AI Shopping Agents Are Exposing Retail’s Trust Gap

Google News surfaced a blunt warning in August: AI shopping agents are reaching retailers faster than security systems can establish whether those agents deserve access.

The original analysis appeared as Google and its retail partners pushed agentic commerce toward real transactions. Agentic commerce means software can research, select, and purchase products under authority delegated by a person.

The conflict is no longer between shoppers and crude checkout bots. It is between authorized agents carrying real demand and malicious automation designed to look equally legitimate.

Google, Visa, Mastercard, Cloudflare, FIDO Alliance members, and major retailers are building standards to close that gap. However, those projects divide trust across agent identity, user authorization, payment credentials, and merchant policy.

A valid signature can identify the software that sent a request. It does not automatically prove that every requested action reflects the user’s current intent.

That distinction creates the central problem for retailers. They must welcome valuable automated shoppers without granting the same privileges to account thieves, inventory scalpers, synthetic identities, or compromised agents.

Google News coverage often presents AI shopping agents as a new consumer interface. Retail security teams see something more consequential: a new class of machine customer that can browse, negotiate, authenticate, and spend.

Traditional defenses were built to answer a simpler question. Is this traffic human or automated?

Retailers now need to ask who controls the agent, what the person authorized, which actions remain permitted, and who absorbs losses when something goes wrong.

Google News Is Tracking a Shift From Recommendations to Transactions

The important change is not that AI can recommend products. It is that major platforms are connecting recommendations directly to checkout.

Google announced the Universal Commerce Protocol with Shopify and retail partners in January 2026. UCP is an open standard intended to connect AI interfaces with product discovery, checkout, and post-purchase systems.

More than 20 retailers, platforms, and payment companies endorsed the initiative at launch, according to shopping standard coverage. Participants included Etsy, Wayfair, Walmart, Target, Mastercard, Visa, and other large commerce operators.

Google said the protocol would support purchases inside AI Mode in Search and the Gemini app. That structure reduces the need to move between an AI conversation, a retailer’s website, and a separate checkout flow.

The consumer sees convenience. The merchant receives a series of machine-generated requests that may touch product catalogs, inventory systems, customer accounts, loyalty data, and payment infrastructure.

That difference matters because each request carries a different risk. Reading a public product description is not equivalent to reserving scarce inventory or submitting a stored payment credential.

AI shopping agents can also work at a speed and scale that human customers cannot match. One agent might compare hundreds of listings, test several delivery configurations, and monitor changing prices.

Those actions can resemble scraping, credential abuse, promotion harvesting, or inventory manipulation. A system that blocks all high-speed automation may reject a valuable customer’s authorized assistant.

A system that permits every agent claiming commercial intent creates the opposite problem. Attackers can label malicious tools as shopping assistants and exploit the more permissive route.

This is why Google News reports about AI shopping are becoming security stories. The interface has advanced from generating text to initiating operations inside systems that hold money and personal data.

The change also pressures existing fraud models. Many models learn from device fingerprints, session histories, navigation patterns, and familiar relationships between accounts and payment instruments.

An agent can break those relationships. It may operate from cloud infrastructure, use an unfamiliar device profile, and transact at an unusual hour for a customer.

The behavior can look fraudulent even when the instruction is legitimate. Conversely, a compromised agent can carry valid credentials and behave like a trusted service.

Google’s commerce push raises the stakes because it can bring agent-mediated shopping into products with wide consumer reach. The more traffic arrives through recognized AI platforms, the less practical blanket blocking becomes.

Retailers therefore need graduated decisions. An agent might receive catalog access but not account access, or build a cart without final payment authority.

That model treats trust as specific to an action. It avoids assuming that an agent approved for one task should receive unrestricted access throughout the buying journey.

Retail Security Still Relies on the Wrong Distinction

Retail defenses remain good at classifying traffic patterns, but agentic commerce requires proof of identity, authority, intent, and transaction scope.

Akamai reported that commerce represented 47.9 percent of AI bot traffic observed across its global network from July through December 2025. AI training crawlers generated more than 70 percent of commerce-related AI bot triggers.

Those numbers describe traffic volume, not verified shopping demand. They still reveal the scale of automated activity that security teams must classify before granting access.

