An AI agent can do more than recommend a jacket. It can browse listings, add items to a cart, and repeat those actions on a shopper's behalf. That shifts what an ordinary website feature does in practice. A short reservation window, for example, can turn into a way to keep an item unavailable for hours.
That's what happened at The RealReal, the luxury resale retailer. Its site temporarily reserves an item when a shopper adds it to a cart. Reporting by The Verge found that Meta's Muse agent could repeatedly add a listing after each 20-minute hold expired, keeping other customers from buying it. The RealReal then updated its bot defenses to make it harder for agents to log in, add items to carts, and check out.
This incident is small compared to the scale of retail. Still, it's a useful stress test. It shows how a system built for human browsing can behave very differently when software can act continuously and at low cost. Below, we'll look at what happened, why it matters beyond resale fashion, and how retailers can respond without shutting down helpful discovery.
What happened at The RealReal?
The RealReal uses a temporary hold to give shoppers time to finish a purchase. When someone puts an item in their cart, it becomes unavailable to other customers for 20 minutes. For one-of-a-kind secondhand goods, that's a fairly sensible design choice - it lowers the odds that two people try to buy the same item at the same time.
The issue was that an agent could keep doing the same thing. The Verge reported that Meta's Muse could be instructed to add a listing again when the hold expired. In testing, that meant the item could stay unavailable to other shoppers for hours. A human shopper might lose interest, get distracted, or decide not to follow through. An agent doesn't really get tired, impatient, or distracted in the same way.
After the report, The RealReal's chief technology officer, Luke Friang, said the company had addressed the specific Muse use case. The retailer changed its bot defenses to make it harder for agents to log in, add items to a cart, and check out. The company said agents could still surface listings and send Muse users to product pages, while it continued strengthening protections.
What's notable here is the focus. The RealReal didn't claim it was banning AI systems from finding products altogether. It tightened controls on actions that affect availability or complete a transaction. In other words: helping someone discover a handbag is different from repeatedly reserving it in a way that blocks everyone else.
This isn't proof that every shopping agent is abusive, or that automation is automatically bad. It does show how a familiar retail rule can be exploited when the system assumes a person is on the other side of the screen. For businesses, the real question isn't "allow or prohibit AI" in the abstract - it's which actions should be allowed, how often, and under what conditions.
Why can AI shopping agents disrupt retail?
Retail sites are built on assumptions about how people behave. People browse at uneven speed, make mistakes, pause to compare options, and then eventually leave. Many safeguards rely on those limits, even when the site doesn't describe them as "security" controls. An agent can run faster, more consistently, and for longer than a human. That means a feature that's fine at human speed can become a problem at machine speed.
The RealReal's cart hold is a good example. It's basically a lightweight coordination mechanism for scarce inventory. But if software keeps refreshing the hold, the same mechanism can squeeze out genuine buyers. Similar pressure can show up anywhere availability is temporarily assigned - limited-stock drops, appointment slots, reservation queues, ticketing systems, and more. The exact failure mode varies by site and product, but the mismatch is consistent: human-oriented rules meet persistent automation.
There's also a business and visibility angle. If more shoppers interact with retailers through assistants instead of visiting sites directly, retailers can lose some insight into how customers discover products and make decisions. That can ripple into merchandising, customer support, and ad strategy. The Verge's reporting notes that major retailers, including Amazon, have blocked agents from shopping on their sites - suggesting concern that automated intermediaries could change the economics of customer access.
At the same time, agents have a real consumer use case. On its Q3 earnings call, Meta said shopping is the most common Muse use case so far and that purchases average over $200. The company also said 10 million people in the US downloaded the app within 40 days. Those numbers don't prove agentic commerce will take over. But they do explain why retailers can't treat it like a niche technical curiosity.
The trade-off isn't "automation vs. human control." A well-designed agent can reduce the effort required to compare products or find a specific item. But if an agent uses its access to reserve scarce inventory, it imposes costs on other shoppers - and on the retailer that has to manage the disruption. The design challenge is to deliver convenience without letting one customer's automation hog a shared system.
How should retailers respond to shopping agents?
Don't treat all bot traffic the same. Classify what the agent can actually do, and write policies around that. Reading a product page isn't the same as creating an account, reserving inventory, or placing an order. Each step changes the system differently, so each needs a different rule.
