The RealReal tightens bot defenses after AI agent cart-hold exploit
The RealReal updated its bot defense after The Verge showed Meta's Muse agent could repeatedly hold cart items, blocking other shoppers for hours.
The story in focus
The RealReal, a secondhand luxury consignment retailer, has updated its bot defense system after The Verge reported that Meta's Muse AI agent could exploit its 20-minute cart hold to block other shoppers for hours, The Verge reports. Chief technology officer Luke Friang said the new configuration makes it harder for all agents to log in, add items to cart, and check out.
- The Verge demonstrated that Meta's Muse agent could re-add The RealReal listings as each 20-minute cart hold expired, keeping items unavailable to other shoppers for hours or longer.
- The RealReal CTO Luke Friang said the retailer addressed that use case and that its bot defense configuration now makes it much more difficult for all agents to log in, add items to cart, and check out.
- Agents can still surface listings and direct Muse users to product pages, Friang said.
- Meta said on its Q3 earnings call that shopping was the most common use case for Muse so far, with purchases over $200 on average.
- Meta said 10 million people in the US had downloaded the Muse app in 40 days.
How the hold was exploited
On The RealReal's website, an item goes on hold and is unavailable to other customers for 20 minutes once it is placed in a cart, according to The Verge. The publication reported that it used Meta's Muse to instruct the agent to keep re-adding listings as soon as each hold expired, keeping products out of reach for hours or longer.
After the report was published, Friang said in an email that the company had addressed the Muse use case flagged by The Verge.
What changed and what agents can still do
Friang said the updated configuration makes it much more difficult for all agents to log in, add items to cart, and check out, according to The Verge. He said agents will still be able to surface listings from The RealReal and direct Muse users to product pages, and that the company will continue to strengthen protections as AI-powered online shopping evolves.
Meta did not immediately respond to a request for comment from The Verge.
Agentic shopping scale
Meta said on its Q3 earnings call this month that shopping was the most common use case for Muse so far and that purchases averaged over $200, The Verge reported. The company said 10 million people in the US had downloaded the app in 40 days.
The Verge noted that retailers, most notably Amazon, have blocked agents from shopping on their sites, citing potential disruption to their business.
Why did The RealReal change its bot defenses?
The Verge showed that Meta's Muse could keep re-adding items to a cart each time a 20-minute hold lapsed, blocking other shoppers for hours. The RealReal CTO Luke Friang said the retailer addressed that use case.
Sources & further reading
Help keep the record accurate. Send a correction.
