How to secure agentic commerce transactions

Visa's Payment Ecosystem Risk and Control (PERC) team has identified a significant increase in dark web activity related to AI agent compromise, with a focus on exploiting these agents for fraudulent transactions that mimic legitimate behavior. The issue lies in agentic commerce, where AI agents, already entrusted with user credentials, can be hijacked to conduct unauthorized purchases, presenting a challenge for traditional fraud detection systems. The proliferation of AI-driven transactions, as seen with the launch of protocols like Google's Universal Commerce Protocol and OpenAI's Agentic Commerce Protocol, underscores the growing scale of agentic commerce, which is expected to handle a substantial portion of e-commerce by 2030. However, the current security model is inadequate, necessitating advancements in areas such as agent identity, scoped delegation, and transaction-level consent to mitigate risks. The responsibility for unauthorized transactions remains ambiguous, with industry stakeholders still grappling with liability issues, as highlighted by Hogan Lovells' analysis and the World Economic Forum's projections on AI agent exploitation in data breaches. To address these challenges, building infrastructure that ensures traceability and accountability through agent identity verification, scoped delegation, and comprehensive audit trails is crucial, even as the legal and regulatory frameworks evolve to catch up with the technological advancements.