AI agents that pay for things on their own are easy to defraud, and the standard security tools don't notice.
A paper posted to arXiv on September 30, 2026 (arXiv:2609.35886) introduces Agentic Commerce Bench, a benchmark built from 1,647 catalogued service operations and 1,068 settlements. It defines twenty fraud classes that agents can fall for even when a counterparty's domain and settlement address check out and the service is genuinely delivered; only six of the twenty scenarios involve an outright impostor. The researchers also release gordonguard, an open-source detector stack for auditing agent configurations offline. Calibrated to hold false positives at 6.5% on clean traffic, the detectors still perform no better than chance on eight of the twenty fraud classes.
That gap matters because agents already settle payments without a human checking each one, and the paper's own numbers explain why: a human review costs 143 times more than the median $0.007 payment it would examine. A widely used agent security scanner, tested against the four fraud types a reasoning layer alone can catch, scored zero on all four, while correctly flagging a control jailbreak. Jailbreak detection and payment-fraud detection, it turns out, are not the same problem, even though vendors often bundle them.
Giving an agent a wallet is easy. Teaching it to recognize a legitimate-looking bill it shouldn't pay is the part nobody has solved yet.