The RealReal Tightens Bot Defenses After an AI Agent Kept Renewing Cart Holds
The RealReal is updating its bot defense system to make it harder for AI agents to shop on its site, according to The Verge, which reported the change on 26 October 2026.
The core of the problem sits in the cart logic. When an item goes into a shopper's cart, The RealReal places a hold on it for 20 minutes, during which it is unavailable to other customers. The Verge used Meta's Muse, an AI agent, to re-add RealReal listings to a cart each time the hold expired, blocking other shoppers for hours or longer. The hold itself was not bypassed. It was renewed repeatedly by an agent that treated expiry as a cue to retry.
RealReal CTO Luke Friang said the company had addressed the Muse use case flagged by The Verge. The updated bot defense configuration, the company says, makes it much harder for all agents to log in, add items to cart and check out, not only Muse. Agents can still surface listings and direct Muse users to product pages. The boundary sits at the transactional steps, not at discovery.
Earlier, in a report published on 22 October 2026, The Verge quoted RealReal saying it sees AI agents as an opportunity and is investing in its own AI-powered services while protecting the integrity of its platform.
In my view, this episode shows where agentic commerce, in which software acts on a user's behalf, is likely to hit friction first. A timed hold assumes a human shopper who either returns to the cart or walks away. An agent running in a loop has no such pattern, and it can turn a per-user reservation into a lock on single-unit inventory. Resellers of one-of-a-kind goods are most exposed, since a listing with only one copy can be held indefinitely by a process that never intends to buy it. The cost falls on other shoppers, who never see the agent involved.
The broader context here is that the fix is blunt. Raising defenses for every agent, rather than only the offending one, gives up legitimate delegated shopping in exchange for predictable inventory behavior. Whether a platform can tell a well-behaved buyer's agent from a hold-hoarding one, using rate limits, session fingerprinting or authenticated agent identities, is an open engineering question that this announcement does not answer. The company's split between surfacing listings and gating checkout points to one practical answer: let agents search and link, and require a human-verified session for the final transaction.
That split also points to what could work. If agents can find inventory and hand a user off to a product page, the convenience of an assistant that locates the right item survives, and the marketplace keeps control of the step where stock is actually reserved. The RealReal's investment in its own AI services suggests it expects to compete for that intent directly rather than cede it. For developers building marketplaces, the useful lesson is not the 20-minute timer but the principle behind it: any reservation mechanism exposed to automated clients needs a limit on how often it can be renewed, and any marketplace that offers one should assume some client will test it.
