The RealReal tightens bot defenses against AI shopping agents

The vulnerability centered on the site’s 20-minute hold window. By programming an AI agent to automatically re-add listings to a cart the moment a hold expired, users could prevent others from purchasing specific items. Chief technology officer Luke Friang confirmed the company has updated its security configurations to restrict automated logins and checkouts, though the platform will still allow agents to surface product listings for human users.

This incident highlights a growing tension between e-commerce platforms and the rise of autonomous shopping assistants. While Meta promotes Muse as a convenient tool—reporting that it has reached 10 million downloads in the U.S. and is primarily used for shopping—retailers fear the shift. If consumers transition from browsing sites directly to interacting with chatbots, companies risk losing their direct connection to shoppers and the associated advertising revenue. As retailers scramble to secure their platforms, they face the challenge of distinguishing between helpful automated assistants and disruptive bots that possess the tireless capacity to perform repetitive tasks no human would endure.