One Consent, Two Success Receipts: Authorization Amplification in the Agent Payments Protocol

The Agent Payments Protocol (AP2) lets an AI shopping agent act on a user's payment authorization. Its central artifact is a signed Payment Mandate: cryptographic proof, held by the Credential Provider and the Merchant Payment Processor, that the user authorized a specific payment for a specific checkout. AP2 states that every agent in the flow "MUST be considered" a potential attacker. We ask how many payment-side acceptances one signed mandate can cause. The specification places the only mandatory double-spend control on the Shopping Agent, the party it names as the attacker; the verifiers "MAY reject multiple overlapping Mandates." The closed mandate carries no field that changes between presentations, and the Key Binding nonce that the underlying SD-JWT and OpenID4VP layers use for replay detection is chosen, in AP2, by the Shopping Agent. We model the Direct (Human Present) payment flow in Tamarin. Every symbolic charge event is backed by a user consent on the exact transaction, payee, and amount. Non-amplification, at most one such event per mandate, is falsified by a fourteen-step trace: one consent, one signature, two tokens, two charge events, no forgery. We then execute the corresponding replay against the public Python reference samples at commit e1ea56db: one closed Payment Mandate yields two payment tokens, two locally completed checkout paths, and two demo-processor-signed success receipts whose reference field names the same mandate. The samples contact no payment rail, and the transcript records zero as each token's amount_charged; this is receipt and control-flow amplification, not evidence of duplicate monetary settlement. The required rule is an atomic consume-once transition at the verifier, keyed on the closed mandate's hash or the checkout's transaction_id. With that rule the Tamarin property verifies, authenticity is unchanged, and the honest flow still completes. The paper gives the normative text AP2 would need and a self-contained trace argument showing what linearizability and complete mediation establish. The finding was reported through the project's stated security channel before publication. This is an unrefereed technical preprint. The finding was reported through the project's stated security channel on 2026-09-01. The public issue records the author's account of the security-program response; that account is not independently confirmed by a public maintainer message. As of 2026-09-02 21:33 UTC, issue #346 had no maintainer response and PR #347 was open and unreviewed. The PR is a proposal and a sequential sample mitigation, not a landed specification change or proof of the paper's required atomic transition.