Dollar Exfiltration Season: Is Your Business Ready for the First Agentic Holiday?

Earlier in my career, I worked in scaled online retail, where every day of peak holiday performance could mean the difference between meeting the year’s targets or missing them. From November through December, we watched the numbers with nail-biting dread. The biggest wildcard back then was Google. A ranking change or an algorithm update could swing a week's results, and at that scale, a bad day was a very expensive day. We built our forecasts as carefully as we could and still knew one search engine's whims could rewrite them overnight.

The 2026 holiday season brings far more whims than Google's. This is the first year AI agents will shop at scale. Consumers are handing gift research, price comparison, and now the purchase itself to personal and third-party agents. By some industry estimates, agents already generate somewhere between 10% and 40% of a brand's web traffic.

The payment rails are ready. x402, the Machine Payments Protocol (MPP), and AP2 now let agents pay for goods, APIs, and MCP tools, including "Human Not Present" purchases that complete while nobody is watching.

The protocols answer two questions well: does this agent have authority, and how does the money move? They don't answer the question that matters most on Black Friday: does this payment make sense for what the agent was asked to do right now?

That gap is where dollar exfiltration happens.

Dollar exfiltration, holiday edition

Dollar exfiltration is the unauthorized diversion of money through an otherwise valid agent payment. The attacker doesn't steal a wallet key. They manipulate the agent's instructions or tool path so the agent signs and submits the payment itself. The same damage can happen with no attacker at all, when an agent loops on a paid service or buys things its task never required.

The holidays make it worse. Transaction volume spikes, deals change by the hour, and inventory looks different every year as tariffs and shipping challenges shift what retailers can stock and at what cost. Holiday demand is also notoriously hard to forecast, even for retailers with years of historical data. World events, economic swings, inflation, and shifting interest in gift categories all move the numbers.

Now add the shift from traditional search to agents, which is accelerating. Every shopping assistant, third-party agent, and agent platform makes its own decisions about what to surface, where to send traffic, and what to buy. Last year's traffic model can't tell you how many of this year's customers will arrive through an agent, how those agents will behave, or what they'll purchase. Every forecast is an educated guess until the hard numbers come in after the weekend. By then, it's too late to redo Black Friday.

There are two ways to get this wrong: let too much through, or block too much. Here are three stories we hope never happen. They are illustrative scenarios (ie cautionary tales for you to avoid!), but each one reflects how agents and agent defenses behave today.

🛒 Horror Story #1 [After all, Halloween is already the start of the holiday shopping season, right?]: The Doorbuster Drain

A large electronics retailer entered 2026 with a board-level AI mandate: capture agentic commerce early, with a hard revenue target attached. Leadership opened the storefront to shopping agents, integrated the new payment protocols, and made agent-driven sales a headline number for the holiday quarter.

At 12:01 a.m. on Black Friday, the limited-quantity doorbuster TV goes live. Within 63 seconds, it's gone, and so is the stock on two other promoted items. For a few minutes, the agent revenue dashboard looks like the mandate is working.

Then the postmortem starts.

It shows hundreds of agent sessions, each claiming to act for a distinct human shopper. Many of them weren't. A resale operation ran a fleet of agents that presented plausible delegation, reserved inventory, and completed purchases destined for secondary marketplaces at triple the price. Others held items in carts and abandoned them, starving real customers during the peak hour.

The retailer's actual customers, some of whom used legitimate agents like Muse and Dots, but many of whom were real live customers not using agents themselves, got "sold out" pages. Customer service took a beating, and the brand ran headlines about scalpers instead of deals. The board's agentic revenue number was real, but much of it came from resellers who had just taken the retailer's best promotions away from its own customers.

The retailer had opened the door without answering the three questions every merchant now faces:

• Is there a real human behind this agent?
• Does that human actually intend to buy?
• Does the agent have the permissions it claims?

What would have stopped it: treating each agent as an identity with defined boundaries, tracking its behavior across the session, and stopping it at runtime when its activity no longer matched a genuine shopper's intent.

💸 Horror Story #2: The Cyber Monday Meter That Never Stopped

A retailer's merchandising team deployed a pricing agent to keep promotions competitive through Cyber Monday. It pays per call, about $0.40 each, for real-time competitor pricing through an x402-enabled data service.

Sunday night, a competitor's site changes its page format. The data service starts returning partial results. The agent reads every partial result as "data incomplete, retry." Each retry is a valid, individually tiny payment well within the per-transaction limit.

By morning, the agent has made tens of thousands of paid calls. That's a five-figure bill for data it never used. Worse, a batch of malformed results convinced it that competitors had cut prices, so it marked down a dozen high-margin products during the biggest traffic hour of the year.

No attacker was involved. The agent did exactly what it was built to do, without limits that understood its task.

What would have stopped it: spend budgets scoped by agent and time window, enforced atomically so parallel agent instances couldn't each burn through the same allowance, plus loop detection that recognized the same paid call repeating with no progress. And the payment bill wasn't the only one climbing. Every retry also sent the malformed results back through the agent's model, so the token bill grew alongside the data bill. A per-agent token limit would have throttled that one agent overnight while the rest of the merchandising stack kept running.

🚫 Horror Story #3: The Checkout That Locked Out Its Own Customers

A national home goods retailer watched the scalper headlines and decided it wouldn't be next. Two weeks before Black Friday, the security team tightened its bot defenses: aggressive challenge pages, strict behavioral scoring, and automatic blocks on anything that looked automated.

