TL;DR: AI agent referrals in Commerce Network were 13.5 times higher in October 2025 than a year earlier, with sales from those referrals up 894%, as ecommerce brands face a new visibility and checkout environment, according to Signifyd. The governance challenge is not only discovery quality but also whether fraud and identity controls can interpret agent-shaped buying behaviour without blocking legitimate sessions.
At a glance
What this is: AI agents in ecommerce are moving from novelty to a material discovery and checkout channel, and Signifyd reports sharply rising referral and sales volumes from those sessions.
Why it matters: Merchants and identity teams now need content, fraud and session controls that can distinguish legitimate agent-assisted shopping from automation-driven abuse.
By the numbers:
- In October 2025, orders from AI agent referrals in Signifyd's Commerce Network were 13.5 times higher than they were a year earlier.
- Sales from those referrals climbed 894%.
Context
AI agents in ecommerce create a governance gap between discovery and control. They do not just automate clicks, they interpret product content, policies and intent before a shopper reaches checkout, which means brands now need to be machine-readable as well as human-readable.
That shift matters to identity and fraud practitioners because the session no longer looks like a conventional shopping journey. The control problem is not simply whether an agent can buy, but whether the merchant can recognise when a fast, low-browse, high-intent session is legitimate agent-assisted commerce or suspicious automation.
Key questions
Q: What breaks when ecommerce content is not machine readable for AI agents?
A: When product pages, FAQs and policy text are too vague or inconsistent, AI agents fill gaps with partial or outdated interpretations. That can suppress a merchant's visibility, distort product fit and create inaccurate recommendations. The governance failure is not just bad SEO. It is a lack of structured, trustworthy inputs for machine interpretation.
Q: Why can AI-assisted shopping look suspicious to fraud systems?
A: Because the assistant may do the browsing, comparison and filtering before the shopper reaches the site, the session can appear unusually short or direct. That is a problem for rules built around human browsing patterns. Merchants need to weigh account, payment, device and delivery context, not just click behaviour.
Q: How should merchants balance AI visibility with fraud controls?
A: They should optimise content so agents can understand the brand, while keeping transaction controls flexible enough to evaluate the full identity context. The aim is not to trust agents blindly or block them by default. It is to separate legitimate agent-assisted buying from automation that is trying to look normal.
Q: What should teams do when AI agents misrepresent products or policies?
A: Treat the mismatch as a source-data problem first. Fix the pages, attributes and structured data that assistants are likely to read, then retest the same prompts to see whether the summary improves. If the error persists, adjust the policy language and product detail structure until the machine can cite the right facts.
Technical breakdown
How AI agents change ecommerce discovery signals
AI agents do not search like humans and they do not compare products the way a traditional recommendation engine does. They parse a shopper's brief, infer constraints, scan brand pages, product details, FAQs, reviews and policy language, then decide what to recommend or whether to continue the journey. That means the signals shaping discovery are increasingly semantic and structured, not just keyword-based. For merchants, product attributes, category labels and policy clarity become part of the control surface because machines need unambiguous inputs to summarise and rank the offer correctly.
Practical implication: treat product content, schema and policy pages as governance inputs, not just marketing assets.
Why fraud rules can misread agent-shaped sessions
Fraud systems often rely on signals such as click depth, page views, time on site and referral patterns. Agent-assisted shopping can compress all of those signals because the assistant does the browsing before the shopper lands on the site. That creates a false tension: a legitimate session can look thin, while a malicious automated session can look similar on the surface. The real issue is not speed alone, but whether the merchant can join device, account, payment, address and behavioural context before deciding how much trust to extend.
Practical implication: move from single-session heuristics to multi-signal identity and transaction evaluation.
Why ecommerce now needs machine-readable brand intent
The article's 'codify your vibe' idea reflects a deeper governance requirement: brand intent has to exist in structured, parsable language if AI systems are going to represent it accurately. When differentiators live only in imagery or brand voice, assistants can miss, distort or overstate them. That is an identity and access issue in practice because the machine is being delegated a form of representation authority over the brand and its offers. Clearer source content narrows the gap between what the merchant knows about the product and what the agent can safely repeat.
Practical implication: encode differentiators, usage context and policy language in forms AI systems can reliably ingest.
Threat narrative
Attacker objective: The objective is to manipulate discovery and checkout outcomes by exploiting the merchant's inability to distinguish legitimate AI-assisted commerce from automation-driven fraud.
- Entry occurs when an AI assistant or agent reaches product, policy and checkout content before the shopper does, using that material to shape the session.
- Credential or trust abuse happens when merchants over-trust the agent-shaped session and underweight contextual signals because the browsing pattern looks non-human.
- Impact appears when legitimate agent-led discovery is blocked or malicious automation is allowed through, either of which distorts revenue and risk decisions.
Breaches seen in the wild
- postmark-mcp malicious MCP server 2025: A fake Postmark MCP server on npm quietly BCC'd every email AI agents sent through it to an attacker, using victims' own Postmark tokens.
- Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Agent-assisted commerce creates a new trust boundary: merchants are no longer only optimising for human discovery, they are optimising for machine interpretation of product truth. That changes the governance problem from ranking content to controlling how product, policy and checkout signals are consumed. The practitioners' job is to make sure the machine's answer reflects the merchant's actual offer, not an inferred approximation.
