From prompt to payment - securing agentic commerce

For twenty years, "securing e-commerce" mostly meant stopping humans from doing bad things to other humans online. That assumption is about to age very quickly.

We're entering an era where AI agents don't just recommend products. They search, compare, negotiate, and spend money on a consumer's behalf. The moment an autonomous agent can place an order, the security problem stops being about what the model says and starts being about what it's allowed to do. Defenders now need answers to questions that didn't exist two years ago: Who is this agent acting for? What authority does it hold? What data can it touch? How much can it spend? How is consent recorded? How do merchants and platforms verify each other? And what happens when the model, the tooling, or the data supply chain gets compromised?

A wave of new protocols is trying to sort this out. UCP, ACP, AP2, A2A, MCP, x402, all backed by different industry heavyweights, all operating at different layers, and none of them covering the full picture. If you're finding it hard to keep track, join the club. This session cuts through the noise with a plain-English overview of what each protocol actually solves, where they overlap, and where the gaps are, with real examples.

We then put the agentic commerce stack under a threat model. How do attacks like prompt injection, confused-deputy flows, token abuse, poisoned catalogue data, agent impersonation, insecure tool use, and post-purchase actually play out in practice? And how do they map to controls you can implement: identity binding, constrained delegation, least-privilege scoping, data provenance, human-in-the-loop approval gates, runtime monitoring, auditability, and rollback.