On Black Friday morning, the dashboards looked great. Bot traffic was down sharply, but by Saturday it was clear that real live customer traffic was down… and bounce rates were up. And so were abandoned shopping carts… Revenue was the worst in 5 years.

In a Sunday emergency revenue war room, the team deconstructed its site analytics, scouring every option from latency on their CDN to failures in their payment processor, until they found the real reason, and it wasn’t pretty:

Real human shoppers on mobile networks, behind corporate VPNs, using privacy browsers, or simply checking out fast because they'd pre-loaded their carts had been scored as bots. They hit endless verification loops at the payment step, crashing the cart. Some solved three challenges and still got bounced. Legitimate agents carrying real shoppers' authorization were blocked outright, because the rules couldn't tell an authorized agent from a malicious one.

By Monday, the retailer knew it had missed not only its holiday forecast, but its quarterly and annual, because they couldn’t get back their lost peak weekend. There was no second chance. Black Friday weekend happens once, and the revenue that walked out the door wasn't coming back in January.

The security controls did their job by the numbers. They just measured the wrong thing. Blocking automation was never the goal. Blocking automation that didn't serve a real customer's intent was. Blocking real customers was never part of the vision.

What would have stopped it: decisions based on intent instead of blunt traffic signals. Let the shopper and the authorized agent through. Stop the payment that falls outside what a real customer asked for.

The holiday lesson: trust needs a safety net, not a wall

Early online shopping didn't win consumer trust on its own. It won trust because the industry built safety nets: fraud protection, chargebacks, and clear remediation when things went wrong.

Agentic commerce needs the same thing, built now and built for machines. Shoppers don't fully trust agents yet, and neither do merchants, but both are moving fast. The three stories above show the trap: open the door too wide and you get drained, close it too tight and you lock out your own revenue. Coarse controls force you to pick one failure.

Getting out of that trap takes two things the protocols don't provide:

Agents as accountable identities. Every agent touching your commerce flow should be recognizable, bounded, tracked, and stoppable at runtime. Eventually, merchants will want to build loyalty with agents too, linking agent and human purchase behavior. None of that works without accountability first.

Transaction-level judgment. Every payment attempt should be evaluated against the task, the destination, the amount, and your commercial policy, before it's submitted.

How Operant helps you keep the purse strings

Holiday agents cost money two ways: the payments they make, and the tokens they burn deciding what to pay for. Operant meters and controls both, in real time.

Agentic Commerce Defense: Trust and controls for agents

Operant Agent Protector's Agentic Commerce Defense evaluates every agent payment attempt across x402, MPP, and AP2 before it's forwarded:

• Task-aware payment gating checks the paid action against the task the agent was given. Agents doing the job keep moving; agents that drift get stopped.
• Commercial scope restricts which MCP servers, payment networks, assets, and wallet destinations an agent can use. Unapproved and untrusted destinations are blocked even when the credentials are valid.
• Purse strings apply atomic spending limits by agent, service, MCP server, user, team, network, and asset, over hourly, daily, weekly, or monthly windows. Concurrent agents can't double-spend the same remaining budget.
• Intent checks from Operant's Semantic Firewall flag prompt injection, task drift, and runaway loops, even when the payment is authorized and under budget.
• Audit without custody records requests, decisions, and outcomes without holding keys or signing transactions. Your wallet stays your wallet.

Token Meter: control what agents spend to think

The model bill is the cost most retailers won't see until January. Pricing, merchandising, customer service, and inventory agents all run harder during peak season, and the most common cause of runaway cost is simple: an agent doing far more work than its task requires, at machine speed. Retry loops against transient errors, maximum context on every call, and fallbacks to the most expensive model for simple requests all multiply under holiday traffic.

Provider reports won't help at the moment. They arrive after the fact, often don't cover hosted deployments, and can't enforce a limit.

• See usage as it happens. Near real-time token metrics per agent session, broken out by user, team, agent, and model.
• Enforce budgets at runtime. Token limits by user, team, agent, and model, plus organization-wide caps, enforced even mid-session. Only the segment over the line gets throttled.
• Cover every deployment. All models, including hosted deployments on AWS Bedrock, Google Vertex, and Azure Foundry, under one policy from endpoint to cloud.

When the customer service agent falls back to the largest model for every "where's my order?" question on Cyber Monday, you cap that agent on that model. The rest of your AI keeps working.

Together, the result is agents that pay and think freely within their task and get stopped the moment they stray outside it, without blanket gates that break the experience for the customers you're trying to serve.

Your holiday readiness checklist

Before the first agent hits your checkout this season, ask:

1. Can we tell a legitimate agent shopper from a scalper fleet?
2. Are our bot controls blocking real customers and authorized agents? Have we tested checkout under peak conditions?
3. Do we know which destinations our own agents are allowed to pay?
4. Are our agent budgets enforced per agent and per time window, or just per transaction?
5. Would we catch an agent retrying the same paid call ten thousand times?
6. Do we know what our agents' model usage will cost during peak traffic, and can we cap one runaway agent without shutting down the rest?
7. If an agent gets injected, can we stop the payment before it's submitted, not after the chargeback?

If any answer is "no" or "we're not sure," you have a few weeks to fix it. I remember what it felt like to watch a holiday weekend slip away in real time. This year, you can have the controls in place before it starts.

Your agents get a wallet. You keep the purse strings.

Book a demo to see Agentic Commerce Defense and Token Meter in action before the holiday rush.