Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Shopping bots are no longer just visitors to product pages: AI agents can browse for a person and may continue into account access, authentication and checkout. That activity can resemble abuse, but automation alone does not reveal intent. Retail security teams need to assess what an agent is trying to do, whose authority it represents and what risk the action creates—then protect sensitive flows without automatically blocking useful customer activity.
What is a shopping bot?
Here, a shopping bot means an AI shopping agent or agentic browser that searches or browses products for a person and may proceed to sign-in, account activity or checkout. It is different from a training crawler, which collects web content, and a scraper, which extracts data. HUMAN Security treats those as separate categories in its 2026 State of AI Traffic & Cyberthreat Benchmark Report.
The term covers a range of behavior, not a single technical identity or level of permission. An agent might only compare products, or it might interact with a retailer’s APIs and a customer’s account. The security question is therefore not simply “bot or not?” but also “trust or not?”: what is acting, for whom, and with what authorization?
Why are shopping agents a security issue now?
Agents can traverse the same product pages, APIs, identity checks and payment steps as human shoppers. Those surfaces also attract scraping, credential abuse, fake-account creation, account compromise and payment fraud. A fast sequence of page requests or programmatic checkout may be legitimate when initiated by a customer, but harmful when driven by an attacker or used beyond the customer’s authorization.
#1 Best Overall
Several 2026 reports describe rising activity, but their figures measure different populations and should not be combined into a single estimate of bot activity across retail:
| Publisher and measure | Reported finding | What the figure represents |
|---|---|---|
| HUMAN Security, March 2026 | AI-driven traffic observed by HUMAN increased 187% from January through December 2025. During 2025, 77% of HUMAN-observed agentic activity was on product and search pages, 8.8% on account pages, 5% on authentication flows and 2.3% on checkout pages. Retail and e-commerce accounted for 46.6% of observed agentic traffic. | Aggregated, anonymized interactions observed across HUMAN’s customer base from 2022–2025; HUMAN says the data does not represent all internet traffic. |
| Akamai, July 2026 | Commerce represented 47.9% of AI bot traffic observed across Akamai’s global network from July through December 2025. | Akamai network telemetry, not an independently measured global census. |
| Akamai, 2026 API Security Impact Study and July 2026 announcement | Akamai reported a 9% year-over-year rise in web attacks targeting APIs. It also said 85% of commerce respondents in the study experienced at least one API-related incident in the prior year, while 22% knew which APIs exposed sensitive data. | Akamai’s reported attack measure and study respondents; these are not universal rates for all retailers. |
| DataDome, September 2026 | DataDome reported that malicious automated traffic increased 124% from July 2025 through June 2026. In H1 2026, AI agents generated 605.6 million requests to login pages, forms, carts, payment flows and account-creation pages; login pages made up 51.7% of that activity. Scraping represented 70.9% of bad bot traffic across its customer base during the study period. | DataDome’s customer-base analysis and definitions of malicious automated traffic, AI-agent requests and bad bots. |
| DataDome, September 2026 website scan | 65.3% of websites in DataDome’s expanded scan stopped none of the ten bot types it evaluated. | A result from DataDome’s test of the websites in its scan, not a measure of every website’s defenses. |
| Visa, November 2025 | Visa said it saw a 25% increase in malicious bot-initiated transactions over the prior six months, with a 40% increase in the United States. | Visa’s company-reported measure and time window. |
These reports are evidence that security teams should account for automated activity in commerce, not proof that every retailer sees the same volume or threat mix. HUMAN also found agentic activity concentrated in retail and e-commerce, streaming and media, and travel and hospitality; its platform data is not a census of internet use.
What can go wrong when an agent shops?
Account, identity and payment abuse
An agent entering a login or account flow can intersect with credential abuse, account compromise, fake-account creation and synthetic identity fraud. Akamai also identifies agent hijacking and misuse of stored payment credentials among commerce threats. The relevant signal is not just the presence of automation, but whether the agent’s actions fit the user’s authority and the transaction’s risk.
