false information or execute transactions different from those requested, bounding agent security by its weakest integration.Proposed defenses attribute tool calls to their causally responsible prompt context so suspicious calls can be blocked before execution.Source: §4.1.3 · pp. 6–7

4.1.4. Memory Injection and Persistent Store Poison-

  • Memory injection can bias future decisions across sessions, while write-path poisoning, retrieval manipulation, and stale memories present distinct risks.Proposed safeguards include provenance tags, trusted-write checks, robust retrieval testing, TTL-bounded entries, and periodic audits.Source: §4.1.4 · p. 7

4.2. Dimension 2: Transaction Authorization

Transaction authorization concerns whether an agent’s financial actions are properly bounded and verifiable. The section considers credential exposure, spending policies, and checking that intent matches execution.

4.2. Dimension 2: Transaction Authorization

  • Transaction authorization asks whether an autonomous agent executes only financial actions it is authorized to perform.Source: §4.2 · p. 7

4.2.1. Credential and Key Management for Autonomous

  • Agents holding wallet credentials, payment secrets, or private keys can be prompt-injected into revealing or misusing them.Multi-signature schemes, scoped API tokens, and HSMs can limit exposure, but may add latency incompatible with high-frequency operations.Source: §4.2.1 · p. 7

4.2.2. Spending Policies and Bounds.

  • ERC-8004 provides on-chain spending limits and allowances, but policies must balance unauthorized large transactions against impeding legitimate operations.Permissions should be attenuated, contextual, and bound to a narrow task rather than broad standing authority.Source: §4.2.2 · p. 7

4.2.3. Intent

  • AP2 separates intent declaration from execution for pre-execution verification, while MPP binds payment challenges to request bodies using content digests.These mechanisms address mismatches between an agent’s intended action and the encoded payment instruction or transaction, including replay against a modified API call.Source: §4.2.3 · p. 7

4.3. Dimension 3: Inter-Agent Trust

As agents increasingly transact with other agents, identity, negotiation, and coordinated behavior create trust challenges. LLM agents may be manipulated individually or compromised instructions may spread across a network.

4.3. Dimension 3: Inter-Agent Trust

  • Increasing agent-to-agent interaction introduces trust challenges with no direct parallel in human-operated systems.Source: §4.3 · p. 7

4.3.1. Agent Identity and Authentication.

  • Wallet addresses and signatures do not convey an agent’s capabilities, authorization level, or operating policies, while Sybil identities can manipulate reputation or enable wash trading.Source: §4.3.1 · p. 7

4.3.2. Negotiation Integrity.

  • LLM agents may be vulnerable to persuasion, anchoring, and adversarial framing in negotiations, enabling messages crafted to obtain unfavorable terms for a victim.Source: §4.3.2 · p. 8

4.3.3. Collusion and Coordination Attacks.

  • Coordinated agents can manipulate prices, run pump-and-dump schemes, or corner markets, and natural-language communication makes collusion harder to detect.Source: §4.3.3 · p. 8

4.3.4. Cascading Compromise via Prompt Infection.

  • Self-replicating prompt injection can spread from one compromised agent through recipient agents, potentially disseminating malicious trading instructions before safety checks trigger.The paper recommends message-origin tagging and stricter sanitization of agent-sourced content.Source: §4.3.4 · p. 8

4.4. Dimension 4: Market Manipulation

Autonomous agents create market-manipulation risks through rapid, adaptive execution and correlated behavior, while DeFi transaction exposure adds a distinct sandwich-attack risk.

4.4.1. Agent-Driven Market Manipulation.

  • LLM reasoning combined with automated execution can support continuous, adaptive market manipulation, including behavior that may emerge under profit-maximizing objectives.Agent-based schemes can coordinate across markets and operate at machine speed [9],,.Source: §4.4.1 · p. 8

4.4.2. Adversarial Herding.

  • Shared models and training data can produce correlated agent behavior that adversarial signals exploit to trigger flash crashes or artificial price spikes.Per-agent authorization cannot prevent harmful aggregate effects when individual actions remain within scope; proposed controls include portfolio- and market-level circuit breakers and model diversity mandates.Source: §4.4.2 · p. 8

4.4.3. Sandwich Attacks on Agent Transactions.

  • Publicly broadcast DeFi transactions can be sandwiched through front-running and back-running, while private order flow, auctions, and slippage bounds offer defenses with different execution trade-offs.Private RPC routing adds 50–200 ms to next-block inclusion; orderflow auctions add a 300–800 ms window, while slippage bounds add no latency but may cause reverts if too tight.Source: §4.4.3 · p. 8

4.5. Dimension 5: Regulatory Compliance

Autonomous financial agents raise compliance questions about customer identity, regulated-party status, liability, and auditability. The section maps these issues to obligations and engineering controls.

4.5.1. KYC/AML for Non-Human Actors.

  • Because KYC/AML frameworks assume human account holders, agent-mediated transactions leave the customer’s identity ambiguous and may obscure beneficial ownership.The text identifies the deployer, model provider, and framework developer as possible candidates for the customer role,.Source: §4.5.1 · p. 9
  • The section maps BSA, MiCA, and FATF obligations to agent deployments, including reporting, licensing, and travel-rule requirements.It links structuring detection to SAR filing and beneficiary-information exchange to agent-to-agent payments –.Source: §4.5.1 · p. 9, §4.5.5 · p. 9

4.5.2. VASP Classification and Principal Liability.

  • The proposed principal model assigns deployment-time KYC to deployers, AML monitoring to infrastructure operators, and automated execution to the agent instance.The text interprets the infrastructure operator as the liable VASP under FATF Guidance (2023).Source: §4.5.2 · p. 9

