Who Is Liable When a Prompt-Injected Agent Spends Money — the unresolved question behind every mandate protocol in this wiki

When a prompt-injected or malfunctioning AI agent spends a consumer's money, no regulator or court has yet decided who bears the loss. This page separates what the actual text of US Regulation E says, what payments-law commentators infer from it, what happens once settlement moves on-chain (no equivalent protection exists at all), and what protocol vendors market as a fix but have not proven in a real dispute.

The Existing US Legal Frame: Regulation E and "Actual Authority"

Regulation E (12 CFR § 1005.6) defines an "unauthorized electronic fund transfer" as one "initiated by a person other than the consumer without actual authority to initiate the transfer and from which the consumer receives no benefit." Consumer liability is tiered by how fast the consumer reports it: $50 maximum if reported within 2 business days of discovering a lost/stolen access device; $500 maximum if reported after 2 days but before further unauthorized transfers occur; unlimited liability if unauthorized transfers appear on a periodic statement and are not reported within 60 calendar days. Regulation E's anti-waiver provision blocks any agreement — including, presumably, an agent's terms of service — from reducing these caps, and ordinary consumer negligence (e.g. poor password hygiene) cannot increase liability beyond the statutory limits. — FONTE: https://www.consumerfinance.gov/rules-policy/regulations/1005/6/ ; https://www.consumerfinance.gov/compliance/compliance-resources/deposit-accounts-resources/electronic-fund-transfers/electronic-fund-transfers-faqs/

The open question

whether an agent acting under a valid mandate but manipulated by prompt injection (or one that misreads its own scope) still falls inside the "actual authority" exception — in which case the transfer is *not* unauthorized and Reg E's caps never engage at all. This is characterized as an open legal question by payments-law commentary, not resolved by any CFPB text or court ruling in the notes for this page. — FONTE: https://www.lexology.com/library/detail.aspx?g=5e81048c-efbd-42bc-ab88-db92120878a2 ("When AI Is Hijacked - Prompt Injection as a Compliance Risk")

The Access Device Exception Risk

Reg E's "access device exception" holds that an EFT is *not* deemed unauthorized if it was "initiated by a person who was furnished the access device to the consumer's account by the consumer." Commentary warns that if a consumer authorizes an agent to hold or use payment credentials, a creditor or payment network may argue the transfer is presumed authorized under this exception even when the agent misapplied its mandate or was compromised — shifting liability onto the consumer rather than the institution. — FONTE: https://www.consumerfinance.gov/rules-policy/regulations/1005/6/ ; https://www.electronicpaymentsinternational.com/comment/your-ai-agent-bought-something-who-authorised-payment/

Countering this, CFPB guidance on the access-device definition emphasizes the exception applies only when the device was genuinely, *voluntarily* "furnished" by the consumer; fraudulently obtained credentials do not qualify. — FONTE: https://www.consumerfinance.gov/compliance/compliance-resources/deposit-accounts-resources/electronic-fund-transfers/electronic-fund-transfers-faqs/

(unverified) Some law-firm commentary in the notes assumes Reg E's protections may simply not extend to agent-initiated transactions absent explicit regulatory guidance — but this is commentary, not settled law or a CFPB pronouncement.

Card-Rail Chargebacks vs On-Chain Settlement: No Symmetric Protection

On the card rail, a CFPB advisory dated January 2026 on autonomous-agent purchases (Regulation Z and card-network rules) states that consumer dispute and chargeback rights are not waived by the existence of an agent mandate; they are only narrowed where the mandate is appropriately scoped and documented. — FONTE: https://www.fraudbeat.com/agentic-commerce-disputes-friendly-fraud/ ("Agentic Commerce Disputes: A Fraud Window Left Open")

