TL;DR: Agentic shopping is moving from experimentation to near-term reality, and the article argues that merchants will face a sharper trade-off between customer control and traffic loss as AI assistants take over more purchasing steps. Riskified also reports LLM-referred traffic as 2.3x riskier in one ticketing example and 1.8x riskier in electronics.
At a glance
What this is: Riskified argues that agentic commerce will shift ecommerce from human-led browsing to AI-driven purchasing, while making fraud detection harder because familiar behavioural signals may disappear.
Why it matters: This matters because merchants will need to govern agent-driven transactions without over-relying on legacy fraud heuristics, and identity teams will have to think about delegated access, tokenised payment flows, and abuse at machine speed.
Context
Agentic commerce describes shopping flows where software agents research, compare, and eventually purchase on a user's behalf. The security problem is not only whether the transaction succeeds, but whether merchants can still distinguish legitimate delegation from abuse when the buying process is mediated by a machine.
For IAM and fraud teams, the governance gap is the loss of human-origin signals that many controls still assume will exist at checkout. When the actor is a delegated agent rather than a person, authorisation, risk scoring, and account protection need to shift from simple session analysis to policy around identity, intent, and payment delegation.
The article frames this as an ecommerce transition rather than a distant AI thought exercise, which is the right lens. The operational question is whether merchants can preserve trust and abuse controls as shopping becomes partially or fully agent mediated.
Key questions
Q: What breaks when shopping is delegated to AI agents?
A: The main failure is that many fraud controls assume a human browser session will leave enough behavioural evidence to judge intent. When an agent acts on behalf of a shopper, those signals shrink or disappear, so merchants must shift to delegated-authorisation checks, token governance, and transaction-context scoring.
Q: Why do AI shopping agents create a fraud risk beyond normal e-commerce bots?
A: AI shopping agents create more risk because they can infer intent, combine signals across channels, and act with delegated authority rather than waiting for each user click. That makes them vulnerable to spoofed sellers, fake reviews, and malicious prompts. The issue is not automation alone, but autonomous decision-making under imperfect trust.
Q: How should merchants prepare for agent-driven checkout flows?
A: They should define where agents are allowed to act, what authority each agent has, and which purchases require additional verification. The goal is to govern delegated commerce as a formal access model, not to let every AI-driven transaction inherit the same trust assumptions as a human shopper.
Q: Should merchants prioritise control or reach when agents drive traffic?
A: Merchants will need to balance both, but control should come first in high-risk categories. If teams accept agent traffic without clear policy boundaries, they may gain volume while losing visibility, fraud discrimination, and pricing leverage across the customer journey.
Technical breakdown
How agentic commerce changes transaction trust
In a normal ecommerce flow, merchants infer trust from browser fingerprints, click paths, dwell time, device reputation, and session continuity. Agentic commerce weakens those signals because the purchaser may be a software agent acting through an approved interface or token, not a human using a browser in the usual way. That means the merchant is no longer validating only the customer, but also the delegated actor, the scope of delegation, and the legitimacy of the purchase intent. Payment networks are already experimenting with spending limits and tokenised credentials, which shows that the technical model is moving toward scoped delegation rather than open-ended account use.
Practical implication: merchants need policy controls that recognise delegated purchase authority, not just customer login success.
Why legacy fraud models struggle with agent-driven shopping
Legacy fraud systems are tuned to behavioural friction. They look for anomalies in mouse movement, browser history, device persistence, and human navigation patterns. AI agents compress or eliminate those cues, so a model that depends on behaviour may see less evidence exactly when risk rises. That is a classic signal loss problem: the transaction still occurs, but the observable trail becomes thinner and more machine-like. Once bad actors deploy their own agents, they can scale credential abuse, reseller arbitrage, and multi-merchant testing without the human tells that many controls depend on.
Practical implication: fraud teams should assume lower signal quality and redesign scoring around transaction context, not just user behaviour.
Merchant-controlled, collaborative, and decentralised commerce are different control models
The article's three scenarios map to three governance postures. A merchant-controlled model keeps AI shopping native to the platform, preserving direct control but demanding stronger in-house capability. A collaborative model introduces standard APIs and shared protocols, which creates a managed delegation boundary. A decentralised model pushes merchants into inventory providers competing inside agent ecosystems, where brand and relationship control shrink. The security significance is that each model changes who owns the trust boundary: the merchant, the shared protocol, or the agent platform. That boundary choice will shape fraud liability, access policy, and how much customer identity data merchants can safely depend on.
Practical implication: teams should decide which delegation boundary they can actually govern before agent traffic scales.
Threat narrative
Attacker objective: The objective is to automate fraudulent purchasing and abuse merchant trust boundaries at scale while evading controls that were designed for human browsing.
- Entry occurs when a shopper account or purchase workflow is accessed through an AI agent rather than a direct human session, which removes many familiar behavioural checks.
- Credential and token abuse follows when an attacker uses stolen account access, delegated purchase rights, or weakly scoped agent permissions to initiate purchases at scale.
- Impact emerges as merchants face automated fraud, reseller arbitrage, and multi-merchant abuse that can look legitimate inside an agent-mediated checkout path.
Breaches seen in the wild
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
- Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Agentic commerce creates an intent-verification problem, not just a fraud-detection problem: when software can act on a user's behalf, merchants need to know whether the agent is authorised to purchase, not merely whether the transaction is technically valid. That pushes governance from session scoring into delegated-access policy. The merchant control plane becomes a trust boundary, and practitioners should treat purchase intent as a governed entitlement.
