The RealReal Shows Why AI Shopping Permissions Must Begin Before Checkout

An AI shopping agent can change what other customers are able to buy without buying anything itself.

That is the lesson in a test The Verge ran on The RealReal, and in the retailer's response. Many of agentic commerce's most visible safeguards, including purchase approval and protected payment credentials, become most explicit at checkout. On a site where a cart is a reservation, the consequential action happens earlier.

What happened

The RealReal puts an item on hold for 20 minutes once a shopper adds it to the cart, and other customers cannot buy it during that time. On October 22, The Verge's Mia Sato described instructing Meta's Muse to add the 10 newest listings from a favorite brand to her cart, then to re-add them each time the hold expired. She had no intention of buying them. The task ran all day before she ended it. Nothing was purchased.

In that story, The RealReal's chief technology officer, Luke Friang, said the company would "remain open to third-party AI agents" while keeping safeguards against automated activity that disrupts the customer experience. On October 26, The Verge reported that the company had addressed the use case. Its bot defenses now make it "much more difficult for all agents to log in, add items to cart, and check out," Friang said, while agents can still surface listings and direct Muse users to product pages. Meta did not comment.

This was not a purchase problem

Muse's safeguards are built around buying. Meta says Muse asks the person before it makes a purchase, and Stripe's Link asks the customer to approve the total. Meta's spokesperson told The Verge that Muse also applies "ethical browsing principles" when asked to do things a human could not, such as buying every ticket to an event.

None of that was triggered, because nothing was bought. And the task was one a person could do, just far more patiently than any person would.

Meta's published security design explains why. A separate agent called Sentinel weighs each action against the policy the user has set and decides whether to allow it, deny it or ask. It supports standing permissions, because Meta does not want Muse asking the user about everything. That design protects the user's accounts, data and money. In Meta's published description, it does not separately explain how Muse limits otherwise authorized browser actions whose cost falls on other shoppers.

This is the gap next to an argument I made earlier: AI can decide what to buy, but should not decide that money moves. Separating the decision from the payment protects the buyer. It does not govern what an agent does before payment.

The inventory pattern is not new

Holding stock without buying it is not new. The pattern resembles what OWASP's catalog of automated threats calls Denial of Inventory: holding limited stock "without completing the purchase," preventing other users from buying it. Hoarding and seat spinning are among its other names, and bot-defense vendors were warning in the spring that buy-for-me agents could do it at scale.

What is new is the source. This came from a mainstream consumer agent following an ordinary instruction on a real account, not from a scripted bot.

I would not call it an exploit or an attack. The reporter used a normal feature, for a test, and The RealReal treated it as a use case to address. "Reservation loophole" is closer. The RealReal's terms of service, last updated in 2023, do bar robots and any use that could interfere with other users, but the company did not say Muse broke them, and its own CTO had described agents as welcome.

Why one-of-one inventory raises the stakes

In a replenishable catalog, a held unit usually has a twin on the shelf. At The RealReal, nearly every item is the only one, which is why its own discovery agent, Ask TRR, was built for one-of-one inventory. Ask TRR is The RealReal's agent, searching its own catalog. Muse is an outside agent acting for a shopper. The difference matters: one is a retailer's tool, the other arrives as a customer.

For a unique item, a hold is the entire supply for 20 minutes. Renewed again and again, it takes the item out of the market without anyone owning it. Not every add-to-cart has that effect. On a site without holds, or with deep stock, the same action costs nobody anything.

Five permissions, not one

An agent arriving at a store is asking for several permissions at once:

• Discovery: finding and recommending the product.
• Account access: logging in for the customer.
• Cart action: adding and removing items.
• Reservation: letting a cart take scarce inventory off the market, and how often.
• Purchase: submitting the order and starting payment.

The RealReal's response separates those permissions, although not through five individually documented controls. Discovery remains available, while account access, cart actions and checkout became more difficult for outside agents. The company has not explained whether reservation behavior is governed separately. It is a blunt instrument, and the same split could be drawn more finely.

Operator implications, not announced features

None of the following is something The RealReal has announced. These are the controls the case suggests for any store where a cart reserves inventory:

• Limits on how many holds one agent or account can place, and how often.
• No fresh start when the same item is re-added right after its hold expires.
• Shorter holds, or none, for agent-initiated carts on scarce or one-of-one items.
• Agent identity and attribution, so a store can tell an agent's cart from a person's.
• Activity the customer can see, so a shopper knows what their agent is holding.

Agent identity makes the other controls more precise. A retailer can apply account, session or traffic limits without knowing the agent, but verified identity lets it attribute behavior and enforce agent-specific rules. Walmart's model gives each outside agent its own profile, with limits, and Walmart's terms let it limit what agents may buy and how often, and require them to respect rate limits. Those published rules address purchases and request rates, not cart holds, and I would not assume they stop this pattern.

What the case shows

An AI shopping agent does not need payment authority to affect commerce. Where a cart controls scarce inventory, permission to add an item is already a form of economic authority. The RealReal has disclosed no financial impact from the test, and one reporter's experiment does not show widespread harm. It does show that retailer permission, the constraint I described in Meta's Muse numbers, has to be granted action by action rather than at the door.

If an agent can hold your scarcest inventory without buying it, which of your rules would notice?