Your customers have started sending software to your checkout page, and the first team at your company to take that seriously was not product, not marketing, and not the board. It was fraud.
That is not a coincidence. Fraud teams are paid to notice when the entity holding the payment credential is not the person who owns it — and agentic commerce makes that the default condition of every transaction.
The bots came for the storefront first
In July, Akamai published Securing the Agentic Storefront: Attacks on Commerce, analyzing traffic from July through December 2025. The headline number: 47.9% of all AI bot traffic across Akamai's network hit the commerce sector. Not social. Not media. Commerce. Where the money is, which is the least surprising sentence in this post.
Two findings deserve more attention than the headline:
- 90% of commerce organizations put AI bot activity in "monitor" status — and then let three-quarters of the remaining activity through unrestricted. Watching is not a policy. It's a decision to decide later, made at the exact moment the traffic mix is changing fastest.
- The attack patterns Akamai describes are agent-shaped, not bot-shaped: agent hijacking, abuse of stored payment credentials, and LLM-assembled synthetic "Frankenstein" accounts built to sail past defenses tuned for scripted bots.
The old fraud question was "is this a human?" The new one is "this is definitely software — is it the software my customer actually sent, doing what they actually authorized?" CAPTCHA does not answer that question. Nothing in the classic anti-bot stack does, because the classic stack was built to keep software out.
Customers want this. They just don't trust it yet.
The demand side is not hypothetical. Adobe measured 393% year-over-year growth in AI-referred retail traffic in Q1 2026, and Salesforce attributed $67 billion in global Cyber Week 2025 sales — 20% of all orders — to AI agent influence (figures compiled by Axis Intelligence). Blocking agents wholesale means blocking a channel that already converts.
But look at what consumers said in Checkout.com's June 2026 survey: 65% trust AI to compare prices; only 14% trust it to place orders autonomously. A 51-point gap between "help me shop" and "spend my money."
And when asked what it would take to close that gap, consumers gave three answers: spending caps (30%), instant revocation (29%), and easy cancellation (28%).
Read that list again. Consumers just wrote a requirements document for agent trust infrastructure. Bounded authority. A kill switch. A reversible audit trail. They didn't use the vocabulary of agent governance, but they described it precisely — and the 86% who won't yet delegate a purchase are telling you exactly which features convert them.
The merchant's false binary
Most commerce platforms today have two available postures, and both are wrong.
Block agents and you're refusing the fastest-growing referral channel in retail while your competitors take the orders. Allow agents and you're accepting that a hijacked agent with a stolen stored credential looks, at the network layer, identical to a legitimate one carrying a customer's mandate.
The binary exists because the transaction is missing three pieces of information the merchant has no way to check: who is this agent (identity), who sent it and with what scope (delegated authority), and how has it behaved everywhere else (track record). Payment rails answer none of these. The card number is valid either way — that's precisely how stored-credential abuse works.
What trust rails actually look like
This is the gap VeriSwarm's Passport and Gate pillars exist to fill.
Passport gives an agent a verifiable identity: signed manifests and portable, cryptographically signed credentials that state who the agent is, who operates it, and — critically for commerce — a delegation chain. When a customer authorizes an agent to buy, that authorization becomes an explicit, scoped, verifiable delegation rather than a vibe. A merchant checking a Passport isn't guessing whether the agent was sent by the cardholder; the delegation says so, with a signature, with a scope, with an expiry. Spending caps — the number-one consumer prerequisite — belong in the delegation, not in a terms-of-service paragraph nobody enforces.
Gate answers the track-record question. Trust scoring turns an agent's behavioral history — across every platform reporting into the shared reputation network — into a score a merchant can gate decisions on, and policy tiers turn that score into graduated authority. A new agent with no history doesn't get a spending limit; it gets a sandbox. An agent with months of clean behavior earns autonomy incrementally. And an agent that gets hijacked and starts behaving like a Frankenstein account doesn't get to burn one merchant and present a clean face to the next — the reputation moves with it.
Instant revocation — consumer prerequisite number two — is the kill switch: authority that can be withdrawn in seconds, not at the end of a support ticket.
None of this requires waiting for the payments industry to finish standardizing agentic checkout. Verification of the agent is the merchant's and platform's problem today, whatever rails the money eventually moves on.
Do this before the wallet opens
If you operate agents that transact, or a platform where they will: inventory the agent traffic you're currently "monitoring" — Akamai's numbers say that's where you are — and stop treating it as one undifferentiated blob. Then put identity and scoring in front of anything that touches a payment credential. Gate's trust scoring is free and always on; Passport adds verified identity and scoped delegations when agents start carrying authority that costs money when it's wrong.
The fraud teams noticed first because the trust infrastructure wasn't there. It is now.
Sources: Akamai, "Securing the Agentic Storefront" (July 2026) · Axis Intelligence, Agentic Commerce Statistics 2026 (compiling Adobe, Salesforce, Checkout.com data) · Security Boulevard on the Akamai findings