What breaks when merchants treat agent-led shopping like normal human browsing?

Why This Matters for Security Teams

Agent-led shopping changes the trust model at the edge of commerce. Human browsing signals such as pauses, backtracking, tab switching and form hesitation no longer map cleanly to intent, so fraud controls, bot detection and checkout friction can all misfire at once. The result is not just more false positives. It is also weaker detection of malicious automation that now looks like legitimate AI-assisted purchasing behaviour.

That matters because merchant controls are usually tuned to human patterns, while agentic workflows can compress research, comparison and checkout into a short burst of machine-speed actions. Guidance from the OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework both point to the same problem: systems must validate intent, provenance and action authority, not just surface behaviour.

NHIMG research shows that 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, which is a useful warning here because shopping agents often behave like privileged non-human actors once they can hold tokens, saved payment methods or session cookies. In practice, many security teams only notice the mismatch after legitimate agent traffic has already been throttled or abused by fraudsters.

How It Works in Practice

Merchant stacks usually rely on a mix of velocity checks, device reputation, behavioural analytics and risk scoring. Those controls work when the shopper is a human with natural hesitation and inconsistent navigation. They break down when an AI agent can compare prices, read reviews, fill carts and complete checkout without the usual human latency. The merchant then has to decide whether the session is a trusted delegated action, a consumer bot, or an attacker using an agent-shaped workflow.

Operationally, the control question shifts from "does this look human?" to "is this authorised, bounded and attributable?" That means merchants need stronger signals around session binding, step-up verification, transaction context, payment method provenance and policy-based limits on what the agent may do. The OWASP NHI Top 10 is relevant because shopping agents often inherit the same governance issues seen in other machine identities: weak lifecycle control, overbroad permissions and poor revocation discipline.

• Bind the agent session to a specific customer, device or delegated workflow.
• Use risk scoring that includes intent confidence, not just page cadence.
• Limit cart modification, payment changes and shipping-address edits by policy.
• Log agent actions with clear attribution for fraud review and dispute handling.
• Revoke or expire tokens aggressively when context changes.

For threat modeling, practitioners should also compare abuse paths against the MITRE ATLAS adversarial AI threat matrix and the NHI lifecycle guidance in Ultimate Guide to NHIs — 2025 Outlook and Predictions, because the same token and privilege failures that affect enterprise agents also apply to commerce agents. These controls tend to break down when merchants rely on legacy bot-management thresholds in high-conversion environments with shared accounts, saved credentials and API-driven checkout flows, because the agent looks both too fast for human norms and too normal for basic automation rules.

Common Variations and Edge Cases

Tighter checkout controls often increase cart abandonment and support overhead, requiring organisations to balance conversion against abuse resistance. That tradeoff is sharper in retail than in many other domains because a legitimate agent may be acting on behalf of a consumer, while a malicious bot may use the same browsing pattern to harvest stock, probe promos or commit fraud.

Best practice is still evolving for how merchants distinguish authorised agentic commerce from generic automation. There is no universal standard for this yet. Some environments may accept delegated tokens and policy claims from a trusted agent platform, while others will prefer out-of-band confirmation for high-risk purchases. The key is to apply stronger controls only where the transaction risk justifies the friction.

This is also where identity intersects with commerce. If the agent is allowed to spend, reorder or modify account data, it effectively becomes a non-human identity with commercial authority. That makes revocation, scoped permissions and evidence of delegation essential. The merchant should be able to answer who authorised the action, what the agent was allowed to do, and how the session can be terminated. For broader governance context, the same operational concerns appear in the NIST AI Risk Management Framework and the OWASP Agentic AI Top 10. In practice, failures cluster around shared credentials, delegated wallet access and weak revocation when a consumer switches from one assistant to another.

Related resources from NHI Mgmt Group

• What breaks when organisations treat agent identities like service accounts?
• What breaks when agent access reviews are designed like human access reviews?
• What breaks when agent access is treated like a normal service account?
• What breaks when an agent is treated like a normal service account?