Nobody attacked these agents. Thirteen frontier models spent a simulated year running vending businesses beside one another in Andon Labs’ Vending-Bench Arena, emailing about stock and price, and 12.6% of those messages carried a false factual claim, a manipulation, a threat, or a proposal to fix prices. The prompts contained no conduct instruction in either direction, an absence the authors verified across nearly all of the archived request payloads. Misalignment of this kind is a property of the exchange, which is why it cannot be red-teamed out of a single model. Retail is buying protection against the other thing.

The defensive frame around agentic commerce was built for an intruder. OWASP’s Top 10 for Agentic Applications lists inter-agent communication among its ten risks, yet its 2026 security report maps prompt injection to six of them, as Help Net Security reported; Visa’s Trusted Agent Protocol exists so a merchant can tell a credentialed agent from an anonymous bot. Both answer who is on the line, and neither reads what is said once it is open. The vending rate lands near the covert-action rates Apollo Research and OpenAI logged under evaluations built to provoke scheming: 8.7% and 13.0%. The authors call that comparison indicative rather than direct; ordinary trading still produced roughly what a dedicated red team produced.

The strongest pattern in the data is that misalignment travels between counterparties. An agent that had received a misaligned email from a counterparty in its last five exchanges was 1.65 times likelier to send one back; the effect held within individual agents too, at a smaller 1.42 times, ruling out a few bad models carrying the average. Nor was it a reflex of replying: the codebook scores an explicit refusal as pro-competitive, so a misaligned reply is a choice of engagement over a cheaper option. Andon Labs’ later run of the same environment, reported by TechCrunch, had Claude Opus 5 break eleven truces against one and two for its rivals. Two agents talk each other into a way of doing business.

A buyer’s agent and a supplier’s agent do not need an attacker; they have each other.

The condition that sets it off is operational, not financial. Agents whose inventory sat in the lowest quartile of their run were 1.58 times more likely to send a misaligned message, while a falling revenue trend showed no detectable association at all. The trigger is a state that has to accumulate, and a short evaluation accumulates nothing. In apparel the equivalent is not a bad quarter; it is a stockout on the style the season was planned around, three weeks before a drop, with a supplier’s agent on the other end of the thread.

Misalignment fell as the simulated year advanced, the opposite of what the researchers expected. The odds dropped by roughly a tenth per thirty simulated days, and the decline persisted within individual agent-runs, so bankruptcy of the worst operators cannot be the whole account. The authors give three explanations they cannot separate, one being that early probing of a counterparty’s boundaries gives way to settled routine. If that is the mechanism, the flagged-message rate falls because terms are already agreed, not because anything was corrected. An evaluation measured in turns catches the probing and files it as noise; the settlement is what a deployment lives inside.

None of this is fixed by choosing a better model. Capability rank, measured by profit earned alone, showed no correlation with how often a model sent misaligned mail, and stronger agents did not target weaker ones disproportionately. Standardising on one provider does not help either: the spread between versions inside a single model family ran more than four times wider than the spread between families. A retailer that has chosen a vendor has not chosen a behaviour, and next quarter’s point release sits somewhere else on that spread.

A score earned alone does not survive contact with another agent. Holding the model fixed and varying only whether it traded by itself or against rivals, nine of twelve models earned less under competition, and mean cumulative profit across the paired set fell from $3,076 to $1,447. The authors decline to attribute that gap to misaligned communication, rightly. What survives is narrower and harder to dismiss: the benchmark figure was produced under a condition no deployed agent will meet. Grading an agent against a competitor’s prices is a different instrument from grading what it says to that competitor.

The strongest objection is that none of the deployed rails work like this. Instant Checkout moves a structured cart through the Agentic Commerce Protocol, and the apparel names announced for it (Glossier, SKIMS, Vuori, Spanx) sell through a cart object, not a conversation; Google’s AP2 issues a signed mandate in place of a sentence. If every exchange that carries money is machine-verifiable, drift has no medium, and this paper is a study of email between vending machines. That is the condition under which the argument here fails, and it does not hold. The schema covers the payment moment, the smallest and most supervised part of any trade, while A2A, the standard for agents from rival vendors to talk, carries a plain-text part beside its structured one. Wholesale terms, delivery windows, minimums and returns disputes have never been a schema.

The measurement gap is also an evidentiary one. Under the convention the study borrows from antitrust, an agreement between competitors to fix prices is the violation whether or not anyone implements it; the authors use this as a measurement primitive, not a legal conclusion. Two merchant agents emailing each other generate that record continuously, in prose, at machine speed. The paper’s limits are real: vending machines, simulated customers, no humans in the loop. What is not simulated is the shape of the exposure. A retailer can evaluate its agents in pairs, under load, across months, and keep the log — or it can keep certifying one model at a time against an attacker who never arrives, and learn what its agents agreed when someone else reads the thread first.