The same commerce security research said commerce organizations placed more than 90 percent of AI bot activity in a monitoring category. They allowed three-quarters of the remaining activity to pass without restrictions.

Monitoring is understandable during an emerging transition. It lets security teams observe unfamiliar behavior without immediately breaking useful services.

However, monitoring does not resolve the trust decision. It postpones the decision while automated traffic continues interacting with production systems.

Akamai also found that web attacks targeting APIs rose 9 percent year over year. Among commerce respondents, 85 percent reported at least one API-related incident during the previous year.

Only 22 percent knew which APIs exposed sensitive data, according to the company’s cited API study. That visibility problem becomes more serious when agents depend on APIs to act efficiently.

An API is an interface that lets software request data or trigger functions without navigating a human-facing page. It can provide a cleaner path for legitimate agents and attackers alike.

Traditional bot detection often examines IP addresses, user-agent strings, request velocity, browser signals, and navigation behavior. Each signal can contribute useful evidence, but none proves delegated authority.

User-agent strings can be copied. IP addresses can change. Human-like pacing can be generated, while legitimate agents can make rapid requests that resemble abuse.

The human-versus-bot distinction also loses value once businesses actively invite nonhuman customers. The important classification becomes authorized automation versus unauthorized automation.

Even that division is incomplete. An authorized agent may be compromised, operate beyond its mandate, or rely on manipulated information from a product page.

Prompt injection illustrates the problem. A hostile instruction embedded in content can attempt to redirect an agent’s behavior when the agent reads that content.

A retailer might verify the agent’s identity successfully while still receiving an unsafe request. Identity establishes who sent the message, not whether the agent’s reasoning remained trustworthy.

Account takeover creates another difficult case. An attacker may control a real customer account and invoke an approved agent through valid authentication channels.

Static allowlists cannot distinguish that session from ordinary activity. The system needs contextual evidence covering the user, agent, requested action, payment method, and recent account behavior.

False positives carry real costs. A rejected agent transaction can send the shopper to another retailer whose checkout accepts automated purchasing.

False negatives are equally costly. They can produce chargebacks, stolen loyalty points, exposed personal data, or purchases that customers deny authorizing.

Retailers are therefore pressured from both directions. Growth teams want agent traffic accepted, while security teams remain responsible for losses and privacy failures.

A binary allow-or-block tool cannot reconcile those goals. Retailers need policy decisions that vary according to the action, value, identity confidence, and available evidence.

The Real Fight Is Authorized Intent Versus Valid Identity

The primary opponent is not Google against another technology company. It is cryptographic identity against the harder problem of proving user intent.

Visa’s Trusted Agent Protocol shows how the industry is approaching the first half of that problem. It lets approved agents attach digital signatures to their interactions with merchants.

The signature can include a timestamp, session identifier, key identifier, and algorithm information. The merchant can verify that a registered agent produced the request.

Visa also binds the signature to a merchant domain and a particular operation. That design limits the reuse of authorization across unrelated websites or actions.

A nonce, which is a unique value used once, helps prevent captured requests from being replayed later. Time limits provide another control against stale authorization.

These mechanisms improve on trusting an IP address or a self-declared agent name. They give merchants cryptographic evidence that a known agent sent a particular request.

The trusted agent specification also describes signals for distinguishing browsing from payment activity. That distinction lets a retailer apply stricter rules as an interaction approaches checkout.

Cloudflare has connected Visa’s approach and Mastercard Agent Pay to Web Bot Auth. Web Bot Auth uses HTTP message signatures, which attach verifiable identity information to web requests.

Under the described system, agent developers register public keys in directories. Merchants or infrastructure providers retrieve those keys and validate signed requests.

The signature framework can identify a registered agent, connect it with a consumer identity, and communicate whether it intends to browse or purchase.

That is meaningful progress. It creates a machine-readable trust layer where merchants previously saw anonymous automated traffic.

Yet the protocol cannot independently know whether a person understood every downstream action. It also cannot guarantee that the agent interpreted the instruction correctly.

Consider a customer asking an agent to purchase running shoes below a chosen spending limit. The agent may be authorized to research products and prepare a cart.

Several unresolved choices remain. Does the limit include taxes and shipping? Can the agent substitute another brand? May it enroll the buyer in a membership?

