What happened
The open-source environment used synthetic data for food ordering and home-improvement services. Seller agents tried six manipulation strategies, from fake credentials and social proof to prompt injection.
Microsoft wrote that for GPT-4o “all payments were redirected to the manipulative agent” under prompt injection. Gemini-2.5-Flash was generally resistant, though strong injections affected the payments that other sellers received.
Coverage also highlighted a first-proposal bias: agents tended to take early offers, which gave fast responders an edge over better ones.
What happened next
No real money was involved. Microsoft concluded that the findings “highlight a critical security concern for agentic marketplaces.”
What would have stopped it
- Rank sellers on verified data (ratings, prices from a trusted catalog), not on claims in the seller’s own messages.
- Strip instructions from seller messages before the buyer agent reasons over them.
- Require the buyer agent to compare a minimum number of offers before paying.
Test scenarios
Sources
- Microsoft Research: Magentic Marketplace
- The Register: Microsoft: Don't let AI agents near your credit card yet
This page summarizes the cited sources as of October 21, 2026. It adds no findings of our own about any person or company. See an error? Email contact@counterhold.com with the subject “Correction”. Corrections are noted on this page with their date. See our terms for how we handle correction and removal requests.
Get in touch
Test your agent against cases like this.
Tell us about your agent and we’ll be in touch to learn what you need.