The Season of Agentic Commerce is Here, Are You Ready?

Earlier in my career, I worked at a major online retailer with billions of keywords that were optimized about as close to real-time as you could get in the 2010s (take that, AI, deterministic rulesets can still work!). Yet, we were still at the mercy of Google's delayed reporting and its whims in serving our traffic, so we didn't get a full picture until the following day, when any minor change - a new competitor entering higher bids, a subtle change to search algorithms, an infusion of irrelevant image searches - could mean huge shifts in revenue and cost. Overspend on the wrong things, you've destroyed your ROI targets. Underspend on the wrong things, turn away real customers, or, god-forbid, have an issue with your shopping cart, and your annual revenue targets are shot.

Yum, yum, turkey and football with a nice sauvignon blanc with Grandma? Forget it. Thanksgiving was just a lead-in to the biggest retail weekend of the year. Every day from Black Friday to Cyber Monday was a make-or-break nail-biter, and that was when the sources of customers and how to identify them were relatively stable. I know you retailers are nodding your heads at this - alas, it is still so true for so many, and now I have some good and bad news rolled up into one:

Welcome to 2026, the year of agentic commerce. 

I hate to break it to you, but the game has just changed when the table stakes have never been higher. You need to be ready, and here's what we can offer to help, not just to security teams, but to the revenue teams that are depending on an effective effort to protect and grow sales while minimizing the impact of malicious agents, dollar exfiltration, and unexpected token run-ups, all of which are already bigger problems than you realize.

We have made a handy-dandy “holiday gift guide” for retail teams and their security leaders to help navigate this agentic commerce season before they lose revenue - our gift to you: peace of mind through secure agentic commerce! Download the full guide here.

The biggest shift in retail traffic since search

For two decades, online retail ran on a familiar pattern: shoppers searched, clicked, browsed, and bought. Retailers built their forecasts, their marketing, and their security around that pattern.

This year, that pattern is breaking. Real shoppers are handing gift research, price comparison, and now the purchase itself to AI agents. Meta launched its Muse agent on September 8. Amazon blocked it on September 20. OpenAI launched Dots on September 29. Salesforce forecasts that 20% of holiday e-commerce traffic this year will come from AI agents. And new payment rails, including x402, the Machine Payments Protocol (MPP), and AP2, let those agents pay with no human at the checkout at all.

This isn't bot traffic in the old sense. Behind many of these agents is a real customer with a real budget and a clear intent to buy. A shopper can tell an agent to watch every retailer for a TV and buy it the moment the price drops, then go to sleep. That agent is a customer.

At the same time, two other shifts are landing. Bad actors are arriving alongside the good agents: scalper fleets, scrapers, and rogue agents that look almost exactly like legitimate shoppers. And retailers are putting their own agents to work in pricing, merchandising, customer service, and inventory, often before teams have the visibility and controls to know what those agents are doing or spending.

Nobody has run a holiday like this before. Every retailer is working through it at the same time, and that's not a failing of anyone. It's a paradigm shift. But it does mean last year's traffic model, and last year's security rules, can't tell you what's coming. And if you only find out after the weekend, it's too late to act.

The good news: Black Friday is November 27. There's still time to get ahead of it, if you act now.

Real customers, legit agents, and malicious bots, all swept up in your checkout flow

To summarize the challenge for retailers used to managing customer flows, you now have three groups to contend with, and a blunt instrument won't cut it:

Real customers, shopping through agents. Shoppers are sending Meta's Muse and OpenAI's Dots to research, compare, and buy for them. Every one of those agents carries a real buyer with a real budget.

Real people who look like bots. Shoppers on VPNs, mobile networks, and privacy browsers, or checking out fast with pre-loaded carts. Normal people doing normal things, flagged as automated.

Bad agents. Scalper fleets, scrapers, and rogue or manipulated agents that drain inventory, loop on paid services, and send valid payments to the wrong place. They are coming, and they have to be stopped.

