Escrow-and-judge model for agent trades raises prompt-injection security concerns

Researchers publishing 'Whispers of Wealth' (arXiv 2601.22569) demonstrated in early 2026 that simple prompt-injection attacks could subvert Google's Agent Payments Protocol, steering purchases and leaking user data without breaking any cryptography. Around the same time, multiple projects including ERC-8183, Virtuals' Agent Commerce Protocol, Circle, and BNB Chain independently converged on an escrow-plus-evaluator model, where a judge-agent or human holds funds and decides when to release payment. This design suits subjective service work — such as code or video delivery — where on-chain verification of quality is impossible. However, analysts warn that applying the same pattern to asset trading creates a dangerous single point of failure, since any component using contextual reasoning to release funds becomes a persistent prompt-injection target. As the value locked behind such discretionary decisions grows while the cost of manipulating them stays constant, security researchers argue that atomic settlement mechanisms may be structurally safer for straightforward asset exchanges.