Skip to content
UCP
Menu

Security · Agentic Commerce

Security in agentic commerce: how UCP protects merchants and consumers

When an AI agent makes purchases on your behalf, fraud, spoofing, and unintended transaction risks exist. The Universal Commerce Protocol integrates multiple security mechanisms to protect all three transaction actors: the user, the AI agent, and the merchant. Here's how they work.

Editorial team · Updated : April 2026 · Primary query : agentic commerce security

Risk vectors specific to agentic commerce

Agentic commerce introduces risk vectors that classical e-commerce doesn't face:

  • Agent identity spoofing: a malicious actor impersonating a legitimate AI agent (Gemini, ChatGPT) to initiate fraudulent orders via UCP endpoints
  • AP2 session hijacking: intercepting a valid AP2 token to execute unauthorized transactions
  • Identity Linking attack: modifying delivery data during transmission between agent and merchant
  • AP2 permission abuse: a compromised AI agent (via prompt injection) making purchases beyond the user's intentions
  • Fraudulent merchants: stores that expose UCP endpoints but deliver products different from or inferior to their catalog description

UCP security mechanisms

1. Discoverable platform identity

Every REST request includes a UCP-Agent header pointing to the platform profile at /.well-known/ucp. UCP can also use RFC 9421 HTTP Message Signatures. The specification does not define a central UCP certificate authority.

2. AP2 mandates and receipts

When the optional AP2 extension is negotiated, signed Checkout and Payment Mandates bind authorization to checkout state. Each AP2 role verifies the artifacts assigned to it and returns signed receipts. Constraints depend on the mandate schema and flow; they are not a generic guarantee against every compromised-agent scenario.

3. Scoped Identity Linking

Identity Linking is based on OAuth 2.0 authorization and declared scopes. Businesses should request only the data needed for the transaction and enforce authorization on their own resource servers.

4. Verifiable AP2 evidence

AP2 mandates and receipts can provide verifiable evidence for disputes when their signatures and hash bindings validate. UCP itself does not automatically create or retain an immutable bilateral log.

5. Business-controlled post-purchase experience

The Order capability exposes current state, fulfillment events and adjustments, while the business permalink remains authoritative. UCP does not define a central merchant reputation registry.

Merchant security recommendations

  • Serve REST endpoints over HTTPS with TLS 1.3 or later, as required by the current binding
  • Apply authentication and rate limits based on the advertised transport and your risk model
  • Define retention from applicable legal, payment and security requirements
  • Regularly test your endpoints with the versioned UCP schemas and independent contract tests
  • Set up alerts for anomalies: order bursts, unusual amounts, unrecognized agents

User protection: what AI agents must do

UCP imposes behavior rules on AI agents to protect users:

  • Mandatory confirmation for transactions exceeding the user-defined threshold
  • Notification of every completed transaction with merchant, product, price, and order number details
  • Cancellation grace period: user has a configurable window to cancel an agentic order before preparation
  • Monthly summary of agentic purchases made, with option to revoke permissions

Further reading