F-Secure Built Its Own AI Shopping Agent to Test Whether the Category Can Be Trusted

Security researchers at F-Secure have built a working AI shopping agent and run it through adversarial scenarios to find where automated purchasing fails, publishing the results as part of the vendor's partner-insights series. The point was not to show off what the agent can buy, but to document what it gets wrong when it holds payment credentials, shipping details and live access to a merchant session.

Shopping agents are a different class of target than the chatbots most security teams have spent the past two years testing. To finish a transaction they need a stored card number, an address and an authenticated session, and they act without a person approving each step. That combination means a successful attack spends real money instead of merely producing a wrong answer, which raises the stakes on flaws the web has lived with for years.

The build-then-break approach is standard practice in security research, but it has been applied far more often to coding assistants and general-purpose models than to agents that check out. F-Secure's write-up focuses on failure modes that matter at the point of sale: manipulated product listings, instructions embedded in page text that an agent may read and obey, and the difficulty of establishing which merchant an agent is actually talking to.

The commercial context is what makes the findings worth reading now. Retailers and payment networks are already piloting transactions initiated by agents, and model providers have spent the past year shipping tool use and browser control as first-class features. Every added capability widens the surface an attacker can reach, and prompt injection defenses on the merchant side remain uneven across the industry.

F-Secure's framing places responsibility with the vendors deploying these agents rather than with shoppers, a position that cuts against how the products are marketed. Consumers are told an assistant will find a lower price or reorder a household staple; they are seldom told who pays when the agent is steered to a fraudulent seller or leaks a stored card number. Liability in agentic checkout is still largely undefined.

Standards work on agent identity and payment authorization is underway but incomplete, and there is no settled mechanism for proving that a given agent is authorized to spend on a user's behalf. Until that exists, each deployment is essentially its own experiment. F-Secure's full findings are available through its partner insights page, and the accompanying discussion thread remains open.