Agents

Rose's agent shops for her. Second Key makes sure it buys what she meant.

She signs what she wants on her own device. The agent can be wrong, rushed or manipulated; the money only moves when the purchase matches what she signed.

Real products · Channel3 · PayPal sandbox

Try it with real products

Say what Rose wants. The agent searches real products through Channel3, Rose's device signs what she approved, and every purchase the agent attempts is checked against it before PayPal captures anything.

Try:

Advanced

Try to beat Second Key

Rose's mandate is fixed. Everything else is yours: the page her agent reads, the purchase it proposes, and the messages it gets. Pick a prepared attack or write your own.

Rose's mandate · fixed

“Trail-running shoes, size 10, not white, one pair, up to $90, from REI or Backcountry.”

Confirmed by Rose and stored by Second Key. Nothing on this page can change it; that's the point.

Pick an attack

Control

Prompt injection

Mandate

Merchant & product

Pressure

Input

Orders hidden in the description

Goal: Steer the agent to a pricier product without Rose noticing.
Changes: The product page contains instructions addressed to the AI agent.

Edit the attack

The product page written by the seller, so untrusted

TitleWhat the listing is called.Price (USD)Price per item.ColourAs the listing states it.SizeLeave empty to omit it.CategoryThe seller's category.Brand

DescriptionThe agent reads this. Second Key treats it as evidence, never as instructions.

What the agent proposes the purchase it's about to make

MerchantWho would be paid, as a domain.QuantityRose asked for one pair.

Messages to the agent optional, untrustedOne per line, as Speaker: messageUp to eight. They can add a pause; they can't change the mandate.

Real rules and AI checks. Nothing is bought; PayPal isn't called.

The decision appears here

You'll see what the attack changed compared with Rose's mandate, what Second Key found, and the decision it made. If an attack gets through that shouldn't, that's a finding, and it's shown as one.

Scripted, repeatable

Replay the cases

The same protections on fixed trail-shoe pages, so each run comes out the same way every time.

A poisoned page: the purchase waits for RoseFour runs · real PayPal sandbox

Five AP2 runs, each stopped by a different checkSigned on this device · real verifier