The agent identity can remain valid across every step while its behavior crosses the customer’s intended boundary. Trust must therefore attach to a mandate, not merely to software.

A mandate is a verifiable record of what the user authorized, including constraints such as merchant, product category, amount, timing, and confirmation requirements.

Payment credentials solve another limited piece. A valid network token can reduce exposure of card details, but it does not settle a dispute about what the agent was told.

Retailers also need evidence they can preserve. A post-transaction record should show the agent, user authorization, applicable limits, merchant decision, and final purchase details.

Without that chain, disputes become difficult to resolve. The consumer can blame the agent, the agent provider can blame merchant data, and the merchant can point to valid payment credentials.

Security teams should therefore avoid treating signed traffic as automatically safe. A signature should raise confidence in origin while policy engines evaluate the proposed action separately.

This tradeoff also affects smaller retailers. Large platforms can integrate several identity, payment, and fraud systems, while smaller merchants often depend on packaged commerce software.

If standards fragment across payment networks and agent providers, merchants may face multiple directories, signature formats, and liability rules. That complexity creates inconsistent implementation and new security gaps.

Interoperability matters because trust cannot depend on every retailer negotiating separately with every agent operator. The ecosystem needs shared methods for identity and authorization.

Standards Are Arriving Before Their Security Guarantees Are Settled

Agentic commerce security is moving toward interoperable credentials, but the standards process confirms that essential authorization questions remain open.

The FIDO Alliance formed an Agentic Authentication Technical Working Group in April 2026. FIDO is known for authentication standards, including the technology behind passkeys.

Its new work focuses on verifiable user instructions, agent authentication, and trusted delegation for commerce. Those are related controls, but they are not interchangeable.

Verifiable instructions establish what a person approved. Agent authentication establishes which agent is acting. Trusted delegation connects that authority to bounded actions.

The agent standards initiative draws on contributions from Google’s Agent Payments Protocol and Mastercard’s Verifiable Intent. The working groups include representatives from major technology, retail, identity, and payment companies.

That collaborative approach can reduce fragmentation. It also shows that the market has not reached one settled trust model.

Visa states that its Trusted Agent Protocol remains in development and deployment. Its public documentation describes potential features and sequences, which should not be mistaken for universal merchant support.

Adoption requires more than publishing a specification. Agent developers must sign requests correctly, directories must remain available, merchants must validate signatures, and fraud systems must use the resulting evidence.

Key management creates operational risk. If an agent provider’s signing key is stolen, attackers can produce traffic that appears to come from an approved agent.

Directories also become important infrastructure. Merchants need timely information when a key, agent, provider, or authorization relationship has been revoked.

User consent must remain understandable. A technically precise authorization record can still fail consumers if the interface encourages broad permissions they do not comprehend.

Retailers also face incentives to request more identity data than an interaction requires. Connecting agents to emails, phone numbers, loyalty accounts, and payment references can improve checkout while increasing privacy exposure.

The United Kingdom’s Information Commissioner’s Office has already highlighted legal questions around transparency, fairness, accountability, and data protection. Regulators will examine whether people understand how agents use their preferences and personal information.

The most difficult attacks may also bypass the protocol layer. A malicious seller could manipulate product information to influence how agents rank or select items.

A compromised tool could alter a shopping agent’s behavior after authentication. An attacker could use an approved agent account with stolen user credentials.

No request signature can prove that a product claim is accurate. It also cannot confirm that the model selected the best item or avoided a hidden conflict.

This is why agentic commerce security must remain layered. Authentication, authorization, fraud detection, content integrity, payment controls, and dispute evidence each address different failures.

Retailers should also preserve friction for higher-risk actions. Human confirmation can remain appropriate for expensive purchases, unusual delivery addresses, subscriptions, or irreversible orders.

That does not negate agentic commerce. It recognizes that autonomy should expand according to evidence and risk, not according to marketing schedules.

Google News readers should treat every protocol announcement as infrastructure work, not as proof that autonomous checkout has become safe. Standards create common building blocks, while deployments determine their actual reliability.

The security guarantee remains conditional on correct implementation across several organizations. One weak link can undermine a transaction even when every other participant follows the standard.

