As consumers use AI agents for product recommendations and purchases, ecommerce platforms increasingly require agentic AI security to protect the business and its customers.
Agentic commerce is growing at a rapid pace: In the second quarter of 2026, AI-driven traffic to Shopify stores was up three times year over year, and Shopify data shows conversion from AI search is nearly 80% higher on product pages than traditional organic search. With significant growth in AI in ecommerce comes the need for business owners to prepare for agentic commerce’s unique security risks.
This guide defines agentic AI security, explores the security risks to navigate when incorporating AI agents, and explains the security controls store owners can implement to govern AI agents responsibly.
What is agentic AI security?
Agentic AI security is the practice of protecting systems that interact with AI agents from risks that can stem from external AI agents used to browse products and make purchases, as well as from internal agentic systems that handle real-time pricing, procurement, inventory management, or customer service.
Agentic AI security mitigates these risks. Here are some of the ways Shopify’s data and AI management settings are designed for secure transactions:
-
Private business data stays private. Third-party AI channels don’t have access to your full order history, orders from other sales channels, or your general customer database. For orders that originate in AI channels through direct checkout, order data (like name, address, order details) is shared with the AI channel.
-
Contractual protections with third-party AI vendors. Shopify’s relationships with third-party AI vendors are governed by contractual protections that restrict these providers from using Shopify or merchant data for any purpose other than providing services to Shopify and you, such as training their own or third-party models on your data.
-
Control over agentic partner data access. Store owners have per-partner controls in Shopify Admin to decide which agentic partners receive their product data from Shopify. For example, you can allow an agentic partner to access your product data via Shopify Catalog but send them to your storefront to complete checkout, allow agent partners to access product data and complete checkout for customers within the partner’s channel, or not allow either action.
-
Competitors don’t see your non-public data. Your non-public store data is not exposed to other Shopify store owners.
Key principles of agentic AI security
- Enforce least privilege access
- Create thresholds for human oversight
- Secure the action layer
- Monitor agent behavior continuously
- Establish zero trust between agents
- Validate agent inputs and outputs
*Disclaimer: These principles are general best practices for deploying agents in your business, reflecting some of how Shopify approaches its own agent development. For more details on Shopify's AI products and audited assurance programs, see our Help Center.
AI security systems designed with the assumption that agents will make mistakes, act on inaccurate data, and can be manipulated into unsafe behavior can help protect your business. Reducing risk depends on a system of layered protections, so that no single failure can result in catastrophic harm.
Here are six foundational principles for enhancing agentic AI security.
1. Enforce least privilege access
Give agents the minimum permissions needed to perform a specific task and nothing more. A customer service agent may need to read order histories, but it shouldn’t be able to access pricing systems or supplier records. A pricing agent may need to read competitor data and update product prices, but it doesn’t need access to payment records or customer PII.
Implementing least privilege access involves establishing strict permission levels for each agent before deployment and regularly auditing which systems agents are able to access as new tools and integrations are added.
2. Create thresholds for human oversight
Limit the actions AI agents can take without human approval. Defining clear approval thresholds helps ensure that higher-risk decisions receive additional review.
For example, a customer service agent may be authorized to issue refunds up to $50, or a procurement agent may be authorized to reorder standard stock items, but approving larger refunds or adding new suppliers requires human intervention for sign-off. Businesses may also require customers to confirm agent-driven purchases above a specified amount.
3. Secure the action layer
Setting clear limitations for AI agents isn’t enough if the systems they connect to are left unprotected. The action layer—APIs, automated workflows, and external integrations that agents use to perform tasks—can become a security risk if not properly controlled.
Common protections include rate limiting to prevent agents from making excessive API calls and temporary authentication tokens that reduce the risk of malicious agents reusing compromised credentials. Businesses may also place limits on the actions agents can perform. For example, a pricing agent should never be able to set a price to zero, regardless of what instruction it receives.
4. Monitor agent behavior continuously
Agents that function correctly today may be compromised or manipulated tomorrow. Use monitoring tools to compare agent activity against established behavior baselines and receive alerts when agents deviate from expected patterns.
For example, a customer service agent that suddenly begins accessing pricing APIs or a procurement agent that starts approving orders from new vendors at an unusual frequency should trigger immediate review by a human in the loop.
5. Establish zero trust between agents
A zero-trust approach requires AI agents to verify the identity, permissions, and authority of requests before acting on them, even when those requests originate from another AI agent.
This is especially important in multi-agent systems, where agents may pass instructions or requests between each other. Problems can occur when one agent automatically trusts information from another agent, as low-level agents can be used to manipulate AI systems with higher-level privileges (an example of a privilege escalation attack).
For instance, a customer service agent authorized to approve refunds under $50 may be manipulated into sending a refund request for $500 to a finance agent. If the finance agent automatically trusts the request, the larger refund may be approved without the appropriate review.
6. Validate agent inputs and outputs
Every customer message, product listing, supplier document, or third-party data source an agent receives is a potential risk. Likewise, every action an agent takes could expose sensitive data or trigger unintended outcomes. Businesses can reduce risk by screening all inputs before agents process them and validating outputs against known safe boundaries before they execute.
For example, automated screening systems can scan customer messages for attempts to invoke system commands, which may indicate a prompt injection attack. (A prompt injection attack is when someone attempts to trick an AI system into following malicious or unintended instructions.) Pricing agents can be prevented from approving new product prices that exceed minimum or maximum thresholds.
Routinely stress-testing validation systems can help ensure they continue to work as expected.
