# The State of Agent Trust 2026

Autonomous agents are starting to pay, buy, and hire on their own. The rails are live, the attacks are real, and the standards underneath do not yet answer the question of whether the agent on the other side can be trusted. Here is the evidence, and the gap a trust layer has to close.

_Last updated 2026-06-25._

## The agent economy is scaling faster than the trust to govern it

Automated activity is climbing fast. HUMAN Security measured traffic from AI agents and agentic browsers growing 7,851% year over year in 2025, and automated traffic growing roughly eight times faster than human traffic [1].

The rails to move money are already in production. Stripe lets businesses accept payments initiated by AI agents and automated systems, and runs a hosted Model Context Protocol server that any compatible client can connect to [2]. Google published the Agent Payments Protocol for agent led payments on a user's behalf [3].

So agents can now present products, manage carts, and initiate payments, and the volume of automated traffic is rising quickly. What the rails do not answer is whether the counterparty agent is who it claims to be, is acting within its authority, has a good record, or can be held to account if a deal goes wrong.

> Source note: the two traffic growth figures come from a single vendor benchmark with a commercial interest, measured off a small 2024 base. Read them as what HUMAN Security measured on its own platform, not as independent fact.

## The core failure is prompt injection

OWASP ranks prompt injection as the top risk for large language model applications, with impacts that include executing commands in connected systems and gaining unauthorized access to functions [5]. For an agent that can spend money, those impacts are transactions.

It is no longer theoretical. Palo Alto Unit 42 reports that indirect prompt injection through web content is being actively weaponized, documenting real cases and payload techniques, rooted in an agent's inability to tell instructions from data when both arrive in one content stream [6].

The scale is large. In a public red team competition of 1.8 million attacks against 22 frontier agents across 44 scenarios, more than 60,000 attacks triggered real policy violations including illicit financial actions, and nearly every agent was breakable within 10 to 100 queries [7].

And it may not be fixable with rules alone. A 2026 result framed through contextual integrity argues that an adversary can always construct a context in which a blocked action looks legitimate, reaching a 96.7% attack success rate against an email assistant and transferring across models [8]. Most striking: even with no attacker present, agents let authority from one task leak into an unrelated one in up to 65% of cases, which is direct evidence that agents act outside their authorized scope on their own [8].

## The standards landscape, and what each one leaves open

The emerging standards each solve one slice of the problem and explicitly defer the rest.

| Standard | Layer it addresses | What it does not solve |
| --- | --- | --- |
| A2A Agent Cards | Identity | Cards can be spoofed or misconfigured, and A2A has no built in reputation between agents [10] |
| AP2 mandates | Authority | Cryptographic mandates do not stop prompt injection of the agent reasoning that decides when a mandate is used [3][9] |
| Model Context Protocol | Integration | Connectivity, not trust. It widens the surface that injection can reach |
| Stripe Agent Toolkit | Money movement | Moves funds, but does not verify the counterparty or provide recourse [2] |

AP2 targets authorization, authenticity, and accountability through signed mandates and a non repudiable audit trail [3]. But a red team study found that AP2 fails to protect against contextual manipulation of agent reasoning and lacks effective mechanisms for mitigating prompt injection [9]. The mandate constrains what is permitted. It does not constrain the reasoning about when and how the mandate gets invoked.

A2A establishes identity through Agent Cards. A Cloud Security Alliance threat model found those cards can be spoofed or manipulated, enabling agent impersonation, and that A2A has no built in trust mechanism between agents, recommending that a reputation system be added to track agent behavior [10].

> Framing note: the A2A weaknesses are named threats from a threat model, not documented exploits in the wild, and A2A offers optional mitigations such as signed cards and mutual TLS. The load bearing point is that no standard supplies inter agent reputation, which holds across the sources.

## The financial stakes

There is no measured dollar figure yet for agent to agent or agent payment fraud specifically. That data is genuinely sparse, and any agent specific loss number today would be speculative.