API exposure and attacks
Retail APIs can expose sensitive data or enable actions without the same visible cues as a browser journey. Akamai recommends continuous API discovery because an organization cannot govern an endpoint it does not know exists. Its findings also point to the need to connect API protection with broader commerce risk rather than treating APIs as an isolated technical inventory.
Fraudulent storefronts and misleading signals
Visa describes a scenario in which a fake storefront appears legitimate and advertises unusually low prices, then exploits an agent’s stored credentials after a purchase. Visa also warns that synthetic content can weaken legacy fraud indicators. This is a risk scenario, not evidence that every low-priced seller or agent-led purchase is fraudulent; it does show why storefront legitimacy and payment authorization matter alongside the agent’s browsing behavior.
Availability attacks and customer friction
Akamai includes Layer 7 distributed denial-of-service activity among commerce threats. At the same time, blocking all automation can disrupt agents acting for real customers. A control that uses request volume as its only signal may therefore miss harmful traffic that imitates people while rejecting useful traffic that behaves programmatically.
Rank #3
What should retail security teams do?
The practical aim is to distinguish beneficial automation from harmful activity while preserving strong controls over accounts, APIs and transactions. Akamai’s recommendations and the National Retail Federation’s Center for Digital Risk & Innovation guidance support four operational priorities. The NRF guidance, published March 19, 2026, grew out of late-2025 workshops with US retail cybersecurity, technology, legal and business leaders; it is industry guidance, not a formal standard or representative survey.
1. Map APIs and sensitive-data exposure
Maintain an inventory of APIs, including those that may be poorly documented, and identify which expose sensitive data or support high-impact actions. Use that map to prioritize monitoring and protection for endpoints involved in identity, account changes, inventory, carts and payments. Akamai recommends continuous API discovery; its findings about respondents’ limited awareness of sensitive-data exposure underscore why discovery and ownership need to be ongoing.
2. Evaluate intent and business value, not automation alone
Build decisions around the action, context and authorization behind a session. Consider whether the agent can be identified, whether it is linked to a represented user, what it is attempting, and whether the requested action is appropriate for that user and transaction. Apply proportionate friction or controls to risky actions instead of making a blanket allow-or-block decision based only on a bot label.
3. Coordinate security and fraud operations
Security teams see technical signals across sessions, APIs and infrastructure; fraud teams see transaction patterns and losses. Akamai recommends cooperation between cybersecurity and fraud teams so that an agent’s behavior can be assessed in context and the response can account for both account compromise and payment abuse. Define how incidents, indicators and escalations move between those teams.
4. Strengthen identity and risk controls on high-value flows
Apply risk-based authentication and other controls where account access, sensitive data or payment credentials are at stake. Akamai recommends microsegmentation as part of its commerce security guidance. In practice, teams should limit how far a compromised or misused session can reach, and avoid treating an agent’s ability to reach checkout as proof that the underlying action is trustworthy.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallHow should teams compare agent-security solutions?
The cited sources describe evaluation needs, but they do not provide a neutral comparative product test. Teams can use the following capabilities as procurement and architecture questions rather than assuming any one product has independently verified effectiveness:
Best Value
- Agent identity: Can the system establish what agent is acting and connect it to a represented user or authorization?
- Intent and session visibility: Can analysts see what the session is attempting, rather than only its request rate or automation classification?
- Journey coverage: Does protection span APIs, product browsing, accounts, authentication and checkout?
- Abuse reduction: Can controls address account abuse and payment misuse while preserving legitimate agent activity?
- Response integration: Can findings feed the retailer’s existing security and fraud processes?
Visa and Akamai announced in December 2025 that they would integrate Visa’s Trusted Agent Protocol with Akamai’s edge behavioral intelligence and bot protection. Their announcement describes the collaboration’s intended capabilities; it does not establish universal merchant deployment or independently prove effectiveness.
What does the rise of shopping bots mean for security teams?
Automation is becoming a less reliable proxy for malicious intent. The core task is to assess identity, authorization and purpose across a customer journey, then apply controls according to the risk of the action. That requires API visibility, coordinated security and fraud decisions, and safeguards that can separate a customer-authorized agent from abuse—without assuming that every agent is safe or every bot is hostile.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
