Resale Retailer: AI Agents Exploit 20-Minute Item Holds

Ten million Americans downloaded Meta’s Muse app within 40 days of its release, creating a massive pool of automated shoppers for online retailers. The RealReal, a secondhand luxury fashion consignment company, reported that this surge in traffic forced it to overhaul its digital defenses against artificial intelligence agents.

The company identified a specific vulnerability in its inventory management system. On The RealReal’s website, items placed in a shopping cart are reserved for that user for 20 minutes, preventing others from purchasing them. Reporters previously demonstrated that an AI agent could exploit this rule. The agent would re-add listings to the cart the moment the 20-minute window expired, keeping the items off the market for hours or even days.

This automated hoarding effectively locked up stock that human shoppers could not access. The strategy allowed a single user to hold multiple designer garments simultaneously without completing a transaction. The RealReal’s chief technology officer, Luke Friang, confirmed the company has since adjusted its bot defense configuration. Friang stated that the new settings make it much more difficult for agents to log in, add items to carts, or complete checkouts.

The update does not ban AI access entirely. Friang explained that agents can still display listings and direct users to product pages. However, the process for actually securing an item has become more complex for automated scripts. The company plans to continue refining these protections as AI-driven shopping becomes more common.

Meta, which developed the Muse assistant, did not immediately respond to a request for comment. During a third-quarter earnings call earlier this month, Meta identified shopping as the most frequent use case for the platform. The company noted that the average purchase amount through Muse exceeded $200. These figures suggest that automated buying is moving from a niche experiment to a standard consumer behavior.

The RealReal is one of several retailers addressing the impact of non-human shoppers. Large e-commerce players, including Amazon, have already restricted agent access to protect advertising revenue and customer relationships. The shift highlights a growing tension between retailers and the developers of AI assistants. As consumers rely more on these tools to execute purchases, companies must determine how much control to give machines over limited inventory.