AI shopping agents: mandate and identity, not just access
In brief
According to Journal du Net, AI agents can now compare offers and pay for purchases, including via the MCP standard from late 2024. Fraudsters can take control of an agent, for example by prompt injection, and drain an account very quickly. An international study by the Cloud Security Alliance and Token Security says 65% of organizations have already had at least one security incident caused by an AI agent.
What it changes for an SME
If you sell online or let an AI agent buy for your company, classic fraud signals such as speed and a linear checkout no longer separate bots from legitimate delegated purchases. The main risk is not only who can access an account, but an agent that exceeds its mandate, with sensitive data leaks already reported in that study. Blocking all automation slows honest purchases while organised fraud still gets through. Tie each agent to a verified human identity, a written mandate, and a log you can show in a dispute or an audit.
What you can do
- List every AI agent that can reach a payment system, a customer account or a marketplace, and who is accountable for it.
- Write down each agent's mandate: amounts, product categories, allowed merchants, and when a human must confirm.
- Check that every action is logged back to an identified person, and that your fraud tools no longer treat speed alone as proof of attack.
Let's talk about the time you could save.
In 20 minutes, we find where AI could save you time or money. Free, no commitment.