Agents that can buy, book, and transact turn a prompt injection into a financial loss. We cover the new risks of agentic commerce and why authorization and human confirmation belong around every consequential action.
Every risk we write about gets sharper when money enters the picture, and agentic commerce, AI agents that can purchase, book, subscribe, and transact on a user's behalf, puts money squarely in the path of an autonomous system that can be manipulated. The convenience is obvious: tell an agent what you want and it handles the buying. The exposure is just as obvious once you say it plainly: a prompt injection against an agent that can spend is no longer an embarrassing transcript or even a data leak. It is a financial transaction the user never authorised. If your product is heading toward letting agents transact, this is the risk you cannot afford to treat casually.
What changes when actions cost money
Throughout our writing we describe the breach chain: untrusted content hijacks the agent's goal, and its permissions decide the damage. In agentic commerce, "the damage" includes moving money. The same indirect injection that could make an agent leak a record can make a transacting agent buy the wrong thing, buy from the wrong place, subscribe to something, or send funds, all framed as completing the user's request. The agent is acting with the user's payment authority, so the attacker is, in effect, borrowing the user's wallet.
There are a few distinct exposures worth naming:
- Unauthorised transactions. A hijacked agent makes a purchase or payment the user never intended.
- Manipulated commerce content. Product listings, prices, and merchant pages are attacker-influenceable content the agent reads to make decisions; poisoned content can steer it toward the attacker's outcome.
- Authority confusion. As agents transact with merchants and other agents, proving who authorised what becomes critical, and weak authorization is an opening.
Why this demands more than detection
We are strong believers in detecting the injection that starts the chain, and that matters here too. But when the consequence is financial, we are equally firm that detection alone is not enough, because the cost of the rare miss is a real, possibly irreversible, transaction. This is one of the clearest cases for the principle we apply across agentic security: pair detection with hard limits on the action itself. An agent that can be manipulated should not also be able to spend without a boundary in between.
Concretely, that means consequential financial actions are exactly the kind that should not proceed on the agent's judgment alone. We treat executing a payment or a purchase the way we treat any high-stakes, hard-to-reverse action: it warrants explicit authorization and, for anything significant, human confirmation. The agent can prepare the transaction; a deliberate approval step decides whether it happens.
What actually helps
- Scan the content driving the decision. The listings, prices, and pages an agent reads to decide a purchase are untrusted content; evaluate them for manipulation before they steer a transaction.
- Gate transactions with authorization and confirmation. Consequential spending should require explicit approval, not flow automatically from a hijackable agent. Reserve human confirmation for the actions whose reversal is hardest.
- Scope spending authority tightly. Limit how much, where, and on what an agent can transact, so a manipulation hits a ceiling rather than an open account.
- Keep an auditable trail. Every agent-initiated transaction should be logged and attributable, so anomalies are visible and disputes are resolvable.
Frequently asked questions
Isn't requiring confirmation defeating the point of an autonomous agent? Only if you require it for everything. The right design lets routine, low-stakes actions flow freely and reserves confirmation for consequential, hard-to-reverse spending. You keep most of the convenience while removing the catastrophic, irreversible tail, which is exactly the trade worth making when money is involved.
Can't detection alone prevent unauthorised transactions? Detection is essential and not sufficient on its own when the downside is financial and irreversible. The rare miss costs real money, so you pair detection with limits and confirmation on the action, so that even a missed injection cannot translate directly into an unauthorised payment.
How is this different from normal payment fraud controls? Traditional fraud controls assume a human or a known system initiated the transaction. Agentic commerce adds an autonomous, manipulable initiator acting with the user's authority, which is a new variable. You still want classic fraud controls, plus controls specific to the agent: content scanning, scoped authority, and confirmation gates.
How Promptention helps
We approach agentic commerce the way we approach all high-stakes agent action: catch the manipulation, and constrain the action. Our detection evaluates the untrusted content an agent reads, including the commerce content that drives its decisions, for the injection and manipulation that would steer a transaction, and we help enforce policy on what an agent is permitted to do, so consequential spending runs into authorization boundaries rather than flowing automatically from a system that can be hijacked. When an agent can spend your money, "we detected most attacks" is not enough. We help make sure a missed one still cannot quietly buy something.
Promptention pairs injection detection with policy enforcement on agent actions, supporting safer agentic commerce and transaction authorization.
