Last November, Microsoft Research built a simulated marketplace, populated it with 100 customer-side AI agents and 300 business-side agents, and watched what happened when some of the sellers cheated. One result should be pinned above every desk in adtech:
Against several widely used models, prompt-injection attacks worked so completely that “all payments were redirected to the manipulative agent” (Microsoft Research, 2025).
Not some payments. All of them. The same Magentic Marketplace study found that GPT-4o accepted the first proposal it received 100% of the time, and that measured consumer welfare fell sharply as the number of options grew; one model’s welfare score dropped from 1,800 to 600 as search results expanded. Agents, in other words, negotiate worse when markets get bigger, and hand over the money when a seller phrases the manipulation correctly.
I wrote in July about joining the Agentic Advertising Organization and why open standards should come before agent-to-agent media buying. This is the harder half of that argument: verification. When agents negotiate and transact media, who confirms they are what they claim, follow the instructions they were given, and report honestly on what they did?
The supply chain was leaky when humans ran it
We do not need to speculate about what unverified automation costs. We have the receipts from the last era.
Juniper Research put global digital ad spend lost to fraud at $68 billion in 2022, up from $59 billion the year before, with the US accounting for more than $23 billion of it.
The ANA’s programmatic transparency study concluded in late 2023 that only 36 cents of every dollar entering a DSP effectively reaches a consumer, and identified around $22 billion in recoverable waste on an $88 billion open-web programmatic market.
Those numbers happened with humans nominally supervising every step: contracts, ad ops teams, brand-safety vendors, quarterly business reviews. The industry now proposes to remove humans from the transaction loop and let agents negotiate with agents at machine speed. If the incentives stay the same and the oversight gets thinner, fraud does not shrink. It compounds faster.
Three questions I ask about every agent
I do independent technical review work for AI adtech vendors: validator tooling for agentic ad protocols, and reviews of MCP servers that expose marketing systems to agents. Every failure I have found in that work falls under one of three questions.
Is the agent who it says it is? Identity is mostly unsolved. An agent presenting itself as a brand’s buying agent is a string in a request until something cryptographic proves otherwise. Nothing in most current implementations stops a hostile actor from wearing a trusted name, which is exactly the spoofing economics that made domain fraud profitable in the programmatic era.
Does it do what it was told? Instruction-following degrades quietly. In review work I regularly see agents pass a clean demo and then drift on edge cases: a spend cap honored on the happy path but not when a retry fires twice, a brand-safety exclusion applied at planning but silently dropped at execution. The Microsoft findings are the lab version of the same behavior. Models with strong benchmark scores still wired money to whichever seller manipulated them best.
Did it report what actually happened? This is the oldest problem in adtech, restated. When an agent’s self-report is the only record of a negotiation, you have reinvented the black-box ad network with better grammar. Logs that exist independently of the agent are the difference between reporting and testimony.
The verification layer is finally being built
The standards bodies have started treating this as infrastructure rather than an ethics slide.
IAB Tech Lab published its agentic roadmap in January, putting trust, provenance and transaction-integrity signals alongside the buying protocols themselves. Its AAMP 2.3 release in late July gets specific in the right places: server-side trust verification on every price-moving path, spend commitments that are deterministic and provable, human approvals above value thresholds, and inventory availability based on real rather than derived numbers.
The AAO made governance one of its three founding pillars: frameworks for setting boundaries, requiring approvals and auditing what agents do.
And the analysts expect verification to become its own market. Gartner predicts that guardian agents, AI systems whose job is to monitor, redirect or block other AI agents, will account for 10 to 15% of the agentic AI market by 2030.
Read that number as a practitioner and it is not a niche. Verification at 10 to 15% of the market is roughly what viewability and fraud detection became for programmatic: an entire industry layer that exists because the transaction layer could not be trusted on its own.
What I would require before an agent touches budget
I spend real money, so my standard here is not academic. Before any agent negotiates or commits spend on an account I am responsible for, four things go in place.
- Hard spend caps enforced outside the agent, in the platform or payment layer, never in the prompt.
- An immutable, agent-independent log of every negotiation step and commitment.
- Human approval above a value threshold, the same principle AAMP 2.3 just standardized.
- A third-party review of the agent and its tooling before it goes live, by someone whose incentive is finding the failure, not shipping the feature.
That last one is where my own review work sits, and it has made me more conservative, not less. The demos are uniformly impressive. The gap between the demo and the edge case is where budgets die quietly.
Agentic advertising will be real; the protocols are being written, and I argued last month that buyers should help write them. But protocols specify how agents talk, not whether they are telling the truth. Trust is not a feature of the agent. It is a property of the system around it: caps, logs, approvals, audits. Build that layer first and the agents earn their autonomy. Skip it, and we run the $68 billion experiment again at machine speed.