Securing Agent-to-Agent Payments: A Threat Model for the Agent Economy

A defining feature of the agentic economy is that it uses modern technology to eliminate the need for humans in the loop and to expedite A2A transactions. 

Some of the key differences include:

• Delegated Authority: AI agents receive natural-language instructions and interpret these into a series of actions to take. Miscommunications, hallucinations, and prompt injection can all cause an intended task to go off the rails.
• Machine-Speed Transactions: AI agents often settle payments on-chain and can make decisions in microseconds. This means that A2A payments move too fast for humans to analyze or prevent before they are executed.
• On-Chain Settlement: The agentic economy is built on the blockchain, using stablecoins and smart contract wallets for A2A payments. In addition to fast transaction speeds, the blockchain also offers immutability, meaning that transactions can’t be reversed after they’re executed.

AI agents are imperfect systems that are prone to manipulation and hallucination, yet they’re being trusted with Web3 wallets and sensitive tasks. At the same time, A2A payments are performed on-chain, where reversing an incorrect transaction is generally infeasible.

A2A payments and the agentic economy unlock new capabilities, but they also introduce a range of new risks and threats. A threat model for the agentic economy should include:

• Prompt Injection: Prompt injection attacks use crafted inputs to trick agents into taking certain actions. In the agentic economy, this could mean manipulating agents into performing unauthorized payments or redirecting legitimate ones.
• Identity Spoofing: Agentic identity is a complex problem since anyone can spin up an agent, and agents can delegate tasks to one another. A malicious agent could impersonate another, trusted agent or a human principal to request that an agent make a malicious payment.
• Compromised Wallets: A2A payments rely on Web3 infrastructure, using Web3 wallets and stablecoins to perform payments rapidly on-chain. Insecure key management or signing processes could result in an attacker taking over and draining an agent’s wallet.
• Malicious Service Providers: In marketplaces, malicious or rogue agents can masquerade as legitimate service providers to trick agents into paying for fake services. Alternatively, agents can collude with one another to manipulate service pricing and negotiation.
• Smart Contract Vulnerabilities: A2A payments commonly use smart contracts as digital wallets and to encode certain functionality, such as escrow services. Vulnerabilities or logical errors in these smart contracts could allow an attacker to manipulate the terms of agreements or steal funds from escrow.
• Cascading Errors: AI agents have the ability to delegate tasks to one another, often resulting in a tree of agents addressing various sub-tasks at the direction of higher-level agents. Agents may also coordinate with one another within automated workflows and toolchains. Prompt injection or an error by a high-level agent could trigger unauthorized payments across multiple agents within an automated workflow.
• Oracle Manipulation: AI agents and smart contracts may rely on external data sources for certain information, such as prices, exchange rates, or proofs of task completion. If these data sources are compromised by an attacker, the agents could be fed false information as justification for fraudulent payments.

AI agents operate at machine speed and use irreversible on-chain transactions to perform micropayments to other AI agents. Managing these risks requires a focus on prevention since malicious or unauthorized transactions can’t be reversed after the fact.

Machine-speed, irreversible transactions make prevention a key element of any A2A payment security strategy. 

Best practices to help address the top risks of the agentic economy include:

• Cryptographic Agent Identity: AI agents need a way to authenticate one another’s identity before making payments or performing tasks. Agent identities should be backed by strong cryptography to reduce the risk of impersonation or theft.
• Payment Guardrails: AI agents may be tricked into performing fraudulent transactions that are impossible to reverse after the fact. Spending limits, allowlists, and policy engines should be incorporated into and enforced by smart contracts.
• HITL Checkpoints: High-value or anomalous transactions pose a significant risk since they’re irreversible if executed. Defining and enforcing conditions in smart contract code that require human approval allows high-risk transactions to be validated before it’s too late.
• Prompt Injection Resistance: Prompt injection requires input from users or third-party tools to be interpreted as commands. Sandboxing or separating data from instructions reduces the risk of injection attacks.
• On-Chain Monitoring: A2A payments are generally performed on-chain with stablecoins. On-chain monitoring and anomaly detection can help flag anomalous or malicious transactions so that compromised agents can be stopped before more damage is done.
• Multi-Agent Consensus: For high-value, high-speed transactions, protocols can implement multi-agent consensus or attestation. This reduces the risk that an agent could misinterpret an instruction or that an attacker could successfully carry out a prompt injection attack.

Managing the security threats of A2A payments requires a strong understanding of both AI and Web3 and their associated risks. AI agents are vulnerable to prompt injection and hallucinations, and they might be exploited via their reliance on on-chain transactions to perform A2A payments.

Halborn offers advisory and smart contract auditing services designed to help projects bake security into their protocols, code, and off-chain processes from the very beginning. If your team is working to build the agentic economy and wants to ensure compliance with industry best practices and regulatory requirements, get in touch with Halborn.