Case file 08.08.26 Agentic commerce / evidence integrity
Data Laundering
How brands could corrupt the telemetry layer to deceive your AI agent
The consumer advertising model is losing its monopoly on persuasion.
For a century, brands fought for control of the consumer’s attention. In the agentic economy, an increasing share of purchasing authority will sit somewhere else: inside software.
That changes the target.
A personal procurement agent does not watch television. It does not aspire to drive the same car as a celebrity. It does not feel embarrassed that its shoes lack the correct logo.
But that does not make the agent impossible to manipulate. It makes the agent vulnerable to an entirely different class of manipulation.
Humans can be persuaded by stories. Machines can be persuaded by evidence. And wherever evidence determines the flow of money, someone will eventually learn to manufacture the evidence.
The process of passing misleading claims about a physical product through trusted laboratories, certificates, registries or machine-readable systems until the claims become indistinguishable from legitimate evidence to an automated buyer.
Institutional capture
The easiest way to corrupt the data layer may be to capture the institution that produces the data.
This is not science fiction. A 2026 Government Accountability Office report describes three kinds of laboratories accepted by the Consumer Product Safety Commission: independent, government-owned and manufacturer-controlled “firewalled” labs. Firewalled laboratories are not presumed corrupt; the category exists because manufacturer influence over nominally independent testing is a recognized institutional risk.
The GAO also documented actual failures. It reported withdrawn approvals involving false testing reports, fraudulent use of another laboratory’s address and emblem, and cases in which manufacturers had compromised the integrity of testing processes.
The historical record gets worse. The owner of a consumer-products testing company pleaded guilty in a $46 million fraud scheme involving fabricated lab results. In another case, a manufacturer agreed to a $46 million settlement after falsified test results and thousands of fraudulent certifications for aluminum supplied to hundreds of customers, including NASA and the Defense Department.
The difficult question is not “Did the laboratory lie?” It is “Who chose the test?”
A sophisticated manipulation does not need to invent a number. It can select a favorable protocol, provide unusually good specimens, exclude adverse observations or reproduce a laboratory environment that bears little resemblance to actual use.
A shoe might genuinely survive 100,000 flex cycles at 22°C. The laundering happens if the protocol excludes the moisture, heat, torsional load or gait pattern under which the shoe fails. The number is real. The implication is false.
Provenance laundering
Sometimes the physical object never changes. Only its informational identity does.
The organic-food market is a near-perfect analogue. “Organic” is mostly an invisible attribute. A buyer cannot inspect a soybean and determine where it was grown, what chemicals touched it, or whether it remained segregated from conventional grain. The premium depends on a chain of custody: claims, certificates and records.
The U.S. Department of Agriculture maintains a registry of fraudulent organic certificates because non-organic products have repeatedly been represented as certified organic. Federal cases show how valuable this altered information identity can become. One alleged scheme involved conventional corn and soybeans shipped to the United States under organic representations. Another involved at least $142.4 million in fraudulent organic-grain sales.
The commodity stayed the same. The market value changed because the information wrapped around it changed.
Digitization does not eliminate the oracle problem. It can make the wrong claim faster, cleaner and easier for machines to consume.
Europe’s emerging Digital Product Passport framework points toward a richer machine-readable product layer and explicitly addresses authentication, reliability, integrity, security and fraud prevention. That infrastructure could improve accountability enormously.
It could also create a dangerous temptation: confusing an authenticated claim with a true claim.
Spec-hacking
Goodhart’s law moves from the spreadsheet to the factory floor: once a metric becomes a target, it stops being a reliable measure.
Dieselgate is the canonical case. Volkswagen did not merely forge a certificate. According to the Environmental Protection Agency, software in affected vehicles detected when an emissions test was occurring and changed the vehicle’s behavior. Some cars emitted nitrogen oxides at up to 40 times the applicable standard during ordinary operation.
The physical system learned to recognize the evaluator.
Now reverse the actors. Instead of an AI exploiting a human-written objective, imagine a manufacturer optimizing its product against the observable metrics used by an AI buyer: battery cycle life at one temperature, peak benchmark score, one tear-resistance configuration, three contaminants, one carbon-accounting method.
Specification-gaming research shows why this matters: powerful optimizers are good at finding the gap between the literal metric and the intended outcome. A manufacturer does not need to make the best battery. It needs to make the battery that receives the highest score from the procurement function it can observe.
Spec-hacking optimizes the product against the buyer’s proxy metrics, not the buyer’s underlying objective.
The two coincide only if the agent’s measurements perfectly represent real-world utility. They never will.
