Proposing two new techniques for ATLAS related to AI agent identity and payment security. Full proposal emailed to atlas@mitre.org.

Technique 1: Agent Identity Spoofing

• Tactic: Initial Access / Credential Access
• An adversary creates or compromises an AI agent that impersonates a legitimate agent to gain access to systems, data, or financial authority
• Exploits lack of cryptographic identity verification in agent-to-agent communication

Technique 2: Agent Payment Hijacking

• Tactic: Impact (Financial Theft)
• Adversary manipulates an AI agent's payment flow to redirect funds
• Exploits gap between agent identity verification and payment execution

Mitigations:

• Challenge-response cryptographic identity verification (ECDSA P-256)
• Pre-payment sanctions screening (OFAC/HMT)
• Behavioural trust scoring with graduated spend limits
• Message-level signing with nonce-based replay protection

Related standards:

• IETF draft-sharif-agent-payment-trust-00
• OWASP MCP Security Cheat Sheet Section 7
• NIST NCCoE AI Agent Identity concept paper