Checkout rules now need identity context, not just velocity thresholds: a short, direct session is not automatically suspicious when an AI assistant has already done the comparison work offsite. The control gap is over-reliance on session shape as a proxy for legitimacy, which is increasingly weak in agentic commerce. Fraud and identity teams need to evaluate the full customer context before overfitting rules to human browsing patterns.
Machine-readable intent is becoming a named governance concept: if product differentiators, return terms and use cases are not encoded clearly, AI systems will fill the gap with their own summaries. That creates a verification problem for ecommerce and identity teams because the brand loses control over how it is represented at the point of recommendation. Practitioners should treat content clarity as a governance control, not a copywriting preference.
Agentic commerce will expose weak policy boundaries faster than traditional ecommerce: AI systems will amplify any mismatch between product data, structured data and checkout enforcement. The merchants most exposed are the ones whose catalogue, policy and fraud decisions were designed for linear human navigation. The practical conclusion is to align discovery, disclosure and risk decisioning before agent-led traffic becomes routine.
From our research library:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
- Read next: AI Agent Identity Security Buyer's Guide
What this signals
Agentic commerce is now a content governance problem as much as a fraud problem: if AI assistants cannot reliably parse the brand's offer, merchants lose control over how demand is routed and how risk is assessed. That means product truth, policy clarity and structured data now sit closer to security controls than to marketing copy.
Fast sessions are no longer a reliable proxy for bad intent: once an assistant has done the comparison work offsite, a legitimate shopper may arrive with minimal browsing but high purchase intent. Identity and fraud teams should move toward context-rich decisioning rather than hardening rules around traditional human navigation patterns.
Machine-readable intent will define the next control surface: the brands that win discovery will be the ones that can express differentiators in ways both people and systems can consume. For practitioners, this is a sign to test content, schema and checkout logic together instead of treating them as separate workstreams.
For practitioners
- Audit product pages for machine readability Review product titles, feature bullets, FAQs, reviews and structured data so AI assistants can summarise the offer without guessing at size, use case or policy details.
- Test how AI assistants describe your brand Run the same shopper-style prompts across multiple assistants and compare whether they identify the right use cases, differentiators, and policy details.
- Re-tune fraud rules for agent-assisted sessions Reduce over-reliance on page depth and dwell time, then add account, payment, device and delivery context before escalating a fast checkout for review.
- Make policies summarisation-friendly Rewrite returns, warranty, shipping and eligibility language so it can be accurately quoted by an AI system without stripping away key conditions or exceptions.
- Build quarterly visibility testing into workflow Re-run priority prompts on a regular cadence so changes in assortment, policies and competitor positioning do not leave assistants working from stale information.
Key takeaways
- AI agents are changing ecommerce discovery by acting on structured product and policy signals, not just human search queries.
- Fraud controls built around human browsing patterns can misclassify legitimate agent-assisted sessions and miss automation that looks similar on the surface.
- Merchants need clearer product data, policy language and identity-aware risk evaluation so discovery and checkout controls stay aligned.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and OWASP API Security Top 10 address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-10 — Human Use of NHI | AI-assisted commerce delegates shopper decisions to a machine acting on the merchant's content. |
| Recommendation — Govern AI-assisted shopping flows so delegated machine actions cannot bypass transaction controls or content integrity checks. | ||
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Agent-led purchase flows can overstep intended trust boundaries when session context is weak. |
| Recommendation — Constrain agent permissions and verify delegated actions before allowing them to influence checkout or account state. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Fraud and session controls depend on accurate authorisation decisions for agent-shaped transactions. |
| Recommendation — Apply PR.AA-05 to enforce context-aware authorisation for agent-assisted purchases and related account actions. | ||
| NIST SP 800-53 Rev 5 | IA-9 — Identification and Authentication (Non-Organizational Users) | Ecommerce shoppers, devices and agent-mediated sessions are external identities that need trustworthy authentication signals. |
| Recommendation — Use IA-9 to validate non-organizational access paths before granting trust to agent-assisted sessions. | ||
| OWASP API Security Top 10 | API8 — Security Misconfiguration | Incorrectly exposed product, policy or checkout data misleads agents and weakens downstream controls. |
| Recommendation — Harden exposed APIs and data surfaces so AI systems read current product and policy truth rather than stale configuration. | ||
Key terms
- Agent-Assisted Commerce: A shopping journey where an AI system researches, compares or advances purchases on behalf of a human. The security issue is that the merchant may see a shortened or non-linear session while the real decision process happened earlier in a machine-mediated layer.
- Machine-Readable Brand Intent: The set of product attributes, policy language and structured signals that tell AI systems what a brand stands for and when it should be recommended. If that intent is only expressed in visual or marketing language, machines are more likely to misstate it or miss it entirely.
- Identity-Rich Fraud Decisioning: A fraud approach that evaluates account, device, payment, address and behavioural context together instead of relying on one session signal such as click depth or dwell time. In agentic commerce, that broader context is necessary because legitimate AI-assisted sessions can look unusually fast.
- Structured Data: Structured data is information organized in a fixed schema, such as rows, columns, fields, or database records. It is easy to search, query, and analyze because its format is predictable. In security programs, structured data is simpler to classify and govern, but still needs access control, retention rules, and validation to prevent misuse.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and agentic AI identity. It helps practitioners align identity controls with the systems now acting on their behalf.
Published by the NHIMG editorial team on July 10, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org