One practical model is to group actions like this:
- Discovery: viewing public listings, searching inventory, opening product pages.
- State-changing actions: logging in, adding items to a cart, reserving stock, booking a slot.
- Commitment actions: submitting payment, placing an order, or changing an existing purchase.
The RealReal's response fits this idea. It kept listings discoverable, while adding friction for agents around account access and transactions. That preserves some discovery value without assuming an automated tool should get the same permissions as a human buyer.
Next, review rules that depend on limited human attention. Ask what happens when a user repeats an action continuously, across multiple accounts, or at a pace no person could sustain. This review should cover hold expiration, limits on repeated reservations, and whether abandoned carts reliably release inventory. You're not trying to make every user prove they're human. You're trying to stop automated behavior from turning a reasonable "hold" feature into a denial-of-access tool.
Then match controls to risk. A read-only product feed may need fewer restrictions than repeated inventory reservations. Higher-impact actions can justify rate limits, account-level quotas, extra verification, or explicit confirmation before a purchase. Keep in mind that every control has a cost: too much friction can block legitimate users, accessibility tools, and useful automation. It's also worth measuring false positives - not just "fewer bots" as your only success metric.
Finally, treat protection as an ongoing operating practice, not a one-time patch. Agents will change, and so will user behavior and interfaces. Monitor for unusual patterns, set thresholds you can adjust, and make sure there's a path for customers who get blocked incorrectly. If your policy is invisible to legitimate users but effective against repeated harmful behavior, it's usually better than a broad ban that simply pushes the problem somewhere else.
What should businesses evaluate before enabling agents?
If you build or permit shopping agents, evaluate the effects on other users - not just whether the agent completes its goal. "Keep this item available for me" sounds helpful from one shopper's point of view. On a marketplace where only one item exists, that same behavior can prevent everyone else from buying it.
A good review starts with the action and its consequence. For each capability, ask:
- Does it change shared state? Viewing a listing affects things differently than reserving stock.
- Can it be repeated without meaningful cost? If yes, a human-style limit may not work.
- Who absorbs the downside? The customer, retailer, seller, or other shoppers may feel the impact.
- Can the action be reversed? A temporary hold may expire, but a completed order or cancellation can carry heavier operational cost.
- What signals point to misuse? Repeated reservations, unusual frequency, and patterns across accounts matter more than a single attempt.
This is also where product design and technical controls have to meet. An agent interface should clearly indicate when it's browsing, when it's reserving something, and when it's about to commit to a purchase. Requiring human confirmation for consequential steps can reduce mistakes, but it isn't a complete defense - persistent agents can still cause disruption before the final confirmation step.
Retailers also need a way to separate helpful traffic from traffic that harms the service. That doesn't always mean identifying the exact model or blocking every automated client. Sometimes it's about controlling the rate and effect of sensitive actions, using inventory-aware limits, or offering structured access for approved partners when it makes business sense. The right approach depends on inventory scarcity, margins, fraud exposure, and how much value the retailer actually gets from external discovery.
There are real costs on both sides. Blocking agents can protect inventory and preserve direct customer relationships, but it can also make products harder to find through emerging assistant interfaces. Allowing broad access may increase reach, but it can hand off key customer interactions to intermediaries. Businesses should spell out that trade-off and revisit it as real traffic and customer behavior become clearer.
Key takeaways
- Separate product discovery from actions that reserve or purchase inventory.
- Test safeguards against persistent automation, not just ordinary human browsing.
- Apply friction based on the likely impact of an action.
- Track legitimate-user disruption as well as bot activity.
- Give agents and customers clear feedback when an action is limited or requires confirmation.
Conclusion
The RealReal's response shows how quickly AI agents can expose assumptions built into everyday web systems. A 20-minute cart hold behaves differently when software can keep renewing it without getting tired, distracted, or impatient. The issue isn't that agents are inherently harmful. It's that automated actions can affect shared resources with a scale and persistence that existing rules weren't built for.
Retailers should define permissions by consequence, protect high-impact actions, and monitor both abuse and overblocking costs. Agent developers should account for other users and systems affected by an action - not just whether the assigned task gets completed. The practical standard is simple: make discovery easy when it's safe, and put real limits around automation that can deny access or lock up resources.