Agentic Commerce Has an Intent Problem: How Retailers Can Close the Buyer-Intent Gap

AI agents are beginning to change a fundamental part of ecommerce: who - or what - actually does the shopping.

Instead of a customer searching a retailer’s website, comparing products, filling a cart and completing checkout, an AI shopping agent can increasingly perform those steps on their behalf.

The commercial opportunity is significant. McKinsey estimates cited in our latest white paper suggest that AI agents could generate $3-5 trillion in global sales by 2030. On Shopify stores, orders originating from AI search were reportedly around 13 times higher in Q1 2026 than a year earlier, while new-buyer orders from AI search were approximately twice those originating from regular search.

For retailers, that creates an obvious incentive to embrace agentic commerce.

But it also introduces a new fraud and security question:

How does a retailer know that the order an AI agent submits is actually the order the customer intended to make?

That is the buyer-intent gap.

What is agentic commerce?

Agentic commerce describes shopping experiences in which AI agents perform some or all of the purchasing journey for a customer.

A shopper might simply ask:

“Reorder my running shoes, size 10.”

Rather than requiring the shopper to visit a website and navigate the traditional ecommerce journey, an agent could search a retailer's catalog, add an item to a cart, provide delivery and payment information and initiate checkout.

The customer gets a dramatically simplified experience: make a request, review the proposed purchase and approve it.

But the retailer sees something very different.

As the diagram on page one of our white paper illustrates, the store can see the agent's interactions with its commerce infrastructure — such as catalog searches, cart updates and checkout calls — but it does not necessarily see the shopper's original request or everything the agent presented to the shopper before obtaining approval.

That distinction matters.

Agent verification isn't the same as buyer intent

Emerging agentic commerce standards are addressing an important part of the trust problem.

Retailers need mechanisms for determining whether an agent is genuine and whether a customer authorized a transaction. Agent signatures, payment authorization and newer approaches incorporating signed shopper approval can help establish that.

But verification and intent aren't the same thing.

An approval can establish that the customer approved the cart presented to them. It doesn't necessarily explain how the agent arrived at that cart.

Consider a legitimate AI agent operating from a legitimate customer account, using a legitimate payment method and carrying valid authorization.

The transaction could still be wrong.

An agent could have misunderstood the request. It could have been influenced by malicious content encountered during its research. An attacker could have gained access to the shopper's AI assistant. Or an unexpected product could have entered the purchasing journey without corresponding to anything the shopper originally wanted.

The white paper highlights this distinction using emerging agent protocols themselves. Google's AP2 specification, for example, explicitly considers prompt-injection risk, while Mastercard's Verifiable Intent specification distinguishes verification of constraints from verification of how an agent behaved.

For fraud teams, that creates a new problem: a technically valid transaction can still be an unwanted transaction.

Why traditional ecommerce fraud controls may struggle

Many fraud strategies concentrate controls around high-risk events such as login, checkout and payment.

That makes sense when the human shopper is directly navigating the journey. Agentic commerce changes the model.

The agent may interact directly with retailer tools and APIs. Some of the context that previously came naturally from a customer's website journey may therefore look very different — or disappear entirely.

Checking an agent's signature and payment authorization at the final transaction tells the retailer something important, but it doesn't provide the complete context of everything that led there.

The same problem exists when retailers rely too heavily on isolated point-in-time risk assessments.

Darwinium's approach is based instead on connecting digital interactions into journeys and continuously assessing their context. The platform can combine information about devices, connections, behavioral signals and previous interactions to distinguish trusted activity from anomalous behavior.

In an agentic world, the journey becomes part of the security signal.

Three agentic commerce risks retailers should prepare for

The buyer-intent gap becomes clearer when you consider what could happen in real transactions.

1. Account takeover through a trusted AI agent. Imagine an agent ordering three expensive smartphones for same-day delivery from an established customer's account. The agent is legitimate. The payment checks out. But has the shopper suddenly decided to buy three phones, or has someone socially engineered access to their AI assistant?

The final transaction alone may not provide enough information to distinguish the two.

Journey context can. Spending dramatically above the account's normal level, shopping at an unusual time, or moving through an unfamiliar purchasing pattern can provide reasons to introduce additional verification.