The closest available proxy is broad generative AI fraud. Deloitte projects that generative AI could enable US fraud losses of $40 billion by 2027, up from $12.3 billion in 2023, a 32% compound annual growth rate, and notes a sharp rise in deepfake incidents in financial services [4].

> Read this as adjacency, not measurement. The Deloitte figures cover generative AI fraud broadly, including deepfakes and banking, not AI agent transactions. They are the closest proxy for the stakes, not a direct count of agent fraud.

## The four gaps a trust layer has to close

Mapping the evidence, the standards leave four complementary gaps. Each maps to a check that has to happen before money moves.

- Identity, or Know Your Agent. Verify the agent's signed credential and the operator behind it, because a card on its own can be spoofed [10].
- Authority. Enforce scoped mandates at runtime, because a cryptographic mandate does not constrain the reasoning that invokes it, and agents leak authority across tasks even with no attacker present [8][9].
- Reputation. A transparent, cross source behavioral score, because no standard supplies one and reputation cannot live inside any single rail [10].
- Recourse. Escrow and the ability to undo a bad transaction, because none of the standards provide recovery, only an after the fact audit trail [3].

Each standard solves one layer and explicitly defers the others. That is the case for a neutral trust layer that spans all four, sits above the rails, and is owned by none of them.

> This four part mapping is our synthesis of the sources rather than a claim from any single one. The recourse gap in particular is argued from the absence of any recovery mechanism in the standards, not from an explicit statement that none exists.

## How this report was made

This report was assembled from a multi source research pass across primary sources, including arXiv preprints, OWASP, Palo Alto Unit 42, the Cloud Security Alliance, and vendor documentation from Stripe and Google. Each load bearing claim was checked independently by multiple adversarial reviewers, and claims that could not survive scrutiny were dropped before publication.

Two claims were refuted in verification and are deliberately excluded: a specific dollar value theft driven by prompt injection, and a precise AP2 launch date with a named partner list. Both should be re verified independently before anyone cites them.

This is a fast moving area. Vendor capabilities, partner lists, and protocol details change often and should be checked against the primary sources at the time of reading.

## What we still do not know

- What the actual measured losses are from agent to agent or agent initiated payment fraud, as opposed to generative AI fraud broadly. No source in this set quantifies it.
- Whether there are confirmed real world incidents, outside the lab and red team setting, of an agent being induced to complete an unauthorized payment with a verified amount.
- How AP2 adoption compares to A2A and the Model Context Protocol in practice.
- Whether a production stack that combines signed identity, scoped mandates, cross source reputation, and recourse measurably reduces agent fraud and successful injection attacks.

## Sources

1. 2026 State of AI Traffic, HUMAN Security. https://www.humansecurity.com/learn/resources/2026-state-of-ai-traffic-cyberthreat-benchmarks/
2. Agents and agentic commerce, Stripe. https://docs.stripe.com/agents
3. Announcing the Agent Payments Protocol (AP2), Google Cloud. https://cloud.google.com/blog/products/ai-machine-learning/announcing-agents-to-payments-ap2-protocol
4. Deepfake banking fraud risk on the rise, Deloitte Center for Financial Services. https://www.deloitte.com/us/en/insights/industry/financial-services/deepfake-banking-fraud-risk-on-the-rise.html
5. LLM01: Prompt Injection, OWASP. https://genai.owasp.org/llmrisk/llm01-prompt-injection/
6. AI agent prompt injection in the wild, Palo Alto Networks Unit 42. https://unit42.paloaltonetworks.com/ai-agent-prompt-injection/
7. Large scale red teaming of frontier AI agents, arXiv 2507.20526. https://arxiv.org/abs/2507.20526
8. Contextual integrity and the limits of agent defenses, arXiv 2605.17634. https://arxiv.org/pdf/2605.17634
9. Whispers of Wealth: red teaming AP2, arXiv 2601.22569. https://arxiv.org/html/2601.22569v1
10. Threat modeling Google's A2A protocol with MAESTRO, Cloud Security Alliance. https://cloudsecurityalliance.org/blog/2025/04/30/threat-modeling-google-s-a2a-protocol-with-the-maestro-framework