{"slug": "signing-the-transaction-but-not-the-decision-whisper-attacks-and-a-binding", "title": "Signing the Transaction but Not the Decision: Whisper Attacks and a Binding", "summary": "A September 10, 2026 arXiv paper shows that agent payment protocols such as AP2 produce cryptographically valid signatures for completed purchases without constraining the decisions behind them, letting ordinary product-description text steer shopping agents into carts that pass every protocol check but do not match the user's request. Using the Gemini Flash-Lite models that AP2's sample agents specify by default, the paper's three attacks succeeded at rates of 90%, 56%, and 73.3%, and the same vulnerability appeared across seventeen Google models, three unrelated agent frameworks, two cross-vendor anchors, and Google's own consumer assistant. The authors introduce A-VIP (AP2 Verified-Intent Protection), a protocol-layer defense that binds every credential lookup to the requesting session and every cart line to the listing seen, blocking the first two attacks with zero false positives and surfacing the third for user confirmation, alongside the release of A-VIP code, machine-checked invariants, and AP2-WhisperBench, a suite of 1,544 evaluation scenarios.", "body_md": "# Computer Science > Cryptography and Security\n\n  [Submitted on 10 Sep 2026]\n\n# Title:Signing the Transaction but Not the Decision: Whisper Attacks and a Binding Defense for AP2\n\n[View PDF](/pdf/2609.11757)\n\n[HTML (experimental)](https://arxiv.org/html/2609.11757v1)\n\nAbstract:Software agents are beginning to shop and pay on a person's behalf. Agent payment protocols such as AP2 produce cryptographically valid signatures for completed purchases, yet do not constrain the decisions that lead to them. Consequently, ordinary product-description text can steer a shopping agent into forming a cart that passes every protocol check but no longer matches the user's request. In this paper, we show that this vulnerability enables three related attacks. In the first attack, the agent is steered into fetching another user's payment credentials. In the second, it assembles a cryptographically valid cart whose contents do not match what the user was shown. In the third, a single factual claim about stock or product lineage moves the agent from the cheaper displayed item to a more expensive one, while the resulting cart remains fully consistent with the listing. In experiments using the Gemini Flash-Lite models that AP2's sample agents specify by default, the three attacks succeeded at rates of 90%, 56%, and 73.3%, respectively. The same vulnerability appears across seventeen Google models, three unrelated agent frameworks, two cross-vendor anchors, and Google's own consumer assistant. To address this attack vector, we introduce A-VIP (AP2 Verified-Intent Protection), a protocol-layer defense that treats the signed intent as a capability grant rather than judging the merchant's description. The defense binds every credential lookup to the session that requested it and every cart line to the listing seen, while flagging unauthorized spending. The first two attacks leave structural traces that these bindings block with zero false positives. The third attack leaves no trace, so A-VIP surfaces unauthorized spending for user confirmation. Finally, we release the A-VIP code, machine-checked invariants, and AP2-WhisperBench, a suite of 1,544 evaluation scenarios.\n    \n\n### References & Citations\n\nLoading...\n\n# Bibliographic and Citation Tools\n\nBibliographic Explorer \n\n*(*[What is the Explorer?](https://info.arxiv.org/labs/showcase.html#arxiv-bibliographic-explorer))\nConnected Papers \n\n*(*[What is Connected Papers?](https://www.connectedpapers.com/about))\nLitmaps \n\n*(*[What is Litmaps?](https://www.litmaps.co/))\nscite Smart Citations \n\n*(*[What are Smart Citations?](https://www.scite.ai/))\n# Code, Data and Media Associated with this Article\n\nalphaXiv \n\n*(*[What is alphaXiv?](https://alphaxiv.org/))\nCatalyzeX Code Finder for Papers \n\n*(*[What is CatalyzeX?](https://www.catalyzex.com))\nDagsHub \n\n*(*[What is DagsHub?](https://dagshub.com/))\nGotit.pub \n\n*(*[What is GotitPub?](http://gotit.pub/faq))\nHugging Face \n\n*(*[What is Huggingface?](https://huggingface.co/huggingface))\nScienceCast \n\n*(*[What is ScienceCast?](https://sciencecast.org/welcome))\n# Demos\n\n# Recommenders and Search Tools\n\nInfluence Flower \n\n*(*[What are Influence Flowers?](https://influencemap.cmlab.dev/))\nCORE Recommender \n\n*(*[What is CORE?](https://core.ac.uk/services/recommender))\n# arXivLabs: experimental projects with community collaborators\n\narXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.\n\nBoth individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.\n\nHave an idea for a project that will add value for arXiv's community? [**Learn more about arXivLabs**](https://info.arxiv.org/labs/index.html).", "url": "https://wpnews.pro/news/signing-the-transaction-but-not-the-decision-whisper-attacks-and-a-binding", "canonical_source": "https://arxiv.org/abs/2609.11757", "published_at": "2026-09-13 06:07:08+00:00", "updated_at": "2026-09-13 06:27:54.829383+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-policy", "ai-research"], "entities": ["AP2", "A-VIP", "Gemini Flash-Lite", "Google", "AP2-WhisperBench", "arXiv"], "alternates": {"html": "https://wpnews.pro/news/signing-the-transaction-but-not-the-decision-whisper-attacks-and-a-binding", "markdown": "https://wpnews.pro/news/signing-the-transaction-but-not-the-decision-whisper-attacks-and-a-binding.md", "text": "https://wpnews.pro/news/signing-the-transaction-but-not-the-decision-whisper-attacks-and-a-binding.txt", "jsonld": "https://wpnews.pro/news/signing-the-transaction-but-not-the-decision-whisper-attacks-and-a-binding.jsonld"}}