Delegated commerce trust gap: the article exposes a governance gap created by systems that still assume a person is present at checkout. Once agents transact, behavioural signals lose much of their value and many existing anti-fraud assumptions fail. This is not a temporary tuning issue but a structural shift in how trust is established across identity, payment, and fulfilment flows. Practitioners should redesign controls for delegated identity, not human mimicry.
Fraud scaling will increasingly look like automation, not deception alone: bad actors do not need to defeat every merchant control if they can industrialise credential abuse, inventory testing, and reseller arbitrage through agents. That changes fraud from a point-in-time event to a machine-speed campaign pattern. The right governance response is to classify agent-driven abuse as an access and authorisation problem as much as a fraud problem.
Merchants face a platform choice that will define future control strength: merchant-native, collaborative, and decentralised agentic commerce models each move the trust boundary differently. A decentralised model may expand traffic but compress control, while a merchant-native model preserves more governance but demands sustained investment. The field is heading toward explicit delegation architectures, and merchant teams should align fraud strategy with that operating model now.
Named concept: delegated commerce trust gap: this is the widening gap between traditional fraud controls built for human browsing and the delegated identity model required for AI-driven purchasing. It will become a defining control issue as agentic commerce scales, so merchants should plan for authorisation-aware fraud governance rather than more behaviour-only scoring.
From our research library:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
- Read next: Agentic AI Identity Guide
What this signals
Agentic commerce will force merchants to move fraud governance upstream: risk decisions will need to happen before checkout completes, because session behaviour will no longer be the main trust signal. That means merchants should prepare for policy-driven authorisation and token controls to matter more than legacy behavioural scoring.
The category will also create a clearer separation between traffic acceptance and transaction trust. Merchants can no longer assume that a shopping session is safe just because it arrived from a reputable referral path, especially when LLM-referred traffic is already 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years. according to the 2026 Infrastructure Identity Survey in adjacent digital workflows.
Delegated commerce trust gap: the governance problem is not whether merchants can block AI shopping, but whether they can differentiate authorised delegation from automated abuse at machine speed. That gap will define the next generation of fraud operations, merchant policy design, and identity-aware payment controls.
For practitioners
- Define delegated purchase boundaries Specify which AI agents may browse, recommend, or complete purchases, and tie each permission to a narrow scope, merchant segment, or spend limit.
- Revise fraud models for low-signal checkouts Retrain detection logic to weight transaction context, account history, token provenance, and fulfilment anomalies when behavioural signals are missing.
- Treat agent tokens as governed credentials Inventory any tokenised credentials, spending tokens, or delegated access paths used by shopping agents and apply lifecycle controls that match their risk.
- Test abuse scenarios across merchant ecosystems Run exercises for agent takeovers, automated reseller arbitrage, and multi-merchant testing so teams can see where current controls lose discrimination.
Key takeaways
- Agentic shopping shifts fraud risk from visible human behaviour toward delegated machine action, which weakens the assumptions behind many current ecommerce controls.
- The article's own examples show that LLM-referred traffic can be materially riskier than conventional referral traffic, especially in ticketing and electronics contexts.
- Merchants that want to preserve trust will need policy-based delegation, token governance, and risk models that work even when human browsing signals are missing.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 addresses the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Agent-driven checkout depends on delegated identity and scoped purchase authority. |
| ASI09 — Human-Agent Trust Exploitation | The article describes trust failures when agents act on behalf of shoppers. | |
| ASI02 — Tool Misuse | Agents can misuse shopping and payment tools when permissions are too broad. | |
| Recommendation — Model agent checkout flows against ASI03 and restrict delegated purchase privileges to the minimum required scope. Apply ASI09 controls to separate legitimate delegation from agent-based abuse in commerce flows. Limit tool permissions under ASI02 so shopping agents can only execute the actions they are explicitly allowed to perform. | ||
| NIST AI RMF | GOVERN — AI Governance and Accountability | Agentic commerce needs governance over accountability, delegation, and control boundaries. |
| Recommendation — Use GOVERN to assign clear accountability for delegated AI purchasing decisions and their risk outcomes. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Delegated commerce is fundamentally an authorisation problem across systems and tokens. |
| Recommendation — Apply PR.AA-05 to govern who or what may initiate purchases, spend funds, or access merchant APIs. | ||
Key terms
- Agentic Commerce: Agentic commerce is a buying and transaction model where software agents act on behalf of a person. The identity challenge is not just proving who owns the account, but constraining what the agent may do, for how long, and under what revocation and audit rules.
- Delegated Purchase Authority: Delegated purchase authority is the permission a consumer grants to an assistant, wallet or AI agent to act on their behalf. The security issue is that the delegated actor can become a trusted path for abuse if scope, intent and revocation are not governed tightly.
- Transaction Signal Loss: Transaction signal loss occurs when the behavioural evidence used by fraud systems becomes thin, misleading, or unavailable. AI agents can remove the normal human interaction patterns that support scoring, forcing teams to rely more on token provenance, account history, and downstream anomalies.
- Agent Takeover: Agent takeover is the abuse of an AI-powered shopping flow after an attacker gains access to a customer account or delegated purchase path. The risk is that an attacker can use the agent's legitimacy to place purchases, move inventory, or test fraud at scale.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, machine identity security, IAM, and secrets management. It helps practitioners translate identity controls into governance decisions for systems that act on behalf of users.
Published by the NHIMG editorial team on July 11, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org