Block the first two, and you lose real revenue. Miss the third, and you get drained. Get it wrong either way, and you won't know until the weekend is over.

Recognizing an agent is step one. Trusting what it does next is step two.

The industry is moving fast on the first part of this problem. Payment rails like x402, MPP, and AP2 answer whether an agent has authority to pay and how the money moves. Identity platforms and signed-agent standards, like UCP, Web Bot Auth, Visa's Trusted Agent Protocol, and Mastercard Agent Pay, are making it possible to recognize which agent is calling, link it to a real customer account, and grant it scoped permissions. That's essential work, and every retailer should be adopting it.

But recognition answers who the agent is. It doesn't answer the question that matters most at 12:01 a.m. on Black Friday: does this action make sense for what the agent was asked to do, right now?

That gap is where dollar exfiltration happens, and it’s why agentic commerce needs both layers: identity at the front door, and runtime judgment for everything that happens after it opens.

Two ways to lose money this holiday

There are two ways to get this wrong: let too much through, or block too much. Both cost money. Only one of them shows up as a security incident.

Too open, and you get drained. 

Scalper fleets claim to represent real shoppers, reserve limited inventory, and route it to resale marketplaces. Pricing and data agents loop on paid services. Injected agents, even recognized and authorized ones, send valid payments to the wrong destination.

Too closed, and you turn away real customers, in two ways.

The first is blocking customers who shop through agents. A shopper who sends Muse or Dots or who uses an agentic browser like Perplexity’s Comet to buy a gift is a real buyer. But many agents this season won't yet carry a signature or a linked account, and to a legacy bot defense, they look like any other bot. A price drop that sets off thousands of customers' agents at once looks like an attack. Block them, and you've lost real revenue

The second is blocking real people who only look like bots. Shoppers behind corporate VPNs, on crowded mobile networks, using privacy browsers, or checking out fast because they pre-loaded their carts can all score as automated. They aren't agents at all, so no agent identity standard will vouch for them. They hit verification loops at checkout, solve challenge after challenge, and eventually give up. 

(I feel this one deeply, having been bounced from multiple checkouts in the last month using my standard corporate VPN, a thing that has never happened before, so I assume some eager retailers have already implemented some blunt instruments that are over-bouncing humans like me.)

As more of the season's buying moves through agents, the share of revenue at risk from over-blocking keeps growing. Bounce every visitor with a hint of suspicion, and you could turn away a share of holiday revenue large enough to decide whether you hit the year - Salesforce recently projected 20% of holiday retail traffic will come from agents - a staggering amount when applied to projected revenue targets for retailers who depend on this season. 

And remember, unlike a breach, that loss doesn't trigger an alert. The sales just quietly won't happen, and you’ll find out only when the numbers come in, after the weekend is already over.

Three stories we hope won’t happen to you

These are cautionary tales, but each one reflects how agents and agent defenses behave today. Halloween is already the start of the holiday shopping season, so let’s talk about some really scary scenarios:

🛒 Horror Story #1: The Doorbuster Drain

A large electronics retailer entered 2026 with a board-level AI mandate: capture agentic commerce early, with a hard revenue target attached. Leadership opened the storefront to shopping agents, integrated the new payment protocols, and made agent-driven sales a headline number for the holiday quarter.

At 12:01 a.m. on Black Friday, the limited-quantity doorbuster TV goes live. Within 63 seconds, it's gone, along with the stock on two other promoted items. For a few minutes, the agent revenue dashboard looks like the mandate is working.

Then the postmortem starts. It shows hundreds of agent sessions, each claiming to act for a distinct human shopper, and each presenting plausible delegation. Many of them weren't real shoppers. A resale operation ran a fleet of agents that reserved inventory and completed purchases destined for secondary marketplaces at triple the price. Others held items in carts and abandoned them, starving real customers during the peak hour.

