The RealReal updates bot protections to block autonomous AI agents from hoarding luxury inventory

Luxury consignment marketplace The RealReal has reconfigured its web application firewalls and anti-bot defenses following reports that shoppers were using autonomous artificial intelligence agents to indefinitely hoard unique secondhand designer inventory. The engineering update introduces aggressive session expiration rules and behavioral verification challenges specifically tuned to detect and terminate automated purchasing bots.

The vulnerability arose from The RealReal's conventional checkout reservation system, which grants a shopper an exclusive 20-minute hold on an item placed in their cart. While designed to prevent checkout collisions on one-of-a-kind vintage luxury apparel, tech-savvy buyers realized they could task autonomous browser agents—including Meta’s open-weights Muse model and custom Chromium automations—with monitoring rare items. The agents were programmed to release and instantly re-add the same garment every 19 minutes, locking human shoppers out of buying coveted pieces for hours or even days.

Under the newly implemented safeguards, The RealReal actively tracks rapid drop-and-re-add cycles on identical SKUs across registered accounts and IP subnets. Speculative carts are automatically released without a cooldown buffer, and suspicious session tokens trigger biometric or hardware-backed CAPTCHA challenges before cart extensions are permitted.

The incident highlights the growing friction between consumer-facing agentic software and legacy e-commerce transaction architectures. As personalized AI agents transition from generating text to executing autonomous economic actions, online retailers are being forced to distinguish between legitimate high-intent human shoppers and algorithmic agents gaming reservation queues.

Sources

1. [src-theverge-realreal-bots] The RealReal won’t let AI agents hog designer clothing