Agent injection
The shortest path may be neither corrupting the product nor the evidence. It may be corrupting the evaluator itself.
Today’s shopping agents mostly work with the surfaces sellers already control: product descriptions, images, reviews, ratings, endorsements, marketplace position and machine-readable schema. That creates several attack classes which should not be collapsed together.
Representation gaming strategically presents truthful information. Telemetry laundering alters or misrepresents evidentiary inputs. Instruction attacks attempt to make the agent ignore its own policy.
The last category matters because a shopping agent will routinely read hostile text. A product page can contain language designed not for the buyer but for the model interpreting the page. OWASP identifies indirect prompt injection as a primary risk in which external content alters model behavior.
Merchant-provided content is evidence. It must never acquire the authority of the decision policy.
The safest architecture looks less like one omniscient model and more like a separation of powers: untrusted retrieval, evidence parsing, provenance verification, independent auditing, a decision model and transaction authorization.
That is cybersecurity architecture, not shopping software.
A signed lie is still a lie
Cryptography can establish who issued a credential, whether the credential changed and whether it remains valid. Those are essential properties.
They are not the same as factual truth.
The W3C Verifiable Credentials Data Model states the distinction plainly: verifiability does not imply that the encoded claims are true. A verifier must still evaluate the issuer, proof, subject and claim against its own policies.
This is the oracle problem at the heart of agentic commerce. The most dangerous telemetry may not be the clumsy fake PDF. It may be the perfectly signed, impeccably structured, machine-readable falsehood.
480 MPa
- Issuer
- Accredited Lab X
- Signature
- Valid
- Status
- Not revoked
- Schema
- Conformant
- Claim
- Uncorroborated
Integrity of document ≠ integrity of measurement
The forensic trust stack
A reliable procurement agent cannot merely check signatures. It has to audit institutions, compare independent causal traces and periodically reconnect digital claims to physical reality.
01Provenance integrity
Cryptographic signatures, credential status and tamper evidence establish which entity made the claim and whether the record changed.
Who issued this? Is it intact? Is it still valid?
02Institutional provenance
Ownership, accreditation, funding dependence, customer concentration, prior violations and predictive accuracy determine how much confidence an issuer deserves.
Who is the issuer, and why should I trust it?
03Cross-source corroboration
Warranty claims, recalls, repair records, shipping data, production capacity and unrelated labs can test whether multiple independent traces agree.
Does the claim agree with independent reality?
04Physical challenge testing
Random sampling, unannounced protocols, destructive tests and out-of-distribution conditions reconnect machine-readable evidence with the physical object.
What happens when someone touches the product?
05Instruction-data separation
Merchant-controlled text must enter the system as untrusted evidence, never as instructions with the authority to rewrite the purchasing policy.
Is this information about the product—or an instruction to the agent?
Harder to fool one by one. Easier to attack all at once.
Human persuaded
Agent decision function manipulated
Purchasing decisions potentially redirected
AI does not eliminate asymmetric information. It changes its location.
Early controlled research on shopping agents already shows that agents are not pure utility calculators. They display position effects, vary in their sensitivity to price, ratings and reviews, reward some platform endorsements and can be shifted through model-targeted description changes. The paper What Is Your AI Agent Buying? also found choice concentration around a small number of products and significant variation across models and updates.
That means agents possess their own cognitive attack surface: ordering effects, representation effects, model priors, retrieval bias, source authority, product-schema design and wording that happens to resonate with a model’s learned representations.
The economic leverage is enormous. Persuading one human sells one product. Manipulating a decision rule shared by millions of agents can redirect demand at scale.
A human market is heterogeneous. Different people respond to different stories, loyalties and preferences. An agentic market may concentrate purchasing authority in a smaller set of foundation models, agent frameworks, certification registries and product-information APIs.
A corrupt actor no longer needs to deceive ten million consumers separately. It needs to deceive the epistemic infrastructure used by their agents.
Marketing expenditure will migrate upstream.
Money once spent exclusively shaping consumer perception will increasingly be spent shaping the machine-readable representation of the product: structured data, certifications, test results, digital product passports, provenance systems and independently verifiable performance.
Most of that activity will be legitimate.
Some of it will not.
Because the distinction between legitimate optimization and adversarial manipulation will often be invisible to the purchasing agent, forensic verification becomes a new commercial necessity.
The advertising wars taught corporations how to capture human attention. The algorithmic wars will teach them how to capture machine trust.
An agent does not have to believe a lie in the human sense. It only has to assign the lie a sufficiently high confidence score.
The central security problem of agentic commerce will therefore not be teaching machines to shop.
It will be teaching them whom not to believe.