What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
AI shopping agents are becoming a meaningful source of demand for online stores, but the same automated traffic can inflate infrastructure and LLM costs, obscure attribution, scrape prices and inventory, and imitate legitimate customers. Sellers should measure and classify agent activity, expose only controlled APIs, and protect account and checkout flows rather than applying a blanket allow-or-block rule.
Why AI-agent traffic is suddenly a commerce problem
Shopping agents now search catalogs, compare offers, select products, add items to carts and handle post-purchase tasks. That puts them directly on the paths that sellers previously optimized for human shoppers and conventional search crawlers.
As an Amazon Associate I earn from qualifying purchases.
Akamai reported that 47.9% of all AI-bot traffic on its network came from commerce between July and December 2025. The same 2026 analysis found nearly three trillion Layer 7 distributed-denial-of-service attacks against commerce in 2025, with retail responsible for 84% of that volume. Those figures describe Akamai’s network and measurement period, not every online store, but they show why automated commerce traffic now belongs in both growth and security planning.
Free tools Windows power users keep installed
One-click scans. No signup required.
Legitimate agents can still be costly. Salesforce warns that they consume bandwidth and LLM resources, while product-page visits generated by agents may appear in analytics as direct traffic with no referrer or UTM data. A store can therefore pay to serve high-volume automated requests and misattribute the resulting demand at the same time.
#1 Best Overall
What kinds of automated visitors are reaching a store?
| Traffic intent | Potential business value | Typical cost | Primary risk |
|---|---|---|---|
| Training or indexing crawler | Discoverability, usually indirect and difficult to attribute | Catalog bandwidth and page-rendering resources | Unapproved content reuse or excessive crawl rate |
| Shopping or referral agent | Qualified product discovery and possible conversion | Product-page requests, API calls and LLM usage | Unclear identity, attribution and policy compliance |
| Price or inventory scraper | Little direct value to the seller | Repeated catalog and availability requests | Competitive intelligence, stale-cache pressure and data leakage |
| Fraud or account-abuse agent | None | Support, chargeback and incident-response workload | Credential theft, payment abuse and synthetic accounts |
A blanket rule treats all four categories as identical. Salesforce recommends detecting AI crawlers and shopping agents, assigning policy by category, measuring their effect before enforcement, and then using edge-CDN rules or discoverability controls. The practical objective is selective access: welcome traffic that can create value while constraining requests that create cost or risk.
Why detection is harder than ordinary bot blocking
Akamai says autonomous shopping agents can reproduce the small timing and navigation patterns associated with human browsing. Attackers can also hijack legitimate assistants and abuse payment credentials stored for delegated purchases. LLM-enabled synthetic identities add another problem: a fake shopper can look consistent across sessions even when no real person is behind the account.
DataDome’s 2026 report found scraping accounted for 70.9% of bad-bot traffic in its customer base and said scraping increased 185.2% during its study period. A user-agent string or a single IP address is therefore not enough evidence for an allow or block decision. Combine identity signals, request frequency, sequence of actions, account history, API behavior and the sensitivity of the requested data.
How to govern agents without losing useful demand
1. Create an agent and API inventory
List every endpoint used for product data, prices, stock, search, customer accounts, payments, carts and checkout. Record its owner, data returned, authentication method, rate limits and whether a third-party seller tool accesses it. Akamai reported that web attacks targeting APIs rose 9% year over year; 85% of commerce respondents experienced at least one API-related incident in the preceding year, while only 22% knew which APIs exposed sensitive data. Treat API discovery as an inventory and access-control exercise, not merely a page-security task.
2. Separate read-only discovery from transactional actions
Provide a documented, rate-limited product feed or read-only API for agents that need catalog information. Keep account, payment, cart and checkout operations behind strong authentication, scoped tokens, explicit consent and step-up verification. Never give a discovery crawler credentials that can change listings, place orders or retrieve another shopper’s information.
3. Classify traffic by intent and value
Use logs and edge telemetry to distinguish an identified shopping agent from a scraper, training crawler or suspicious automation. Score each class against four questions:
- Is the request likely to refer or convert a shopper?