The retailer's actual customers, some shopping through legitimate agents like Muse and Dots and many shopping on their own, got "sold out" pages. The board's agentic revenue number was real, but much of it came from resellers who had just taken the retailer's best promotions away from its own customers.

What would have stopped it: every session looked valid at the door, so the answer was in the behavior. Tracking what each agent did across the session, recognizing hundreds of "shoppers" acting as one coordinated fleet, and stopping that activity at runtime once it no longer matched a genuine shopper's intent.

💸 Horror Story #2: The Meter That Never Stopped

A retailer's merchandising team deployed a pricing agent to keep promotions competitive through Cyber Monday. It pays about $0.40 per call for real-time competitor pricing through an x402-enabled data service.

Sunday night, a competitor's site changes its page format. The data service starts returning partial results. The agent reads every partial result as "data incomplete, retry." Each retry is a valid, individually tiny payment, well within the per-transaction limit.

By morning, the agent has made tens of thousands of paid calls: a five-figure bill for data it never used. Worse, a batch of malformed results convinced it that competitors had cut prices, so it marked down a dozen high-margin products during the biggest traffic hour of the year. And every retry sent the malformed results back through the agent's model, so the token bill climbed right alongside the data bill.

No attacker was involved. The agent was the retailer's own, fully authorized, and it did exactly what it was built to do, without limits that understood its task.

What would have stopped it: spend budgets scoped by agent and time window, enforced atomically so parallel agent instances couldn't each burn through the same allowance; loop detection that recognized the same paid call repeating with no progress; and a per-agent token limit that throttled that one agent overnight while the rest of the merchandising stack kept running.

🚫 Horror Story #3: The Checkout That Locked Out Its Own Customers

A national home goods retailer watched the scalper headlines and decided it wouldn't be next. Two weeks before Black Friday, the security team tightened its bot defenses: aggressive challenge pages, strict behavioral scoring, and automatic blocks on anything that looked automated.

On Black Friday morning, the security dashboards looked great. Bot traffic was down sharply. But by Saturday it was clear that customer traffic was down too, bounce rates were up, and so were abandoned carts.

In a Sunday war room, the team worked through every possible cause, from CDN latency to payment processor failures, until they found the real one. Two groups of real customers had been turned away. Shoppers on mobile networks, behind corporate VPNs, using privacy browsers, or checking out fast with pre-loaded carts had been scored as bots and looped through verification until they gave up. And customers who had sent agents like Muse and Dots to buy on their behalf were blocked outright, because the rules couldn't tell an authorized agent from a malicious one. Those customers didn't stop shopping. They bought somewhere else.

By Monday, the retailer knew it had missed its holiday forecast, and likely its quarter and its year. Black Friday weekend happens once, and the revenue that walked out the door wasn't coming back in January.

The security controls did their job by the numbers. They just measured the wrong thing. Blocking automation was never the goal. Blocking automation that didn't serve a real customer was.

What would have stopped it: decisions based on intent instead of blunt traffic signals can be stood up, paired with the work happening in the ecosystem through identity providers and protocols signalling when there are real shoppers and letting authorized agents through. Stop only the payment that falls outside what a real customer asked for.

The way through: a safety net, not a wall

Early online shopping didn't win consumer trust on its own. It won trust because the industry built safety nets: fraud protection, chargebacks, and clear remediation when things went wrong.

Agentic commerce needs the same thing, built now and built for machines. Shoppers don't fully trust agents yet, and neither do merchants, but both are moving fast. The three stories above show the trap: open the door too wide and you get drained; close it too tight and you lock out your own revenue. Coarse controls force you to pick one failure.

Getting through this season takes three steps, working together:

Recognize. Is the agent real, and who does it act for? Your identity layer, signed-agent standards, and account linking answer this at the door.

Bound. What may this agent touch? Scope each agent session to the tools, data, destinations, amounts, and frequency its task requires.

Judge. Should this specific action happen, right now? Evaluate every purchase, payment, refund, and data request against the agent's task and your commercial policy, before it executes, even when the agent is recognized and the payment is authorized.

