Agentic commerce is forcing marketplaces to rethink identity and risk

At a glance

What this is: Signifyd argues that agentic commerce changes marketplace discovery, checkout and fraud controls because AI agents alter how intent, identity and risk are expressed across the transaction journey.

Why it matters: This matters to IAM and trust teams because marketplace security now has to govern delegated intent, seller trust and platform abuse patterns that are not visible in human browsing behaviour.

Context

Agentic commerce changes the security problem because the buyer journey is no longer reliably human-shaped. In marketplace environments, that means identity, intent and trust signals can arrive compressed, delegated or partially hidden, which weakens controls built around browsing behaviour and single-account review. The first governance gap is not checkout itself but the assumptions upstream of it.

Marketplaces are especially exposed because they do not control every seller, listing and payout path in the way a single-brand retailer does. That creates a broader identity and risk governance challenge: onboarding integrity, seller verification, behavioural fraud detection and downstream payment validation all have to work together when an AI agent is acting on behalf of a human or alongside a malicious seller.

Key questions

Q: What breaks when marketplaces still rely on human browsing signals for agentic commerce?

A: Human browsing signals stop being reliable when an AI agent arrives with intent already formed and moves directly to product or checkout. Session length, click depth and search-path patterns lose predictive value, so legacy fraud models can under- or over-react. Teams should shift toward identity linkage, device consistency, order patterns and network-based correlations.

Q: Why does agentic commerce increase connected-abuse risk in marketplaces?

A: Agentic commerce makes it easier for one actor to present as many independent buyers, sellers or payouts across the platform. That raises the risk of refund abuse, fake storefronts and laundering-style transactions because isolated account checks miss the linkage. Marketplaces need graph-level monitoring that ties identities, payout details and transaction patterns together.

Q: What are the signs that seller verification is failing in an agent-led marketplace?

A: Common warning signs include sudden listing churn, repeated low-value refunds, reused bank details, suspicious payout changes and buyer accounts that behave like coordinated automation. These signals suggest the marketplace is seeing connected abuse rather than separate incidents. Teams should treat those patterns as a control failure across onboarding, verification and payout governance.

Q: How should marketplaces handle delegated AI agents at checkout?

A: Marketplaces should treat delegated AI checkout as a distinct trust scenario, not a normal human session with faster timing. That means validating agent authority, preserving buyer accountability and passing agent context into fraud and order systems. The goal is to decide whether the agent is authorised and whether the transaction matches expected behaviour, not simply whether a person logged in.

Technical breakdown

Why agent-led sessions break human fraud models

Traditional marketplace fraud models infer trust from human behaviour such as browsing depth, click patterns, dwell time and a gradual path to checkout. Agent-led sessions can skip most of that. An AI agent arrives with intent already formed, moves programmatically and may transact with little visible exploration. That does not make the transaction fraudulent, but it removes the behavioural evidence many rules and models depend on. For marketplaces, the technical issue is that the same control signals now mean less because the actor type has changed. Practical implication: reweight risk models away from human-session heuristics and toward identity, device, order and network correlations.

Practical implication: update fraud controls so they do not depend on browsing behaviour as a proxy for legitimacy.

How seller verification and payout controls can be bypassed

Marketplaces are vulnerable when a fraudulent seller can use AI agents or automated workflows to create the appearance of independent buyer activity. The article describes patterns such as repeated purchases, refund abuse, recycled payout details and reused bank information that blur the line between genuine demand and connected abuse. This is not just an account-level issue. It is a trust problem across the entire marketplace graph, where one bad actor can create many apparently separate events. Practical implication: treat seller verification, refund monitoring and payout governance as continuous controls rather than one-time onboarding checks.

Practical implication: monitor for linked seller and buyer behaviour instead of relying on isolated account reviews.

Delegated checkout requires agent-aware authorization

Checkout becomes harder when the system cannot assume the person completing the transaction is the same person who searched for the item. An authorized agent may act within scope, but the platform still has to validate the delegation, the human behind it and the transaction context. That is an authorization problem as much as a payments problem. In identity terms, the marketplace needs to know whether the request is legitimate, whether the delegated authority is current and whether the downstream risk engines can use agent metadata without treating it as noise. Practical implication: design checkout and fraud workflows to accept and evaluate delegated intent, not only direct human sessions.

Practical implication: pass agent context into fraud and risk systems so delegated transactions are judged in scope.

Threat narrative

Attacker objective: The attacker wants to convert automated or agent-led activity into repeated fraudulent purchases, refunds or payouts while masking the connection between accounts and storefronts.

