AI shopping agents keep buying from fake stores without stopping to check, and Black Friday is about to test every one of them
Security researchers got an agentic AI shopping browser to buy from a fake store, open a phishing email, and clear a fake CAPTCHA without ever asking for confirmation, and a separate industry survey already puts close to three in four shoppers worldwide using AI somewhere in their online purchase, which means merchants are heading into Black Friday weekend, a stretch when disputes already shift toward non-delivery claims, without the human hesitation their fraud rules were built to read.
Security researchers ran a scripted test against an agentic AI browser built to shop on a person's behalf: a fake storefront, a phishing email, and a page gated behind a fake CAPTCHA. The agent completed a purchase using payment details saved in its own autofill, without pausing to ask the person it was shopping for whether to go ahead [1]. It was not an isolated result. Separate research staged a near-identical test against a counterfeit page styled like a major retailer's checkout: the agent loaded the page, saw no fraud warning, and entered stored bank details without checking whether the site was real [2].
Neither test is a lab curiosity anymore. A survey of online shoppers worldwide found close to three in four now use AI somewhere in their purchase journey, picking products, comparing prices, or handing the actual checkout step to an assistant [3]. That is the current default for a large share of traffic hitting a checkout page today, not a future scenario a business can plan around later.
The reason it works on a script the same way it works on a fake page is structural. Fraud systems were built to read how a person behaves at checkout: how long they pause, where the mouse moves, whether the device looks consistent with past visits. An AI agent removes every one of those signals at once, because it fills a form instantly, never hesitates, and never gets suspicious of a page that looks slightly wrong [4].
The agentic-browser test is the clearest evidence so far that an AI shopping assistant will treat a fake store the same way it treats a real one. The researchers' setup put the agent through three separate traps in sequence, a storefront with no real business behind it, a phishing email, and a CAPTCHA meant to slow down bots, and it cleared all three before completing a purchase with saved card details, never once surfacing the decision back to the person it was supposedly shopping for [1]. A separate test on a counterfeit page styled after a well-known retailer produced the same outcome: the agent entered banking details on a page a human shopper would likely have paused on, because the usual visual tells, a slightly wrong logo, an odd domain, did not register as a reason to stop [2].
That gap matters more now because of how many purchases already run through some form of AI assistance. An industry survey found close to three in four consumers worldwide use AI somewhere in their shopping process, a jump from roughly one in four a year earlier [3]. Most of that usage is still product search and comparison, not full checkout delegation, but the share handing over the final purchase step is the fastest-growing slice of it, which is exactly the part these two tests exposed as unverified.
Fraud-prevention analysis of agentic commerce lists the mechanism plainly: an AI agent strips out the behavioral signals fraud teams have relied on for years, the pause before entering a card number, the mouse movement across a page, a device fingerprint that matches the shopper's history [4]. A scripted agent does none of that, so a checkout flow built to flag anything that moves too fast now has to treat its fastest, most frictionless traffic as potentially its riskiest.
The timing compounds it. Payments data from the 2025 Black Friday to Cyber Monday weekend already shows a shift in what merchants get disputed for: non-delivery claims rose to 34.7% of all chargebacks against 19.9% in a normal week, while fraud's own share of disputes actually fell, from 37.8% to 27.2%, over the same stretch, and smaller merchants carry a higher non-delivery share even outside the peak season [5]. Fraud activity itself has historically climbed starting more than a week before Black Friday, not on the day [5]. Layer a checkout that cannot tell a hesitant human from a scripted agent onto a season where disputes already spike, and the open question, who actually confirmed this purchase, lands on the merchant's desk before it lands on anyone else's.
Those rules key on exactly the signals an AI agent removes: hesitation, mouse movement, a device history that builds up over repeat visits. A checkout that treats instant, friction-free form-filling as normal rather than suspicious is the one an agent sails through, which is the finding both tests produced.
Both tests ran against generic storefronts and a counterfeit page styled like a well-known brand, not a platform-specific exploit. A small merchant's checkout receives the same autofill-driven purchase a large retailer's does, usually with far less fraud tooling sitting behind it to catch what slips through.
Blocking everything that looks automated also blocks a real customer's legitimate assistant mid-purchase, and new agents ship faster than any blocklist tracks them. That trade pushes a business toward rejecting good orders without meaningfully slowing the determined cases.
Add a confirmation step before any payment method, shipping address, or order total above a set threshold finalizes, even when the request looks automated start to finish. Keep proof of delivery, tracking numbers, signed receipts, timestamps, on every order placed from early November through early December, since that is where non-delivery disputes concentrate. Stop treating a fast, frictionless checkout as a good sign by default; it is the exact profile both tests exploited. Watch for a fraud uptick starting in the first half of November, not just on Black Friday itself.
- 1Does your checkout require a second confirmation step when a purchase looks fully automated, no pauses, no scrolling, instant form fill, start to finish?
- 2If an order came from a shopper's AI assistant rather than the shopper directly, who at your business would catch a mismatched delivery address before the package ships?
- 3Do you have delivery proof, tracking and a timestamp, for every order placed from early November through early December, when non-delivery disputes climb?
- 4Would your team tell the difference between a genuine customer dispute and a friendly-fraud chargeback filed after a purchase an AI agent completed successfully?
- 5If a convincing fake version of your storefront showed up in results an AI shopping agent could act on, how would you find out before a customer's agent bought from it?
- [1]GovInfoSecurity — "Agentic AI Browser 'Easy Mark' for Online Scammers" (2026): primary report on the scripted test against an agentic shopping browser, the fake store, phishing email and CAPTCHA sequence, and the unconfirmed purchase using autofill payment details.
- [2]Mezha — reporting on Guardio's "Scamlexity" research, on an AI shopping agent entering bank details on a counterfeit retailer page without a fraud warning.
- [3]Ynetnews — reporting on a Riskified survey finding that close to three in four consumers worldwide now use AI in some part of their online shopping.
- [4]Ravelin — "Agentic commerce: fraud prevention strategy analysis" (2026): on AI shopping agents removing the behavioral signals fraud teams rely on, and the new attack surface agentic checkout opens for merchants.
- [5]Chargeflow — "BFCM payments, fraud and disputes checklist" (2026): source for the non-delivery share of chargebacks during the 2025 Black Friday to Cyber Monday weekend versus a normal week, the fraud-share decline over the same stretch, and the pre-Black-Friday fraud timing data.
We build checkout and order flows with a confirmation step a script can't skip.
Felukaa builds the checkout, order and delivery-tracking flows behind a website so a payment method change, a new shipping address, or a purchase above a set size needs a confirmation step before it finalizes, and so every order carries delivery proof that holds up against a dispute. Published pricing for a checkout-ready system is on the page below.
See published system pricing