Recognition is quickly becoming standard. Bounding and judging every action at runtime is where Operant comes in.

How Operant helps you keep the revenue without the mess

Holiday agents cost money two ways: the payments they make, and the tokens they burn deciding what to pay for. Operant meters and controls both, so problems are caught while there's still time to act on them. And it works alongside the identity and payment infrastructure you're already adopting, picking up where recognition leaves off.

Agentic Commerce Defense: trust and controls for agents

Operant Agent Protector's Agentic Commerce Defense evaluates every agent payment attempt across x402, MPP, and AP2 before it's forwarded:

• Intent over blunt signals lets real shoppers and the agents carry their requests through, and stops only the actions that don't match a real customer's intent.
• Task-aware payment gating checks each paid action against the task the agent was given. Agents doing the job keep moving; agents that drift get stopped.
• Commercial scope restricts which MCP servers, payment networks, assets, and wallet destinations an agent can use. Unapproved destinations are blocked even when the credentials are valid.
• Purse strings apply atomic spending limits by agent, service, MCP server, user, team, network, and asset, over hourly, daily, weekly, or monthly windows. Concurrent agents can't double-spend the same remaining budget.
• Intent checks from Operant's Semantic Firewall flag prompt injection, task drift, and runaway loops, even when an agent is recognized, its payment is authorized, and it's under budget.
• Audit without custody records requests, decisions, and outcomes without holding keys or signing transactions. Your wallet stays your wallet.

Token Meter: control what agents spend to think

The model bill is the cost most retailers won't see until January. Pricing, merchandising, customer service, and inventory agents all run harder during peak season, and the most common cause of runaway cost is an agent doing far more work than its task requires: retry loops, maximum context on every call, and fallbacks to the most expensive model for simple requests. Provider reports arrive after the fact and can't enforce a limit.

• See usage per agent session, by user, team, agent, and model.
• Enforce budgets at runtime, with token limits by user, team, agent, and model, plus organization-wide caps, enforced even mid-session. Only the segment over the line gets throttled.
• Cover every deployment, including self-managed and hosted models on AWS Bedrock, Google Vertex, and Azure Foundry.

When your customer service agent falls back to the largest model for every "where's my order?" question on Cyber Monday, you cap that agent on that model. The rest of your AI keeps working.

Your holiday readiness checklist

Before the first agent hits your checkout this season, ask:

1. Can we recognize which agents are calling and who they act for, and what happens to the agents that don't yet carry a signature or linked account?
2. Can we tell a legitimate agent shopper from a scalper fleet, even when every session presents valid delegation?
3. Are we blocking customers who shop through agents like Muse and Dots, and losing those sales to competitors?
4. Are our bot controls turning away real people on VPNs, mobile networks, and privacy browsers? Have we tested checkout under peak conditions?
5. Do we know which destinations our own agents are allowed to pay?
6. Are our agent budgets enforced per agent and per time window, or just per transaction?
7. Would we catch an agent retrying the same paid call ten thousand times?
8. Do we know what our agents' model usage will cost at peak, and can we cap one runaway agent without shutting down the rest?
9. If a recognized, authorized agent gets injected, can we stop the payment before it's submitted, not after the chargeback?

If any answer is "no" or "we're not sure," you still have time, but not much. Black Friday is November 27, and new controls need to be in place and tested before peak traffic arrives.

I remember what it felt like to find out the morning after that a holiday weekend had slipped away. This year, more of your customers than ever will arrive through agents, and the cost of finding out too late is higher than ever. Put the right controls in place now, and you won't have to choose between protecting your business and welcoming the customers who are shopping in a new way.

Learn more about securing the agentic commerce ecosystem while keeping your revenue safe this holiday season

Book a demo to see Agentic Commerce Defense and Token Meter in action before the holiday rush.

Download our PDF guide to secure agentic commerce this holiday.