2. Prompt injection influencing a purchase. Now imagine an agent researching headphones. It encounters malicious content instructing shopping agents to add a $200 gift card to an external email address.

From a conventional checkout perspective, the order might still look valid.

From a journey perspective, however, the gift card is unusual: the customer never searched for it, it is being delivered to an unfamiliar email address and similar trusted journeys don't normally contain that step.

Instead of rejecting the entire transaction, the retailer could potentially intervene at the anomalous interaction while allowing the legitimate headphone purchase to continue. This example is illustrated on page two of the white paper.

3. Bots masquerading as legitimate agents. As retailers begin allowing known AI agents to interact with commerce infrastructure, attackers gain an obvious camouflage opportunity: make malicious automation look like legitimate agent traffic.

Agent identity therefore needs to be considered alongside behavioral and journey context rather than becoming a new allowlist that attackers can exploit.

From transaction verification to continuous journey intelligence

The answer isn't simply to block AI agents.

Doing so risks blocking an increasingly important route to market. Equally, allowing every verified agent transaction through without additional context creates an obvious blind spot.

Retailers need a way to evaluate whether each interaction fits the journey around it.

Darwinium approaches this by running within the retailer's own CDN infrastructure — including Cloudflare, CloudFront or Akamai — and across web experiences. Interactions can be connected by signals such as browser, account and cart and compared with previous journeys and expected behavior.

That provides a foundation for a more contextual decision.

A familiar agent performing a familiar reorder for a known customer can proceed without unnecessary friction.

An unusual journey can be treated differently.

Rather than forcing every agent transaction through the same authentication process, retailers can respond according to the actual risk they observe.

Intelligent intervention matters as much as intelligent detection

Detecting something unusual is only half the challenge.

Retailers also need to decide what to do next.

A binary "allow or block" decision is particularly problematic in agentic commerce. Block too aggressively and genuine customers may simply take their AI agent — and their purchase — elsewhere. Allow too freely and retailers risk absorbing fraud, chargebacks and disputes.

Darwinium can make real-time decisions and dynamically alter how a journey proceeds. Its platform supports interventions such as redirects, changes to content and the injection of risk information into requests, enabling businesses to adapt the experience according to trust or risk.

For an uncertain agent transaction, that can create a useful third option: hand the journey back to the human.

The white paper provides an example in which a suspicious checkout call can be answered with a link to the retailer's own page. When the shopper opens it, additional device, connection and behavioral context can be compared against the account's established baseline.

A legitimate shopper can continue.

A potential attacker can be stepped up.

The retailer doesn't have to choose between blindly trusting the agent and rejecting the transaction altogether.

What continuous agentic commerce security could enable

Once retailers can evaluate agent interactions as complete journeys, security can become an enabler rather than simply a control.

The white paper identifies several possibilities: a fast lane for trusted agents following familiar purchasing patterns; hand-offs to the retailer's own experience when confidence drops; detection of card testing and promotion abuse conducted through agents; and better visibility into which agents generate legitimate customers and successful orders.

This follows the broader Darwinium philosophy of applying friction according to observed risk. Darwinium combines continuous journey visibility with real-time decisioning so businesses can tailor customer experiences rather than applying the same controls to every interaction.

That principle could become increasingly important as the boundary between human and machine-driven commerce becomes less distinct.

The next challenge for agentic commerce is understanding intent

Agentic commerce promises to remove enormous amounts of friction from online shopping.

But removing the traditional interface between customer and retailer also removes context that fraud teams have historically relied upon.

Agent signatures help answer who or what acted.

Payment authorization helps answer whether the transaction was approved.

Neither necessarily answers the most important question:

Does this purchase fit what this customer actually intended to do?

Closing that buyer-intent gap requires retailers to look beyond the final transaction and understand the complete journey around it — connecting agent activity with account history, device and behavioral context, previous interactions and the sequence of actions that produced the purchase.

That is how retailers can make agentic commerce safer without removing the convenience that makes it valuable in the first place.

Download the white paper: Agentic Commerce and the Buyer-Intent Gap

Explore the buyer-intent problem in more detail, including diagrams showing what retailers can — and cannot — see during an agent-led purchase, examples of account takeover and prompt-injection scenarios, and how continuous journey intelligence can help retailers respond.

Download the full Agentic Commerce and the Buyer-Intent Gap white paper.