November 2026 Summaries

AI shopping agents can research products, fill carts, and complete purchases for users, creating a challenge for retailers that must distinguish legitimate customer-authorized automation from fraudulent bots. Black Friday increases the urgency as agent-driven commerce and AI-agent traffic grow, while bots reportedly account for more than half of web traffic and can mimic legitimate agents. Traditional bot detection is insufficient because it identifies automation without determining the agent’s identity, authorization, intent, or the person it represents, leaving retailers to balance lost sales against risks such as account takeover, card testing, promotional abuse, and chargeback disputes. Socure promotes its Agent Intelligence product as a three-layer approach involving agent detection, a risk-based TrustScore, and a forthcoming credential intended to connect agents with verified principals and approved actions. The proposed retailer response includes revising bot rules to permit trusted agents, applying agent-level risk decisions, linking orders to underlying identities and fraud histories, and retaining records of customer authorization for disputes.

A reported $6.3 billion theft from Binance wallets, described as the largest crypto heist to date, was attributed by Binance to North Korean-linked attackers who used a months-long social-engineering campaign rather than directly targeting wallets. The operation reportedly began with a compromised download reached through a malicious search advertisement, which helped attackers identify employees with access to wallet-related systems, followed by an elaborate fake recruiting process involving fabricated LinkedIn contacts, HR staff, executives, and a company to persuade an engineer to open a malicious coding assignment on a work laptop. Binance says the attackers then leveraged an internal AI tool to move across devices and systems, illustrating how fake recruiters can be as significant a workforce-security threat as fake job candidates. The account argues for repeated identity verification at hiring, access, financial, system-change, and external-software-request stages, alongside stronger access controls so that a single compromised device cannot expose critical infrastructure; it also advises job seekers to independently verify recruiters and avoid running assignments on work computers.

New York’s SAFE for Kids Act, effective January 25, 2027, is prompting companies beyond traditional social media to reassess age-assurance systems as social and personalized features expand into gaming, payments, marketplaces, and other services. The rules define potentially regulated addictive feeds by their use of user-generated content, personalized ranking based on persistent user or device information or past interactions, and a threshold requiring such feeds to account for at least 20% of user time spent on a platform during a selected six-month period. Similar requirements are emerging internationally through the UK Online Safety Act, EU age-verification initiatives, and U.S. COPPA guidance, though standards for evidence, consent, and data handling differ by jurisdiction. The passage argues that platforms need configurable age-assurance workflows that can apply low-friction signals first and escalate, when necessary, to methods such as age estimation, document checks, or guardian consent, rather than using either self-reported birth dates alone or universal high-friction verification.

As AI agents increasingly search, compare, and purchase products on consumers’ behalf, marketplaces risk losing transactions if traditional bot and fraud controls mistakenly block legitimate automated activity. The proposed approach has three parts: distinguish authorized AI agents from malicious bots and human users by assessing identity, behavior, and risk rather than automation alone; establish persistent agent identities linked to verified individuals or businesses through an extension of KYC and KYB practices called Know Your Agent; and evaluate each agent’s authorization and fraud risk at the point of action, especially for sensitive activities such as high-value purchases, refunds, account changes, and access to personal data. The passage argues that marketplaces that can support trusted agent-driven transactions while maintaining fraud controls may gain a competitive advantage as consumers increasingly delegate commerce decisions to AI agents, and it presents Socure’s Agent Intelligence and Agent TrustScore as tools intended to support this process.