AI agents are a new kind of web visitor, and some already attack online shops

Personal AI agents are a third kind of web visitor, neither human nor classic bot, because they act for one person at machine speed. Agent traffic tripled in a single month, many sites block it, and platforms may redesign the web for agents. The risk is a worse experience for humans: constant verification, personalised prices, opaque recommendations (MIT Technology Review).

The darker side: an investigation by the security start-up Gambit, reported by netzwoche, found autonomous AI agents attacking hundreds of online shops. At least 119 websites were infected with card skimmers and more than 600,000 cards were stolen from two companies, at an estimated cost to the attacker of 12,000 to 18,000 dollars.

Agents are both customers and attackers, and a shop cannot treat them as one crowd. It should decide which agents are welcome and through which interface, and watch its own checkout pages, because that is where skimmers are injected. AI makes attacks cheaper, so basic hygiene has to become routine.

Small shops cannot afford a security team, but they can afford a trained local freelancer. Turning people who lost their jobs into those freelancers is one of the most practical things your donation does.

Practical step: set an alert for every change to your checkout code, check the integrity of site files weekly, and write down which agents you allow.