What Retailers and AI Users Should Watch Next

The next phase will be decided by real checkout adoption, interoperable authorization, and evidence that fraud controls can separate trusted agents from convincing impostors.

The first signal is production deployment. Retailers should disclose when signed agent requests move beyond trials and begin affecting live checkout decisions.

Useful evidence would include the share of agent traffic that carries verifiable identity, the rate of rejected legitimate transactions, and fraud outcomes by transaction type.

Raw traffic growth does not answer those questions. A crawler collecting product information is different from an agent submitting an authorized payment.

Akamai reported that AI-driven traffic has become substantial across commerce infrastructure. Visa separately said AI-driven traffic to United States retail sites rose more than 4,700 percent during the year before October 2025.

Those measurements likely cover different systems and classifications. They should not be treated as a direct count of autonomous purchases.

Production conversion data would strengthen the claim that agents are becoming a new customer channel. High traffic paired with weak checkout completion would weaken it.

The second signal is convergence among standards. FIDO’s work will matter if Google, Visa, Mastercard, Cloudflare, agent providers, and commerce platforms adopt compatible authorization records.

A useful standard must answer several concrete questions. It should identify the agent, connect it to an authenticated user, express limits, support revocation, and preserve auditable evidence.

Compatibility should extend beyond payment. Agents act before checkout when they browse catalogs, retrieve loyalty information, reserve inventory, and negotiate delivery options.

If each stage uses unrelated credentials, retailers will struggle to maintain one coherent risk decision. Attackers can target the transitions between systems.

A shared authorization model would strengthen the industry’s trust architecture. Continued fragmentation would leave larger platforms with private integrations and smaller merchants with uneven protection.

The third signal is liability. Consumers, agent operators, payment networks, and merchants need clear rules for purchases that were authenticated but not genuinely intended.

An agent might buy the wrong size, accept an unwanted subscription, exceed a budget through fees, or send an order to an outdated address.

Fraud rules can address stolen credentials, but not every mistaken or overbroad action qualifies as fraud. Refund policies may also conflict with automated purchasing patterns.

The organization controlling the user interface shapes how consent is requested. The merchant controls fulfillment, while payment networks determine authorization and dispute mechanisms.

Unless responsibility is clear, every participant can claim another party caused the failure. That uncertainty will discourage both consumers and merchants from granting wider autonomy.

Retailers should also watch regulatory guidance on automated decision-making and data minimization. Shopping agents can expose detailed preferences that consumers never intended to share with every seller.

For users, the immediate question is not whether an agent can find a product. It is whether the service shows its mandate before it spends money.

A trustworthy interface should display the purchase limit, permitted merchants, substitution rules, delivery constraints, and circumstances requiring confirmation. It should also make revocation simple.

Users should be able to inspect an activity record after the transaction. That record should separate what they requested from what the agent inferred.

Developers face a related responsibility. They should design permissions around specific actions instead of broad access to accounts, messages, saved cards, and browsing histories.

Knowledge workers evaluating agent systems should ask where authorization ends and model judgment begins. The boundary determines whether an error is blocked, confirmed, logged, or silently executed.

The National Retail Federation and PwC have urged retailers to build governance and security foundations while preparing for agentic commerce. Their retail governance work reflects the need for coordination across security, legal, technology, and business teams.

That coordination is essential because no single department owns the full transaction. Marketing values discovery, commerce teams value conversion, security manages abuse, and legal teams handle consent and liability.

Google News will continue carrying announcements about agents that search, compare, and purchase. The more useful question is whether the trust infrastructure advances at the same pace.

Retailers should demand verifiable identity without confusing identity with harmless intent. They should require bounded authorization without assuming every bound captures consumer understanding.

Consumers should look for agents that reveal their planned actions before checkout and provide a clear record afterward. Convenience deserves scrutiny once software can spend, disclose data, or create obligations.

The industry has already crossed the line from AI-assisted recommendations to machine-initiated commerce. It has not crossed the harder line into universally trustworthy delegation.

Watch the signed requests reaching production, the convergence of authorization standards, and the first liability decisions involving disputed agent purchases. Those signals will show whether Google News is documenting a durable retail channel or an identity crisis moving toward checkout.