1. Entry occurs when an agent-led buyer flow or automated workflow reaches the marketplace with compressed behavioural signals and a transaction request that looks unlike a normal human session.
2. Credential or account abuse follows when a malicious seller uses multiple agents, reused payout details or linked buyer accounts to hide that the same actor sits behind repeated purchases and refunds.
3. Escalation happens as the platform mistakes related activity for separate legitimate events, allowing refund abuse, fake storefronts or laundering-style transactions to spread across listings and payouts.
4. Impact is wider platform-wide abuse, including distorted trust signals, fraudulent payouts and reduced confidence in marketplace discovery and transaction data.

Breaches seen in the wild

• JetBrains Marketplace AI Plugin Campaign: 15 malicious JetBrains Marketplace plugins steal AI API keys from 70,000+ developers via supply chain attack.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic commerce creates a delegated-intent governance gap: the marketplace no longer knows whether a transaction should be judged as a direct human action or a permitted agent action. That changes the trust model for discovery, checkout and post-purchase review. Identity teams should treat delegated intent as a first-class governance object, not an edge case.

Marketplace risk is becoming graph-based rather than account-based: seller verification alone cannot contain abuse when the same actor can operate through multiple agents, storefronts and payout paths. Connected-risk analysis is now the control that exposes what individual account reviews miss, which makes platform-wide trust correlation more important than isolated KYC or KYB checks.

Human browsing signals are losing governance value: shorter sessions, fewer clicks and direct-to-product arrivals are not anomalies in agent-led commerce, they are the expected shape of the interaction. That means risk teams need a new named concept, delegated commerce trust gap: the mismatch between who is authorised and what legacy fraud controls can observe. Practitioners should rebuild detection around identity, linkage and payout behaviour.

Catalog quality is now part of identity governance: if agents select products by structured attributes, then poor data becomes a trust and discoverability failure, not just a merchandising issue. Marketplaces that cannot standardise listings will see their sellers misrepresented to both buyers and machines. The operational conclusion is that product data quality is now a control surface for marketplace trust.

Delegated checkout forces authorization to move downstream: a valid cardholder permission is not enough if the platform cannot validate agent scope, session context and transaction purpose. This is where machine-readable delegation intersects with marketplace fraud operations. Security teams should expect authorization and fraud decisions to converge at the point of sale.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Delegated commerce trust gap: marketplaces now have to govern the distance between delegated intent and what legacy fraud systems can observe. When agents compress sessions and skip familiar behavioural footprints, the control point shifts from session review to identity linkage, payout tracing and transaction context.

Marketplaces should expect agent-led shopping to force a redesign of trust decisions across the funnel. The practical risk is not only fraud at checkout but the spread of low-quality seller data, refund abuse and connected accounts that erode confidence in the platform itself. Identity governance now has to extend across buyer, seller and payout relationships, not just login events.

For practitioners

• Standardize catalog inputs for machine discovery Replace freeform seller listings with structured fields for category, size, material, compatibility, shipping speed and condition so agents can compare products reliably.
• Extend seller verification beyond onboarding Monitor for sudden listing changes, repeated refund requests, reused bank details and other signals that indicate a seller is using agent-led abuse to mask identity.
• Build connected-risk detection across buyers and sellers Correlate payout accounts, buyer accounts, storefronts and refund events so the same actor cannot appear as separate legitimate transactions.
• Reweight fraud models for agent-led behaviour Reduce dependence on session length, click depth and browsing path, then increase the weight of device consistency, identity linkage and order-value patterns.
• Pass agent context into checkout decisions Ensure the payment and fraud stack receives agent identity, delegated permissions and session context so a valid agent request is evaluated in scope.

Key takeaways

• Agentic commerce changes marketplace security because the platform can no longer assume that behavioural signals will reveal intent in a human way.
• The risk scales across sellers, buyers and payout paths, which makes linked-account analysis and seller monitoring more important than isolated reviews.
• Practitioners should rebuild controls around structured catalog data, delegated authorization and connected-risk detection rather than human browsing patterns.

Key terms

• Agent-Led Session: An agent-led session is a customer interaction that is initiated or carried materially forward by AI rather than by direct human browsing. These sessions often appear unusually efficient, with fewer clicks, thinner device identity and more direct paths to product pages or checkout.
• Delegated Intent: Delegated intent is the machine-verifiable statement of what a human authorised an agent to do, for which purpose, and within which scope. It becomes a governance boundary when linked to the principal, the resource, the trust level, and the policy version active at the time of execution.
• Connected Abuse: Connected abuse is coordinated fraudulent activity that looks harmless when reviewed account by account but reveals a pattern across buyers, sellers, payouts or devices. It often depends on relationship hiding, reused financial details and automation that makes the same actor appear unrelated.
• Marketplace Trust Graph: The relationship map linking buyers, sellers, listings, payment instruments, refunds and payout paths across a platform. Security teams use this graph to detect linkage, spot coordinated abuse and understand whether a transaction is part of a broader fraud pattern.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity and machine identity security. It helps security and identity practitioners build the governance model that modern delegated access patterns require.