4.5.3. Liability Attribution.

  • Responsibility for financial harm is difficult to attribute across model providers, framework developers, tool providers, and deployers, weakening incentives for comprehensive security.The passage states that adversaries can exploit this diffusion of responsibility,.Source: §4.5.3 · p. 9

4.5.4. Audit Trail Requirements.

  • Audit requirements may exceed protocol traces because compliance may require logs of the reasoning behind transactions, while x402 and MPP metadata remain insufficient for full compliance.The proposed controls include beneficial-owner binding, cumulative exposure monitoring, provenance exchange, and tamper-evident logs,,.Source: §4.5.4 · p. 9, §4.5.5 · p. 9

4.6. Incident Lessons

Incident evidence and constructed scenarios point to cross-dimensional, systemic, and cumulative risks that motivate layered controls.

4.6. Incident Lessons

  • Attacks often cross dimensions, linking token-metadata injection, compromised tools, or evaluator manipulation to downstream harm.The examples connect these failures to authorization, market harm, or settlement.Source: §4.6 · p. 9
  • A single platform-level flaw can affect many agents, as illustrated by the Virtuals launch vulnerability.Source: §4.6 · p. 9
  • Subtle oracle drift, repeated negotiation exploitation, and under-threshold structuring can accumulate into portfolio or compliance harm over time.OpenClaw lifecycle analysis likewise identifies compounding attack opportunities across initialization, memory, inference, and execution [58].Source: §4.6 · p. 9

5. Comparative Analysis

The comparative analysis evaluates defenses, attack vectors, protocols, and research gaps across the taxonomy. Its central finding is that no single protocol or control covers the full execution path.

5.1.1. Agent Integrity Defenses.

  • Agent-integrity defenses range from input sanitization and output validation to runtime context checks and pre-invocation tool-provenance verification.Redundant reasoning can catch individual model failures but multiplies costs and may fail when instances share vulnerabilities.Source: §5.1.1 · p. 10

5.1.2. Transaction Authorization Defenses.

  • Authorization options include tamper-resistant but inflexible contract guardrails, multi-signatures, intent and request binding, and decentralized identities with unresolved credential and governance issues.Source: §5.1.2 · pp. 10–11, §5.1.3 · p. 11

5.1.3. Inter-Agent Trust Defenses.

  • Reputation systems face cold starts and adversarial farming, while escrow and evaluator models reduce counterparty trust but create evaluator-specific risks.The analysis identifies bribery, Sybil clusters, collusion, and evaluator substitution, with bonding, committee selection, independence attestation, and anomaly monitoring as mitigations.Source: §5.1.3 · p. 11

5.2. Cross-Layer Attack Vectors

  • The analysis identifies 12 cross-layer attack vectors; P2T, T2R, T2T, and S2I pose immediate deployment risks, while C2E, O2P, and N2C accumulate more slowly.The vectors differ in how they corrupt reasoning, execution, or signing and in the controls each requires.Source: Table 3 · p. 11, §5.2 · p. 11

5.3. Comparative Assessment of Protocols and Interfaces

  • Payment and commerce protocols improve authorization, settlement, or coordination, but none alone addresses LLM compromise, long-horizon manipulation, and regulatory compliance.MCP contributes tool-access control and auditability as an execution interface; marketplaces also retain evaluator-governance, listing-integrity, and dispute-resolution issues.Source: §5.3 · p. 12

5.4. Layered Defense Architecture

  • The proposed defense architecture layers input and tool hygiene, verified execution context, scoped payment authorization, inter-agent trust controls, and market and compliance monitoring.Source: §5.4 · p. 12

5.5. Open Problems and Research Agenda

  • Research priorities include finance-specific benchmarks, long-horizon monitoring, mature inter-agent governance, and broader study of traditional payment rails and cross-chain deployments.Stricter authorization and slower review may suit portfolio agents better than spot traders, but do not remove the need for custody boundaries and market monitoring.Source: §5.5 · p. 12

6. Conclusion

The conclusion frames autonomous financial-agent security as a cross-layer problem: threats can begin in reasoning, tools, identity, or inter-agent interaction and surface as custody, settlement, market, or compliance harms. It argues that secure deployment requires coordinated controls rather than point defenses.

6. Conclusion

  • As agentic finance matures, its security challenges are expected to become more consequential.Source: §6 · p. 12
  • Security failures can originate in reasoning, tools, identity, or inter-agent interaction and surface as custody, settlement, market, or compliance harms.The conclusion characterizes autonomous financial-agent security as a cross-layer problem.Source: §6 · p. 12
  • Agentic-finance risk arises from interactions between financial irreversibility, reduced human oversight, and LLM security risks—not merely their sum [7],.The conclusion also challenges assumptions that humans can intervene, prompt injection is localized, or on-chain finality implies correctness.Source: §6 · p. 13
  • When many agents share a foundation model or execution stack, one exploit can propagate into market-wide disruption.The conclusion describes systemic risk from model and protocol homogeneity as underappreciated.Source: §6 · p. 13
  • No existing system or protocol offers end-to-end coverage of this threat surface, motivating the paper’s layered defense architecture.The authors conclude that point defenses are insufficient and coordinated controls are needed across agent integrity, authorization, trust, market structure, and regulation.Source: §6 · pp. 12–13
  • The protocols being designed now will shape autonomous-agent transaction infrastructure, and securing it is a prerequisite for responsible deployment in finance.The authors offer their framework, corpus, attack taxonomy, defense architecture, and research agenda as a foundation for that effort.Source: §6 · p. 13
Loading 2604.15367v2…