May 4, 2026

Agent Spoofing: 80% of retail sites are unprotected

CYBERSECURITY

CYBERsEcuritY

Read

3min

Agent-spoofing

Agent Spoofing: 80% of retail sites are unprotected

What is agent spoofing?

It is a malicious bot that impersonates an AI agent, a search engine crawler, a price comparison tool, etc., in order to bypass the security of an online retail site.

By gaining unrestricted access, the bot can, for example, scrape information or manipulate SEO data. With the proliferation of AI agents, this identity spoofing has become the most difficult attack vector to detect.

Key figures

Joint study by DataDome / Botify / AWS / Retail Economics (6,000 consumers in the UK, US, and France), published in late February 2026:

80% of retail sites are not protected against agent spoofing
80% of AI agents do not correctly identify themselves to the sites they visit
AI bot activity on retail sites increased fivefold in 2025
38% of consumers use an AI assistant during their online shopping journey

Direct consequences for retailers: distorted analytics, inflated AI referencing signals, biased commercial decisions, and greater exposure to fraud.

The technical reality

The two traditional methods for distinguishing a legitimate agent from an impersonator, the User-Agent header (a text string indicating the client’s name and version) and the IP range (the network address of origin), are no longer sufficient to identify the nature of the connecting user.

The User-Agent is simply a self-declaration: any malicious bot can present itself as a known AI agent with a single line of code.
AI agents are deployed on shared cloud infrastructures, AWS, Azure, Google Cloud, where thousands of legitimate and malicious services share the same address blocks, which change constantly through dynamic allocation.

The emerging industry response is based on a principle borrowed from digital signatures: HTTP Message Signatures (RFC 9421).

The agent cryptographically signs each outgoing request with a public key exposed at a canonical URL. The origin validates the signature server-side, ensuring the identity of the sender.

For 80% of retailers, now is the time to audit their Bot Management and WAF solutions, identify signed agents, and apply precise security rules based on their nature.

For merchants engaged in a UCP (Universal Commerce Protocol) approach, these signatures are rapidly becoming the standard of trust.