What happened
The open-source environment used synthetic data for food ordering and home-improvement services. Seller agents tried six manipulation strategies, from fake credentials and social proof to prompt injection.
Microsoft wrote that for GPT-4o “all payments were redirected to the manipulative agent” under prompt injection. Gemini-2.5-Flash was generally resistant, though strong injections affected the payments that other sellers received.
Coverage also highlighted a first-proposal bias: agents tended to take early offers, which gave fast responders an edge over better ones.
What happened next
No real money was involved. Microsoft concluded that the findings “highlight a critical security concern for agentic marketplaces.”
What would have stopped it
- Rank sellers on verified data (ratings, prices from a trusted catalog), not on claims in the seller’s own messages.
- Strip instructions from seller messages before the buyer agent reasons over them.
- Require the buyer agent to compare a minimum number of offers before paying.
Test scenarios
Sources
- Microsoft Research: Magentic Marketplace
- The Register: Microsoft: Don't let AI agents near your credit card yet
Early access
Test your agent against cases like this.
We will email you when Countermove opens testing for agents like yours.