Online stores built their anti-bot systems to stop scrapers, fraudsters, scalpers, and abusers. That made sense then. Now AI agents are starting to shop and check out for real customers, and the same defenses can mistake a ready-to-buy customer for malicious automation. The result is a purchase that was about to happen and doesn’t.
The old question was “is this traffic human?” The new one is “did a real person authorize this agent to act for them?” Agentcard offers one answer: the agent can browse and build a cart, but the real payment card is only used after the human approves that specific purchase.
The checkout that says no
Picture a shopper telling their AI assistant, “Find the best deal on these running shoes and buy them.”
The agent searches, compares options, adds the right pair to the cart, fills in shipping details, and reaches payment. Then it hits a wall: a CAPTCHA, a suspicious-traffic warning, a 3D Secure challenge, or a blocked headless-browser session.
The merchant’s system did its job. It spotted automation. But the shopper asked for this purchase, and it failed.
That’s the bot-detection paradox. A defense built to protect commerce is now stopping it.
Why platforms treat automation as a threat
Merchants aren’t being paranoid. Automated traffic costs them real money and creates real risk:
- Scraping prices, inventory, product descriptions, and delivery data
- Scalping limited-release products
- Credential stuffing and account takeover
- Card testing and payment fraud
- Coupon, referral, and loyalty-program abuse
- Inventory hoarding and checkout manipulation
So bot defenses watch for things like unusual browsing speed, datacenter IP addresses, headless-browser fingerprints, odd mouse and keyboard behavior, repeated form submissions, and payment patterns that look like fraud.
The catch is that a well-built shopping agent can trip every one of those signals while doing exactly what its customer asked.
Where agents get caught
Friction doesn’t only show up at payment. An agent’s purchase journey can get stopped at several points along the way.
| Checkout stage | What the agent encounters | Why defenses trigger | Business consequence |
|---|---|---|---|
| Product discovery | Rapid navigation and structured data extraction | Scraping-like behavior | Lost discovery and comparison |
| Cart creation | Fast, repeatable actions | Non-human interaction cadence | Abandoned carts |
| Account login | Automated credential entry | Credential-stuffing controls | Blocked legitimate shopper |
| Checkout | Headless browser, unusual device fingerprint, datacenter IP | Bot scoring and risk rules | Lost high-intent conversion |
| Payment | Card entry and 3DS challenge | Fraud and authorization controls | Stalled or failed order |
| Order confirmation | Automated retrieval of receipt or tracking | Anti-scraping rules | Poor post-purchase experience |
Agentcard’s documentation acknowledges that browser-based agents can be slowed or blocked by bot protection, and that headless Chrome may be treated as a bot depending on the IP address and browser setup.
Intent is invisible to today’s defenses
Most risk systems today look at behavioral and technical signals. They’re good at spotting unusual automation, but they have no way of knowing who authorized an action.
So an agent buying exactly what its owner asked for can look like a scraper, while a human fraudster using a stolen card can look perfectly normal. The systems are measuring the wrong thing.
Three ideas matter here:
- Automation isn’t automatically malicious.
- Authorization is what actually matters.
- Provenance, meaning who started, approved, and benefited from a transaction, needs to become a real commerce signal.
Right now, most checkout stacks have no clean way to say: “This is an agent, but the customer has approved this merchant, this cart, and this amount.”
Why “just solve CAPTCHAs” is the wrong answer
Some agent platforms advertise that they can solve CAPTCHAs, handle one-time passcodes, and push through tricky checkout flows. That fixes a developer’s problem today, but it sets up a long-term fight with merchants.
If agents treat every defense as an obstacle to beat, merchants will answer with tougher controls: more CAPTCHAs, more device checks, more manual review. Everyone loses in that arms race:
- Legitimate agents get blocked more often.
- Merchants deal with more false positives and higher support costs.
- Customers hit friction right when they’re ready to buy.
- Payment disputes get harder because the evidence of authorization is murky.
- The industry ends up optimizing for evasion instead of trust that works across platforms.
The better question isn’t “How does an agent get past this wall?” It’s “How does a merchant recognize an authorized agent and let it transact safely?”
Alternative: authorized agentic checkout
A sturdier approach separates the agent’s ability to browse from the human’s authority to spend.
Agentcard’s documented flow has four moments: submit, approve, pay, confirm. The agent submits a placeholder card at checkout. Agentcard pauses the payment request. The user approves the merchant and amount on their own device. Then the real card completes the payment.
The whole chain looks like this:
User intent → AI agent browses and builds cart → Agent submits placeholder card → Payment request paused → Human approves merchant, amount, and payment → Real card pays → Merchant confirms order
The agent stays in charge of the browsing, and the person who owns the money keeps the payment decision. The agent never sees the real card number, and the approval is tied to a specific merchant and amount.
What a trust layer needs
Telling good agents from bad bots takes more than smarter browser automation. Agentic commerce needs a shared trust layer, and it would need five things:
- Agent identity. Merchants should be able to recognize a declared, accountable agent or agent platform.
- Explicit user authorization. The customer approves the merchant, cart, amount, currency, and payment method.
- Payment isolation. The agent never holds or sees full card credentials.
- Transaction evidence. Merchants, processors, and users all have a timestamped record of what was approved.
- Merchant verification. The order gets confirmed through the merchant’s trusted confirmation page or a supported integration.
Agentcard’s approach covers much of this: a trusted-agent signature, timestamped approval logs, merchant and amount caps the user controls, and confirmation of the merchant’s order result after approval.
What merchants should rethink
Stores don’t have to give up bot defenses. They just need to make them more precise.
- Separate browsing risk from payment authorization. A bot-like browsing pattern shouldn’t automatically mean the payment is unauthorized.
- Build an agent-aware checkout path for declared agents, instead of pushing every automated session through the same fraud funnel.
- Require explicit human approval for agent-initiated purchases, especially above certain values.
- Publish agent-commerce policies that say which agents are welcome, what data they can access, and how purchases get authorized.
- Measure agent conversion separately from scraper traffic, so product and risk teams stop lumping all automation together.
- Design for provenance. Merchant, cart contents, amount, currency, approval time, and payment outcome should all be auditable.
The goal isn’t to make the web easier for every bot. It’s to make it safer and smoother for authorized agents acting for real customers.
What agent builders should stop doing
Agent builders share some of the blame, and some of the fix.
- Stop treating CAPTCHA-solving as the product.
- Stop using customer card data as a default input.
- Stop resubmitting checkout forms over and over after failures.
- Stop hiding agent behavior from merchants.
- Start building consent, approval, audit trails, and merchant verification into the purchase flow.
Agentcard’s guidance is to verify the merchant, items, amount, and currency from trusted merchant data, collect any required customer details from the end user, and submit the merchant form once rather than retrying.
The strategic stakes
This isn’t a niche UX annoyance. It will help decide who captures the next wave of digital demand.
- Conversion: AI agents could become a major way people discover and buy products.
- Fraud: How authorization is designed will matter as much as device fingerprinting.
- Brand trust: A blocked legitimate buyer may blame the merchant, not the agent.
- Payments: Merchants, processors, and agent platforms will need shared signals for agent-initiated transactions.
- Market structure: Merchants that support trusted agent checkout may win sales their competitors lose to friction.
From bot walls to trust rails
The next edge in e-commerce won’t go to whoever blocks the most bots. It’ll go to whoever can tell a malicious machine from an authorized agent working for a real customer, and make the second one easy to do business with.
AI agents will shop online. The real question is whether your checkout will recognize them when they show up.