Agentic commerce fraud rises as AI agents evade trust checks

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Forter's blog post: Automation-driven fraud is accelerating in agentic commerce, and the core problem is distinguishing legitimate agent activity from malicious agents and account takeovers.

Why it matters: IAM, fraud, and identity verification teams need controls that validate behaviour and ownership when agents transact, because declared automation alone is no longer a reliable trust signal.

By the numbers:

• Over the past two months, Forter has seen automation-driven fraud increase 2x.

Context

Agentic commerce creates a trust problem because software can now act with the speed and consistency that once made automation easy to detect, while still looking like an ordinary buyer. When agents can buy, compare, and adapt on behalf of a user, traditional bot controls that focus only on volume or obvious automation lose precision.

The real governance gap is not whether an interaction is automated, but whether the system can still bind the action to a accountable human, a valid mandate, and a believable behavioural baseline. That makes agent identity, session continuity, and fraud intelligence part of the same control plane, not separate problems.

Key questions

Q: How do I tell malicious agents from account takeovers?

A: Malicious agents are autonomous software instances that act with harmful intent, while account takeover is unauthorised use of a legitimate human or machine account. Distinguish them by checking whether the runtime behaviour matches a trusted identity, using device attestation, session telemetry, MFA prompts, token usage patterns and unusual privilege escalation. A takeover reuses valid credentials; a malicious agent may not.

Q: Why do behavioural baselines matter in agentic commerce?

A: Behavioural baselines matter because agentic commerce can involve autonomous buying, negotiation and payment actions that look ordinary in isolation but drift from an approved pattern. Baselines for sequence, timing, spend limits, geolocation, API call rate and data access help detect spoofed agents, compromised credentials and policy violations before a transaction completes.

Q: How can fraud teams govern anonymous agent traffic?

A: Fraud teams govern anonymous agent traffic by treating it as untrusted until it proves a declared purpose, allowed tool set and accountable owner. Platform declarations give a machine-readable statement of identity, intent, data scope and policy, which can be checked against reputation signals, rate limits, bot detection and abuse thresholds before access is granted.

Q: What is the best way to verify a buyer agent at runtime?

A: The best way to verify a buyer agent at runtime is to bind the session to a known identity and continuously re-check its context. Session continuity means validating tokens, device or workload attestation, origin, transaction history and permission scope so the agent cannot be swapped mid-session by a spoofed process or stolen credential.

Technical breakdown

Malicious agents versus agent takeovers

The article separates two fraud patterns that look similar at the transaction layer but differ in origin. Malicious agents are built by the fraudster and operate with stolen identities or payment credentials. Agent takeovers begin with a legitimate buyer’s agent, then shift control to an unauthorised actor who inherits trust, history, and behavioural continuity. The distinction matters because detection has to inspect both the actor and the session context. In practice, the same platform may need to treat one flow as synthetic automation and the other as account compromise. See the Agentic AI Identity Guide.

Practical implication: Model both creation-time fraud and session takeover as separate control problems, because they fail through different signals and require different detections.

Why declared automation is not a reliable trust signal

Declared automation is too weak to serve as a sole trust control because some agents will not identify themselves, and some legitimate automation shares traits with fraud. The key challenge is that platform declarations, allow-lists, or device fingerprints can be absent, inconsistent, or spoofed. That means fraud teams need corroborating evidence from transaction history, preference patterns, delivery behaviour, and multi-session consistency. In agentic commerce, the absence of a declaration does not prove maliciousness, and the presence of one does not prove legitimacy. See the Shadow AI and AI Agent Discovery Guide.

Practical implication: Use behavioural and network context as the decision layer, not platform declaration alone, when judging agentic transactions.

Behavioural baselines now matter more than device signals

Agentic commerce changes which signals are predictive. Some device and connection attributes disappear when an agent transacts, but that does not make the transaction opaque if the programme has a durable behavioural baseline. The stronger pattern is longitudinal consistency: how often the actor buys, where it ships, which preferences repeat, and whether the live session aligns with the owner’s history. This is closer to identity verification than classic bot management, because the decision is about continuity of behaviour rather than a static device check. See the Agentic Commerce Identity Guide.

Practical implication: Shift detection toward longitudinal behavioural consistency, because static device heuristics will misclassify both good agents and hostile automation.

Threat narrative

Attacker objective: The attacker wants to commit fraud at scale while inheriting the trust associated with legitimate buyer behaviour and agent activity.

1. Entry occurs when fraudsters use stolen identities, payment credentials, or hijacked buyer agents to enter the commerce flow as trusted actors.
2. Credential access is reinforced by the attacker’s use of authentic-looking session context, historical preferences, and account continuity that conceal the change in control.
3. Escalation follows when the malicious actor scales automated purchasing or takeover activity across channels and merchants without triggering basic bot rules.
4. Impact is fraudulent commerce at scale, with legitimate buyers impersonated, trust signals polluted, and merchants losing confidence in agent-driven transactions.

