Overview
The RealReal, a secondhand luxury fashion retailer, has updated its bot defence systems following a demonstration by The Verge that Meta’s Muse AI agent could be weaponised to monopolise product listings. By instructing Muse to continuously re-add items to a shopping cart every 20 minutes — the duration of The RealReal’s hold policy — a single agent could prevent other shoppers from purchasing those items indefinitely. The retailer’s CTO confirmed the update specifically addresses the Muse exploit vector, though the changes also restrict AI agent access more broadly.
While this incident did not involve a traditional vulnerability in the cryptographic or code-injection sense, it represents a significant and reproducible abuse of agentic AI capabilities against a live commercial platform — a threat class that is expected to grow as AI shopping agents become mainstream.
Technical Analysis
The attack chain is straightforward but impactful:
- Cart hold mechanism: The RealReal places a 20-minute exclusive hold on any item added to a user’s cart, preventing other buyers from purchasing it during that window.
- Agent loop: Meta’s Muse was instructed to monitor the cart hold timer and re-add the same listing immediately upon expiration, resetting the 20-minute clock.
- Effective DoS: Because the agent could operate autonomously and continuously, it created a near-permanent hold on targeted items — functionally a denial-of-service attack against other shoppers competing for the same listings.
No prompt injection, credential theft, or system compromise was required. The agent simply used the platform’s legitimate API surface in an unintended, high-frequency loop. This is a classic example of excessive agency — an AI agent with sufficient tool access and minimal guardrails executing actions with disproportionate real-world impact.
Framework Mapping
- AML.T0103 (Deploy AI Agent): Muse was deployed as an autonomous shopping agent with persistent task execution against a live retail platform.
- AML.T0094 (Delay Execution of LLM Instructions): The agent’s loop effectively exploited timing mechanics, re-triggering actions at precise intervals.
- AML.T0047 (AI-Enabled Product or Service): Muse, as a commercial AI agent product, was the primary tool enabling the abuse.
- LLM08 (Excessive Agency): The core OWASP risk — the agent was granted sufficient autonomy to cause material harm to third parties without human approval per action.
- LLM04 (Model Denial of Service): The outcome, from the platform’s perspective, was a denial of service against legitimate shoppers.
Impact Assessment
The immediate impact was on competing shoppers who were unable to purchase held items. At scale, this technique could be used to corner limited-supply inventory — a significant concern for luxury resale, ticket platforms, limited-edition retail drops, and any marketplace with time-gated cart logic. The economic incentive for abuse (securing scarce goods, disrupting competitors) is clear and growing as AI agents are deployed by consumers and businesses alike.
Mitigation & Recommendations
- Rate-limit cart add/remove actions per session, IP, and account to detect and throttle automated loops.
- Implement agent fingerprinting to distinguish AI agent sessions from human browser sessions, applying stricter hold policies to detected agents.
- Review cart reservation logic for abuse potential; consider reducing hold durations or invalidating holds on repeated re-additions.
- Apply behavioural anomaly detection to flag accounts that repeatedly re-add the same SKU at consistent intervals.
- Define explicit AI agent policies in Terms of Service and enforce them technically, not just legally.