Dispute rates on agent-initiated card transactions run at roughly 2.4x the rate of comparable human-initiated card-not-present transactions. (unverified detail removed) The claim that this gap is composed mainly of "did not authorise" and "not as described" disputes rather than fraud disputes does not hold up: FraudBeat, the source cited for it, explicitly states it provides no breakdown of dispute composition and that proper categorization is not possible with current infrastructure. Institutions cannot narrow chargeback rights without evidence of proper mandate scope and documentation — meaning early, poorly documented agentic deployments carry full dispute exposure. — FONTE: https://www.backbase.com/blog/ai-agent-payment-liability ; https://www.fraudbeat.com/agentic-commerce-disputes-friendly-fraud/

When settlement is on-chain/stablecoin, this protection does not exist at all. Once a stablecoin transaction (USDC on Base, Solana, or Polygon) confirms, there is no chargeback mechanism, no issuer dispute arbitration, no clawback, and no recovery path beyond voluntary counterparty cooperation or a court order. Unlike card rails, the issuing bank has a reversal mechanism the stablecoin issuer simply does not. Protection therefore depends entirely on application-level controls — spend limits, allowlists, human approval thresholds — because no network-level control exists. — FONTE: https://www.spark.money/research/payment-reversal-stablecoin-chargeback-gap ("The Chargeback Gap: Why Stablecoin Payments Need Dispute Resolution Standards")

Settlement finality itself varies by network and matters for how fast a loss becomes irreversible: Solana USDC reaches practical finality in roughly 1.2 seconds (~400ms block time, with confirmation typically landing inside 800ms — corrected here from an earlier 15-30 second figure that misread the source); Base and other Ethereum L2s offer soft sequencer finality in 1-2 seconds, with hard finality dependent on Ethereum's own settlement schedule; Polygon PoS requires Ethereum checkpoint inclusion, typically 20-30 minutes. On this comparison, Solana is the fastest of the three networks, not the slowest. — FONTE: https://eco.com/support/en/articles/15261554-real-time-stablecoin-settlement-platforms-2026-speed-and-reliability-compared

As of August 2026, no published case involving a disputed agent-initiated stablecoin payment has reached adjudication or settlement. The one documented on-chain stablecoin dispute case on record (ASIC v Wallet Ventures, 2026) concerned regulatory classification, not consumer-agent liability. — FONTE: https://www.nortonrosefulbright.com/en/knowledge/publications/28d5b76f/digital-asset-disputes-2025-in-review-and-what-to-expect-in-2026

What Regulators Have Actually Said — vs What Vendors Market

The CFPB has not issued guidance specific to agent-payment liability under Regulation E or in the context of prompt injection; the January 2026 advisory covered card-network chargeback rights only and did not resolve the "actual authority" question for a manipulated agent. — FONTE: https://www.fraudbeat.com/agentic-commerce-disputes-friendly-fraud/

Against that regulatory silence, Google's AP2 (Agent Payments Protocol, launched September 16 2025) encodes each transaction in three signed Verifiable Credentials — an Intent Mandate (authorization scope), a Cart Mandate (specific items/price), and a Payment Mandate (what the merchant charges) — each cryptographically signed and tamper-evident. It is marketed as creating an auditable trail proving the consumer authorized a given action and that the agent stayed within scope. — FONTE: https://cloud.google.com/blog/products/ai-machine-learning/announcing-agents-to-payments-ap2-protocol

But signing is not prevention. AP2's mandate design does not cryptographically stop prompt injection from manipulating the agent's *interpretation* of a valid mandate — it only produces evidence after the fact. — FONTE: https://gohsoonheng00.medium.com/the-missing-trust-layer-a-deep-dive-into-the-agent-payments-protocol-ap2-and-verifiable-mandates-4cd2a1674316

(unverified) No published case in the notes has tested whether AP2's signed Intent/Cart Mandates satisfy Regulation E's "actual authority" defense, or whether they create a stronger liability barrier than traditional written authorization. The protocols are live; the liability question is not answered by them. See Google AP2 — the one agent-payment authorization spec that shipped code, not just a press release for what AP2 actually publishes versus what it claims.

