The RealReal tightens login protocols to restrict AI agent shopping

The RealReal has updated its bot defense configuration to make it more difficult for artificial intelligence agents to log in, add items to shopping carts, and complete checkouts. The change follows reporting that identified a specific exploit involving Meta’s Muse application. The company stated that while agents can still display listings and direct users to product pages, the process of securing an item for purchase has become more complex for automated software.

The update addresses a gap in the retailer’s item reserve system. On The RealReal’s website, placing an item in a cart places it on hold for 20 minutes, during which time other customers cannot purchase it. Previous reporting demonstrated that an AI agent could be instructed to re-add listings to a cart immediately after that 20-minute window expired. This automated loop effectively blocked human shoppers from buying specific designer items for hours or longer.

Luke Friang, the company’s chief technology officer, confirmed via email that the team had addressed the specific use case involving Muse. He noted that the new bot defense rules apply to all agents, not just those from Meta. The company said it will continue to strengthen its protections as AI-powered online shopping practices evolve.

Meta, which developed the Muse app, did not immediately respond to a request for comment. In its third-quarter earnings call this month, Meta identified shopping as the most common use case for Muse. The company reported that the average purchase made through the app was over $200. Meta also disclosed that 10 million people in the United States downloaded the app within 40 days of its launch.

Technology firms are marketing these agents as always-on assistants that can schedule meetings and purchase goods on behalf of users. However, the rise of automated shopping has raised questions for retailers regarding their relationship with customers and their advertising revenue. Some major retailers, including Amazon, have already restricted agent access to their sites to protect their business models.

The RealReal’s move highlights the friction between human-designed inventory systems and automated purchasing behavior. A human shopper typically has a natural limit on how long they will hold an item in a cart while deciding whether to buy it. An AI agent does not have this hesitation and can maintain a hold indefinitely by repeating the checkout process. The RealReal’s new system aims to close that gap by adding barriers to the login and cart-addition steps.