Adversarial test surface for AP2-paying agents across 8 chains (OWASP LLM Top 10 mapped)

[chopmob-cloud]

A heads-up for AP2 implementors working on the mandate-verification side: the AlgoVoi Agent Trust Bench is publicly live at agent-trust-bench.algovoi.co.uk, an open, provider-neutral harness for measuring how a paying agent behaves under adversarial payment conditions. No AlgoVoi account is required.

The classic bench presents 193 payment challenge profiles (156 mapped across 7 of the OWASP LLM Top 10 categories). On top of it, ATB vNext adds structured test modes (unit, workflow, persona, redteam, runtime, regression) and selectable scenario packs: tool-misuse, aml-edgecase, persona, long-context, multi-agent, data-protection, runtime. Several target the mandate surface directly: forged authorisation context, jurisdiction assertion, task-parameter drift, borderline sanctions, and consent-scope drift across turns.

Each run is scored on five dimensions, each content-addressed: outcome, per-step trace, per-turn trust, cost and latency, and a severity-weighted score that penalises an unsafe success far more than a safe refusal. Pick just the tests relevant to your client and get one aggregated, Falcon-1024 signed result bound to the agent's identity (the same subject as its ATB Pass Certificate), so it composes with the reputation the agent already holds:

curl "https://agent-trust-bench.algovoi.co.uk/vnext/select?packs=aml-edgecase,long-context"

Verify offline: pip install --extra-index-url https://pip.algovoi.co.uk/simple/ algovoi-atb-vnext then algovoi-atb-vnext verify. Docs: docs.algovoi.co.uk/atb-vnext.

[chopmob-cloud]

Refresh on the bench position for AP2 implementers reading this thread.

Since the original post, the substrate the bench composes with has shipped further:

Bench-side update (132 profiles, 30 categories, 8 chains). The profile count consolidated to 132 from 138 during the public-launch cleanup. Threat-category coverage and the AP2-relevant subset cited in the original post (/vault-cap-overflow, /vault-mandate-expired-assert, /vault-merchant-restriction-bypass, /orchestrator-auth, /orchestrator-session-fixation, /jurisdiction-assert, /sanctions-hop) remain unchanged. Machine-readable discovery added at /.well-known/x402.json for CI auto-discovery.

AlgoVoi receipt-format substrate the bench tests agents against. Since this discussion opened on 2026-05-17, the receipt-format suite the bench validates emission against has reached completeness on IETF datatracker:

• draft-hopley-x402-canonicalisation-jcs-v1 (-00 and -01 POSTED, sole AlgoVoi authorship)
• draft-hopley-x402-compliance-receipt (POSTED + -01 in flight)
• draft-hopley-x402-settlement-attestation-00
• draft-hopley-x402-cancellation-receipt-00
• draft-hopley-x402-refund-receipt (POSTED + -01 in flight)
• draft-hopley-x402-composite-trust-query-00

Six sole-AlgoVoi-authored I-Ds form a normative cluster on datatracker, all anchoring to the same JCS RFC 8785 canonicalisation pin. Cumulative cross-validation: 512/512 byte-for-byte agreements across 8 independent JCS implementations (Python, TypeScript, Go, Rust, Java, PHP, .NET, Ruby) covering 7 vector sets, attested at _attestations/ in the conformance corpus.

Substrate Adopters Registry. docs.algovoi.co.uk/adopters (+ machine-readable JSON-LD mirror at /adopters.json) records the three current entries: AlgoVoi (substrate-author), Supership (service_trust_v0), and PEAC Protocol (ap2-open-mandate-hash interop fixture set, self-declared as downstream-adopter on AP2 #265 on 2026-05-25). Any AP2 implementer publishing an artefact under canon_version: jcs-rfc8785-v1 qualifies for inclusion.

Composition with the open_mandate_hash work in AP2 #265. A correctly-configured AP2 agent under bench evaluation computes open_mandate_hash = SHA-256(JCS_RFC8785(unsigned_mandate_body)) on inbound mandates and refuses payment when the hash does not bind to the resource being settled. The AP2 #265 v0 conformance vectors are 5-impl validated across three organisations; running an AP2 agent through the bench is the behavioural-validation step on top of the vector-side correctness check.

Adversarial coverage in production environment classes. The 8-chain coverage matches the deployment surface for AP2 + x402 production implementations. APM (api.algovoi.co.uk) is the production agentic-payment platform that runs the substrate the bench tests, with the same 8 chains + PayPal Orders v2 fiat + EMR 2011 safeguarding.

Profile suggestions for AP2-specific mandate edge cases the working group wants empirically covered remain welcome. The bench is ecosystem infrastructure; AP2 maintainers landing the OMH v0 set normatively would give downstream implementers (XyncPay, PEAC, Sardis, others) a stable target plus a behavioural-test corpus to evaluate against.

-- AlgoVoi

---

AlgoVoi (chopmob-cloud) -- Acquisition enquiries: https://docs.algovoi.co.uk/acquisition