- What bandwidth, rendering or LLM cost does it impose?
- Does it request prices, inventory, personal data or payment-related information?
- Does its behavior match the permissions and terms under which it claims to operate?
4. Measure before enforcing
Establish a baseline for request volume, cache hit rate, response time, LLM consumption, attributed revenue and checkout completion. Check whether “direct” sessions rise when an agent is active, and tag approved integrations where your analytics platform permits it. Only after measuring should you apply edge-CDN challenges, rate limits, deny rules or reduced discoverability.
5. Protect high-impact actions
Use microsegmentation so a catalog request cannot reach account or payment systems. For elevated-risk behavior, Akamai recommends coordinating fraud and cybersecurity teams, using behavioral biometrics and risk-based multifactor authentication, and maintaining rapid kill switches. A kill switch should disable a compromised integration without taking the entire storefront offline.
Marketplace rules now reach seller software
Amazon announced that an update to its Business Solutions Agreement takes effect on March 4, 2026. Under the new Agent Policy, automated agents accessing Amazon Services must clearly identify themselves as automated systems, follow the policy and stop when Amazon requests. Sellers should audit repricing, listing, product-research and support tools that log in to or query Amazon services, including tools operated by outside vendors.
Amazon’s 2025 Trustworthy Shopping Experience Report says every new seller completes verification before selling and that Amazon’s automated technology and AI scan billions of attempted product-detail-page changes daily for abuse. Continuous automated monitoring can block bad activity, but legitimate seller workflows may also encounter verification or rate-limit friction. Keep records of the tools you authorize and a manual fallback for critical listing and fulfillment work.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Delegating an action does not remove responsibility
UK government consumer-law guidance states: “If an AI agent you use does something illegal, you are responsible.” The statement is a useful operating rule even when a seller is working across borders: define what an agent may do, retain an audit trail of instructions and approvals, and make a person accountable for refunds, representations, pricing changes and regulated decisions.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →What shoppers expect from agent-enabled buying
Visa’s 2025 survey questioned 1,600 U.S. adults, 1,600 Australian adults and 500 New Zealand adults who shop online monthly and hold a debit or credit card. Across those markets, about two-thirds said they use or would use shopping agents to save time or find better prices. Nearly nine in ten wanted transparency into how an agent makes decisions, and about 85% of American respondents said visibility into data collection and the ability to customize or delete shopping and purchase information was important.
Average concerns across the three markets were data security (50%), privacy (44%), purchase accuracy (42%), reliability (40%) and loss of control (36%). Make those concerns addressable in agent-readable product and checkout experiences:
- State total price, availability, delivery timing and refund conditions in structured product data.
- Explain what information is collected, how long it is retained and how a customer can correct or delete it.
- Show when an agent is acting, what it is authorized to purchase and how a customer can stop or reverse the action.
- Keep payment credentials tokenized and avoid exposing them to catalog or comparison integrations.
A practical decision framework for sellers
- Allow and identify: Permit an agent that declares its identity, uses documented interfaces, respects rate limits and sends demonstrable referral or conversion value.
- Constrain: Reduce crawl frequency, serve cached or redacted data, or require a challenge when an agent has value but imposes disproportionate cost.
- Quarantine: Isolate unknown automation from account, cart and payment systems until its owner and purpose are verified.
- Block and investigate: Deny traffic that evades controls, scrapes sensitive data, tests credentials or creates abnormal checkout behavior. Share indicators between fraud and security teams.
- Review continuously: Reassess permissions when an agent changes behavior, a marketplace changes its policy or a new API is deployed.
Patrick Sullivan, Akamai’s chief technology officer of security strategy, describes the shift this way: “We are securing a digital frontier where the ‘customer’ is increasingly an AI agent operating on behalf of the human user.” The sound response is not to make the storefront invisible to automation. It is to design explicit, measurable boundaries around what each agent can discover, how often it can ask, and which actions require a verified human.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
