AI Shopping Agents Could Be Hijacked for Retail Fraud, Unit 42 Warns

Palo Alto Networks Unit 42 published research on March 20, 2026 warning that AI shopping agents in agentic-commerce systems could be hijacked through indirect prompt injection to commit retail fraud, modeling two scenarios: hidden digital gift-card additions during checkout and automated abuse of return or refund workflows. Unit 42 did not report a confirmed breach, presenting the work as a risk analysis of poorly secured implementations rather than evidence of widespread attacks. The research highlights Google's Universal Commerce Protocol (UCP), announced in January 2026, which supports tokenized payments and verifiable credentials and works with Agent Payments Protocol (AP2), Agent2Agent (A2A) and Model Context Protocol (MCP).

AI shopping agents could become a new fraud target for retailers if attackers learn to manipulate the instructions, payment workflows or return processes those agents rely on. That is the central warning in new research from Palo Alto Networks Unit 42, which examined how agentic commerce systems could be abused through indirect prompt injection and automated fraud. The important distinction is that Unit 42 did not report a confirmed wave of AI agents stealing credit cards from retailers. Instead, the researchers modeled plausible fraud scenarios around emerging agentic-commerce protocols and explained where weak implementations could create new attack paths. That difference matters: this is a risk analysis of where retail fraud may evolve, not evidence that the described attacks are already widespread in production. What Unit 42 Actually Found In research published March 20, 2026, Unit 42 examined the security implications of agentic commerce — shopping systems where AI agents can browse products, compare options, assemble carts and potentially complete purchases on a user’s behalf. The research focuses heavily on indirect prompt injection . Instead of a user directly giving the AI a malicious instruction, an agent encounters attacker-controlled text or metadata while browsing a website, product listing or other external content. If the agent treats that content as trusted instructions, its behavior could be altered. Unit 42 explored two retail-focused scenarios: hidden gift-card additions during checkout and automated abuse of return or refund workflows. The examples were created to demonstrate potential weaknesses in poorly secured agentic-commerce implementations, not to document a specific breach. Why Agentic Commerce Changes the Retail Threat Model Traditional online shopping assumes a human is directly interacting with a retailer’s website or app. Agentic commerce changes that relationship. An AI agent may interpret the user’s intent, visit multiple services, build a cart and communicate with merchant systems through APIs or commerce protocols. This creates a new trust problem: the merchant needs to know not only who the customer is, but also whether the software acting for that customer is authorized, whether it is following the user’s instructions faithfully and whether external content has manipulated the agent. Google’s Universal Commerce Protocol UCP , announced in January 2026, is designed to provide a common language between consumer interfaces, retailers and payment providers. Google says UCP supports tokenized payments and verifiable credentials and can work with existing protocols such as Agent Payments Protocol AP2 , Agent2Agent A2A and Model Context Protocol MCP . Scenario 1: Hidden Gift-Card Fraud Through Prompt Injection One of Unit 42’s examples shows how an AI shopping agent could be exposed to malicious instructions on an attacker-controlled deals or coupon page. In the researchers’ scenario, the hidden instruction attempts to make the agent add an unauthorized digital gift card to the shopping cart and redirect the gift card to an attacker-controlled recipient. The underlying security issue is not the gift card itself. It is the possibility that an agent could confuse untrusted web content with instructions that are allowed to modify a transaction. A well-designed system should not let arbitrary website content silently modify the user’s approved purchase. Transaction state, payment authorization and user intent need to be protected by controls outside the language model’s free-form reasoning. Scenario 2: Automated Return and Refund Abuse Unit 42 also modeled a returns-fraud scenario in which malicious content tries to persuade an agent to skip a normal verification step and trigger a refund without a legitimate return. Again, the scenario is hypothetical. But the security lesson is practical: a generative AI model should not be able to bypass deterministic business controls simply because text on a product page tells it to do so. Refund eligibility, shipment status, transaction settlement and other high-impact actions should be verified by trusted backend systems. AI can help interpret requests, but the final authorization decision should be tied to validated state and explicit policy. This Is Not the Same as Credit-Card Data Theft Some coverage of the Unit 42 research frames the issue as AI agents enabling credit-card theft. That wording can be misleading if it implies that the researchers observed AI agents directly stealing consumers’ card numbers. The Unit 42 report is primarily about fraud through manipulated agent behavior : unauthorized cart changes, gift-card diversion and refund abuse. It does not present evidence of a specific production incident in which an AI shopping agent harvested card numbers from customers. That said, payment credentials are still part of the broader risk model. Any system that allows software agents to initiate purchases needs strong protections around tokenization, authorization, identity and transaction limits so that the agent does not receive more access than necessary. How Google Is Trying to Secure Agent-Initiated Payments Google’s Agent Payments Protocol AP2 , introduced in September 2025, was designed to address questions that become difficult when software acts on a person’s behalf: Did the user authorize the purchase? What exactly did the user approve? And who is accountable if the agent’s behavior changes? Google describes AP2 as a payment-agnostic