SAN FRANCISCO, Aug. 14 -- When an autonomous AI agent requests a data product and the merchant delivers it within seconds, the payment has already cleared an off-chain verification checkpoint. What can follow is quiet ruin: the blockchain transaction expires before it settles, the payment fails on-chain, and the agent keeps the service. The merchant absorbs the cost.

That attack path, which researchers call "free shopping," is not a theoretical edge case. It is one of six attack methods that security researchers directly validated against live production systems, and it runs across every major AI payment platform in the emerging autonomous commerce stack, including Coinbase.

Researchers presenting findings at the 35th USENIX Security Sy...