Breaches seen in the wild

• Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.
• Gemini CLI prompt injection flaw 2025: Tracebit showed a poisoned README could make Gemini CLI run hidden commands and exfiltrate developer secrets; Google fixed it in 0.1.14.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic commerce creates a trust boundary problem, not just a bot problem. Once automation can behave like a buyer, the security question shifts from whether traffic is automated to whether the actor behind it is authorised, accountable, and behaviourally consistent. That is an identity and fraud governance issue at the same time, which means controls must evaluate mandate and continuity rather than just volume. Practitioners should treat agent trust as a first-class control domain.

Declared agents will not be enough for governance. The article's central insight is that some agents will stay anonymous while others will be legitimate automation used by bad actors. That makes platform declaration, allow-lists, and coarse bot scoring too weak on their own. Organisations need cross-merchant context, behavioural baselines, and fraud telemetry that can distinguish a real customer pattern from a borrowed one. Practitioners should assume the declaration layer can be absent, false, or incomplete.

Identity verification is moving from onboarding to runtime. The stronger risk is not just who opened the account, but who is steering the agent at the moment of purchase. That puts the verification problem closer to session assurance and behavioural authentication than to traditional checkout controls. Agentic commerce identity model becomes relevant here because the system needs a way to connect action, authority, and accountable human ownership. Practitioners should align fraud decisioning with runtime identity evidence.

Agentic commerce will reward controls that understand context across merchants. Merchant-local signals are no longer enough when fraudulent behaviour borrows trust from prior sessions or other properties. Network-level context, preference history, and longitudinal consistency create a stronger picture of legitimacy than a single transaction ever can. This is where fraud prevention begins to overlap with identity intelligence. Practitioners should build detection around patterns that persist across channels, not isolated events.

What this signals

Agent trust will become a policy decision, not a bot score. As agentic commerce grows, programmes will need to decide which forms of automation are acceptable, which require higher assurance, and which should be blocked because the mandate cannot be proven. That pushes fraud, IAM, and identity verification teams toward shared runtime controls instead of separate review queues.

Buyer continuity is the new control surface. The important question is no longer only whether a session is automated, but whether the same actor, preferences, and fulfilment patterns stay coherent over time. That forces practitioners to harden behavioural analytics, session assurance, and cross-channel correlation before agent traffic becomes routine.

Governance will need a human accountability layer even when the action is automated. If merchants cannot tie agent activity back to a real customer relationship, fraud controls will drift toward noisy blocking or permissive acceptance. The programme therefore needs a way to preserve accountable human ownership across every agent-driven transaction.

For practitioners

• Implement runtime agent trust scoring Score each transaction on whether the live actor matches the owner’s historical behaviour, preferences, shipping patterns, and session continuity, rather than relying on a bot flag alone. See the Agentic AI Identity Guide.
• Separate malicious automation from takeover detection Create different detection logic for fraudster-built agents and legitimate agents under hostile control, because the evidence patterns and response paths are not the same.
• Use longitudinal behavioural baselines Maintain customer baselines across orders, destinations, and timing so the programme can spot sudden drift even when the interface and platform signals look normal.
• Correlate merchant and network intelligence Fuse transaction telemetry with cross-merchant intelligence so a suspicious agent pattern seen in one environment can inform decisions in another.

Key takeaways

• Automation-driven fraud is rising because AI agents can scale abuse while still resembling legitimate commerce activity.
• The main governance challenge is distinguishing authentic customer-driven agent activity from malicious automation or takeover.
• Fraud prevention now depends on runtime identity evidence, behavioural continuity, and cross-channel context rather than bot detection alone.

Related NHI Mgmt Group resources: Agentic AI Identity Guide · Agentic Commerce Identity Guide · AI Agent Observability, Audit and Incident Response Guide · Shadow AI and AI Agent Discovery Guide

Key terms

• Agentic Commerce: Agentic commerce is a buying and transaction model where software agents act on behalf of a person. The identity challenge is not just proving who owns the account, but constraining what the agent may do, for how long, and under what revocation and audit rules.
• Malicious Agent: A malicious agent is an autonomous software agent that is designed or compromised to cause harm, such as theft, fraud, sabotage or unauthorised access. It may impersonate a legitimate agent, abuse delegated authority or automate attacks at runtime, so controls focus on identity binding, least privilege, attestation and revocation.
• Cross-Merchant Intelligence: Cross-merchant intelligence is shared fraud or risk information used across multiple merchants to spot repeated abuse patterns, suspicious identities or coordinated attacks. It combines signals such as device reputation, transaction anomalies, bot behaviour and account abuse, usually under governance rules that limit data sharing, retention and false positives.
• Agent Takeover: Agent takeover is the abuse of an AI-powered shopping flow after an attacker gains access to a customer account or delegated purchase path. The risk is that an attacker can use the agent's legitimacy to place purchases, move inventory, or test fraud at scale.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, and machine identity security. It helps practitioners connect identity controls to the broader security programmes they run.