Three agentic payment protocol architectures—AP2, TessPay, and On-Chain ERC-4337—shown as flow stages. Toggle Attack Mode to highlight where prompt injection compromises each design. Click a column to inspect protocol details.
AP2 mandates are signed after the LLM picks the target. Injected text can redirect payment to a malicious merchant before the signature is computed — and 3.8 ms of zero-trust nonce verification closes a different gap entirely.