RealReal tightens bot defenses after 20-minute exploit

Meta reported that 10 million users in the United States downloaded its Muse app within 40 days. This rapid adoption occurred just as the secondhand luxury retailer The RealReal moved to block AI agents from its site. The change follows recent reporting that identified a specific vulnerability in how the platform managed product availability.

On The RealReal's website, an item is reserved for a specific user for 20 minutes once it is added to a shopping cart. Previous testing by The Verge demonstrated that Meta's Muse could exploit this window. The AI agent was programmed to re-add listings to the cart immediately after the hold expired. This action prevented other customers from purchasing the stock for several hours. The RealReal's chief technology officer, Luke Friang, confirmed via email that the company addressed this specific issue.

Friang stated that the bot defense configuration now makes it much more difficult for agents to log in, add items to a cart, and complete a checkout. He clarified that agents can still display listings and direct users to product pages. The company plans to continue strengthening these protections as AI-powered shopping develops. Meta did not immediately respond to a request for comment regarding the update.

The shift in policy comes as technology firms market AI agents as personalized assistants for large consumer bases. Meta stated on its Q3 earnings call this month that shopping is the most common use case for Muse. The company noted that average purchases through the agent exceeded $200. These figures suggest a growing reliance on automated agents for direct transactions.

Retailers are beginning to adjust their strategies in response to this trend. Amazon has already restricted agent access to its platforms. Other businesses recognize that if humans access the web primarily through chatbots, the direct relationship between the company and the customer weakens. This dynamic could impact advertising revenue and other business models. The RealReal's move reflects a wider effort to maintain control over inventory and user experience.

The reserve system on used clothing sites assumes human indecision. A person is unlikely to spend hours manually re-adding items to a cart. An AI agent, however, performs this task without fatigue or hesitation. This capability places a new type of pressure on inventory systems. Consumers are just beginning to utilize these tools, while retailers work to adapt their security measures to match the speed of the technology.