framework that uses cryptographically signed, verifiable credentials to establish user intent and authorization. The protocol includes concepts such as an Intent Mandate and Cart Mandate , creating a record of what the user asked the agent to do and what transaction was ultimately approved. UCP builds on the broader agentic-commerce ecosystem by providing standardized commerce capabilities between agents and businesses. Google says payment authorizations in UCP can be backed by cryptographic proof of user consent. Payment Networks Are Building Their Own Agent Controls Visa is also building infrastructure specifically for agentic commerce. Visa Intelligent Commerce is designed to let AI agents initiate purchases using permissioned payment credentials, authentication and fraud controls. Visa says its agentic-commerce approach can use tokenized credentials rather than exposing the user’s underlying card data to the agent. The company has also described spending limits, approval thresholds, agent identification and fraud monitoring as important controls for AI-initiated transactions. In 2026, Visa reported live agentic-commerce transactions with participating merchants in Europe and expanded programs that allow issuers and partners to test card enrollment, tokenization, authentication and authorization for AI-initiated payments. The Bigger Problem: Legitimate Agent or Malicious Bot? Retailers already deal with automated traffic from scrapers, credential-stuffing tools, scalper bots and payment-fraud systems. Agentic commerce introduces a harder classification problem because some automated traffic is now legitimate and acting with the customer’s permission. Akamai reported in July 2026 that 47.9% of AI bot traffic observed across its global network from July through December 2025 was associated with the commerce vertical. Separately, HUMAN Security reported a large year-over-year increase in agentic traffic to retail and highlighted the challenge of distinguishing useful shopping agents from automation tied to account takeover and payment fraud. This means a simple “block all bots” strategy will become less practical. Retail security systems increasingly need to distinguish among verified customer-authorized agents, ordinary crawlers, unknown automation and clearly malicious bots. What Retailers Should Do Now 1. Keep payment authorization deterministic. A language model should not have unilateral authority to change a cart, issue a refund or move money. 2. Separate untrusted content from privileged instructions. Product pages, reviews, coupon sites and external metadata should be treated as untrusted input. 3. Require explicit user confirmation for material changes. New items, changed recipients, higher totals and payment-method changes should trigger a clear approval step. 4. Use tokenized payment credentials. Avoid exposing reusable card data or long-lived secrets to the agent whenever a scoped token can be used instead. 5. Bind actions to user intent. Cryptographically verifiable mandates or equivalent authorization records can help prove what the user actually approved. 6. Apply least privilege to agents. An agent that only needs to compare products should not automatically receive permission to purchase, refund or modify account details. 7. Verify return and refund state in trusted backend systems. Do not let free-form agent output override shipment, inventory or settlement records. 8. Log agent identity and transaction decisions. Retailers need audit trails that distinguish human actions from agent-initiated actions and record the permissions used. 9. Monitor for high-speed fraud patterns. Agent-enabled abuse can scale faster than manual fraud, so unusual cart, gift-card, refund and account behavior should be rate-limited and investigated. Why Consumers Should Care The security question for consumers is not simply whether an AI agent is “smart enough” to shop. It is whether the agent has narrowly defined authority and whether the payment system can prove what the user agreed to. Consumers should be cautious about giving experimental agents unrestricted access to reusable payment credentials. Transaction notifications, card controls, spending limits and clear confirmation screens remain useful safeguards as agentic shopping develops. Trust is still a major adoption barrier. In a Visa/Harris Poll survey fielded in May 2026, only 23% of U.S. consumers surveyed said they trusted generative AI to handle payment transactions on their behalf. That figure rose when respondents were asked about payments secured by Visa, illustrating how much the emerging market still depends on recognizable authorization and fraud controls. What the Research Does — and Does Not — Prove | Supported by the research | Not established by the research | |---|---| | Indirect prompt injection is a meaningful risk for tool-using AI agents. | That AI shopping agents are already stealing credit cards at scale. | | Agentic commerce can create new gift-card and refund-fraud opportunities if controls are weak. | That UCP itself has been broadly compromised in production. | | High-impact actions need authorization, identity and transaction controls outside the LLM. | That every agentic-commerce implementation is vulnerable to the example attacks. | | Retailers need to distinguish trusted agents from malicious automation. | That the scenarios described by Unit 42 were observed as real customer incidents. | Bottom Line AI agents are moving from recommending products toward taking actions on behalf of shoppers. That creates genuine opportunities for faster and more personalized commerce, but it also changes where trust must be enforced. Unit 42’s research is best read as an early warning: if retailers let probabilistic AI behavior directly control carts, gift cards, refunds or payment actions without strong deterministic safeguards, fraudsters may gain new ways to automate abuse. The answer is not to abandon agentic commerce, but to design it around verified identity, explicit user intent, tokenized payments, least privilege and backend enforcement. For teams building secure delivery pipelines around these systems, our DevSecOps security guide https://techupdate24.com/devsecops-interview-questions/ covers secrets, IAM, container security and supply-chain controls.