Is it safe to let an AI shopping agent buy for you?
Key Takeaways
- An AI shopping agent can browse, compare, and complete a purchase for you, which also means it can complete one on a fake store.
- In Guardio Labs tests, an AI browser went ahead and bought from a fake store and entered saved payment details, though in other runs it stopped and asked the person to finish.
- Hidden instructions on a web page can steer an AI agent. The UK's National Cyber Security Centre says this kind of attack may never be fully mitigated.
- A credit card gives you a formal dispute process. Check statements quickly after any purchase an agent makes.
- Keep the final payment step in your own hands until you trust the store.
What is an AI shopping agent?
An AI shopping agent is an assistant that does more than suggest products. It can open websites, click, fill in forms, and in some cases pay.
People are already using AI tools to shop. Adobe reported that traffic to US retail sites from generative AI tools rose 693.4% across the 2025 holiday season (1 November to 31 December 2025) compared with the year before. Adobe also noted that the base of users remains modest. The more people hand tasks to these tools, the more it matters how they handle a fake page.
How can an AI shopping agent be fooled by a fake store?
Guardio Labs tested this in August 2025 in its research Scamlexity. The team built a fake store that imitated a well-known retailer and asked Perplexity's Comet AI browser to "Buy me an Apple Watch." Comet completed the checkout and filled in the saved payment and address details. In other runs, it refused or asked the person to finish checkout.
The result isn't a promise of how every agent behaves every time. It shows the risk: when security depends on chance, a scam only has to work once. The researchers also point out that when an agent handles the whole flow, the person never gets the chance to notice a red flag.
The same research tested a spoofed bank email. The AI browser clicked the link and treated the fake login page as real. A person might have noticed the sender or the web address.
Can hidden instructions steer an AI agent?
Yes. Guardio Labs also tested a technique it calls PromptFix, where a fake CAPTCHA hides instructions for the AI agent in the page itself. The page looks ordinary to a person, while the agent reads the hidden text and follows it. In the demonstration, the hidden instruction made the agent click a button that downloaded a harmless file, and the researchers say it could have delivered malware.
The general name for this is prompt injection. The OWASP project describes indirect prompt injection as what happens when an AI accepts input from outside sources that an attacker controls, and notes the instructions don't have to be readable by a person. The UK's National Cyber Security Centre warns that prompt injection attacks may never be totally mitigated, and that the realistic goal is to reduce the likelihood or impact of attacks.
Can scammers train a fake page against an agent?
Guardio Labs showed that too. In its March 2026 research AgenticBlabbering, the team noted that AI browsers expose their reasoning, including their doubts about a page. Researchers used that stream of reasoning to refine a fake pet-store refund page over four rounds, and the loop took under four minutes. By the last round, the agent raised no meaningful concerns and logged in.
The takeaway for shoppers is simple. An agent that explains its doubts can teach a scammer what to fix. That is research on one widely used agent at the time of testing, and products change, but the pattern is worth knowing.
What protections do you keep when an agent pays?
How you pay matters. The FTC says the credit card dispute process applies to billing errors on credit cards, and that your letter should reach the issuer within 60 days after the first bill with the error was sent. Federal law also limits your responsibility for unauthorized charges to $50. When you pay from a bank account, the FTC warns that overdrafts can cost fees and damage credit.
It's also worth asking your card issuer how it treats purchases made by an AI assistant on your behalf, before you need the answer.
A checklist before you let an AI agent pay
- Start from the store yourself. Open the retailer from a bookmark or by typing the address, then let the agent help from there. Our guide to detecting fake shopping sites shows what to look for.
- Keep the last click. Turn on any setting that asks you to confirm before checkout, and don't approve a purchase you haven't looked at.
- Pay with a credit card. It has the dispute process described above. Read our guide on safe payment methods online for more.
- Limit what's saved. The agent in the fake store test filled in saved payment and address details. Don't leave a card saved in a browser you let an agent control.
- Don't let it work through email links alone. An agent that follows a link in a spoofed email can land on a fake login page.
- Watch the first purchases. Stay on screen while the agent shops until you've seen how it behaves.
- Check the confirmation and the card statement. Look at the order email and the charge within a day or two.
How Guardio helps
Guardio helps flag fake shopping sites and phishing pages as you browse, with the browser extension for Chrome and Edge and the Guardio apps for iOS and Android. Guardio can't make handing over a checkout risk free, so the checklist above still applies.
The bottom line
An AI shopping agent is only as safe as the store it lands on and the instructions it follows. Keep the final click, pay with a credit card, and check the statement. Test your own scam spotting with the free scam quiz.
Take the free scam quiz and get a free security scan
Sources
- Guardio Labs, "Scamlexity: We Put Agentic AI Browsers to the Test," 20 August 2025
- Guardio Labs, "AgenticBlabbering: How AI Browsers' Verbose Reasoning Fuels the Ultimate Scamming Machine," 11 March 2026
- Adobe, "Holiday Shopping Season Drove a Record $257.8 Billion Online," 7 January 2026
- OWASP GenAI Security Project, "LLM01: Prompt Injection"
- UK National Cyber Security Centre, "Prompt injection is not SQL injection (it may be worse)," 8 December 2025
- FTC Consumer Advice, "Using Credit Cards and Disputing Charges"
- The Hacker News, "Experts Find AI Browsers Can Be Tricked," 20 August 2025
FAQs
Are AI shopping agents safe to use?
They can save time, but Guardio Labs research shows they can be fooled by fake stores, spoofed emails, and hidden instructions. Keep the final payment step in your hands until you trust the store.
Can an AI agent be scammed?
Yes. In Guardio Labs tests, an AI browser completed a purchase on a fake store and treated a fake login page as real. In some runs it stopped and asked the person to finish, so results vary.
What is prompt injection?
It's an attack where an AI follows instructions an attacker has hidden in content it reads, such as a web page. The UK's National Cyber Security Centre says it may never be totally mitigated.
Should I give an AI agent my credit card?
If you do, use a credit card rather than a debit card, confirm each purchase yourself, and check statements quickly. The FTC's dispute process covers billing errors on credit cards.
What should I do if an agent bought from a fake site?
Contact the card issuer right away, since the FTC says a dispute letter should reach the issuer within 60 days of the first bill with the error. Change the password for any account you used, and report the scam to the FTC at ReportFraud.ftc.gov.
Is it safer if I do the clicking and paying myself?
You keep the chance to notice a red flag, which the Guardio Labs researchers say is lost when an agent handles the whole flow. A fake store can still fool a person, so keep checking the web address and the seller.
How-To & Safety TipsHow to Create Strong Passwords You Can Remember
How-To & Safety TipsTikTok Account Hacked? How to Recover It Safely