Prompt Injection Against Payment Agents: What's Actually Documented

This is not a hypothetical attack surface. Researchers documented injection payloads embedded in websites instructing payment-integrated AI agents to execute transactions without user confirmation, with recipient, amount, and description fully specified inside the malicious prompt. — FONTE: https://unit42.paloaltonetworks.com/ai-agent-prompt-injection/

In a public red-team exercise, 1.8 million prompt injection attempts were launched against deployed AI agents; more than 60,000 succeeded in causing policy violations. — FONTE: https://atlan.com/know/prompt-injection-attacks-ai-agents/

A documented attack pattern for gift-card theft: a fraudulent deals site embeds a hidden instruction in its HTML; a shopping agent ingests it into memory; the instruction appends an unauthorized gift card to the cart before checkout; the card ships to the attacker's address. — FONTE: https://www.proof.com/blog/the-fraud-files-agents-impersonation-and-the-identity-layer-nobody-built-july-2026

The first judicial sanction anywhere for prompt injection occurred in Brazil's 3rd Labour Court of Parauapebas (May 2026): two lawyers were fined for hiding instructions (white text on white background) in a court filing to manipulate the court's AI system, Galileu. This establishes that courts will sanction prompt injection as misconduct — but it is not a payment-liability case. — FONTE: https://www.dentons.com/en/insights/articles/2026/august/14/ai-manipulation-in-litigation

To date, no published case involves an actual *payment* dispute arising from prompt injection against an agent — only documented attack demonstrations and red-team exercises. The liability question remains untested in court.

Summary: The Unresolved Core Question, by Settlement Rail

1. Card settlement: Regulation E's $50-$500 liability caps likely apply, but only if the consumer can argue the agent's credential use was not genuinely "furnished" for that specific use. Card-network chargeback rights survive per the January 2026 CFPB advisory, but require documented mandate scope to narrow. 2. On-chain/stablecoin settlement: no chargebacks, no scheme arbitration, no Reg E equivalent. Recourse is limited to application-level preventive controls or civil action (breach of contract/negligence) against the agent's operator. Who bears the loss today (August 2026) is a matter of contract law and the operator's insurance, not regulatory mandate. 3. What protocols market: cryptographic proof of authorization (AP2's mandates, Visa/Mastercard tokens) creates an audit trail and *may* shift liability toward the consumer if the mandate is deemed valid — but none has been tested in a real dispute to show whether it protects the issuer or sharpens consumer risk. 4. Regulatory guidance: CFPB, Visa, and Mastercard have not assigned explicit liability for prompt-injected or out-of-scope agent purchases.

Why this page matters for the wiki's objective

every mandate protocol covered here — Google AP2 — the one agent-payment authorization spec that shipped code, not just a press release, Mastercard AP4M — an announced authorization layer, not yet a published spec or a shipped integration, Visa Intelligent Commerce: Tokenized Agent Credentials — the spec-vs-announcement test applied to Visa's own numbers — is sold partly as a liability-management tool. This page is the check: a signed mandate is evidence, not a settled legal shield, and the wiki must not repeat vendor liability claims as fact. It also sets up Mandate Expression Compared — AP2, AP4M, Visa, ACP, Coinbase Side by Side, Where the Constraint Actually Lives (how each protocol's revocation/scope mechanics differ) and Regulatory Response to Agent Payments So Far — What's Actually on the Books vs Assumed (whether any regulator has moved since this page was written).

Related

- Google AP2 — the one agent-payment authorization spec that shipped code, not just a press release — the mandate design whose signed Intent/Cart/Payment credentials are marketed as an answer to the "actual authority" question this page shows is still open. - Mandate Expression Compared — AP2, AP4M, Visa, ACP, Coinbase Side by Side, Where the Constraint Actually Lives — compares how AP2, AP4M, Visa, ACP, and Coinbase wallets express and revoke scope; relevant because revocation speed determines how much loss accumulates before an overspending agent can be stopped. - Regulatory Response to Agent Payments So Far — What's Actually on the Books vs Assumed — tracks whether CFPB, Visa, or Mastercard have since issued the guidance this page finds absent as of August 2026. - Who Holds the Money — Custody Models Across the Five Protocols, and Why It Names the Defendant — custody model determines who is actually the defendant when an agent overspends: this page answers "is there a defense," that page answers "against whom."