AI is starting to shop for you. Here’s how Visa is making sure it doesn’t scam you

As autonomous AI agents increasingly browse, compare prices, and complete purchases on behalf of consumers, one challenge is becoming unavoidable for merchants: trust.

On Wednesday, Akamai Technologies announced a strategic collaboration with Visa aimed at addressing that problem. The partnership integrates Visa’s Trusted Agent Protocol with Akamai’s behavioral intelligence, allowing merchants to authenticate AI agents, link them to real consumers, and block malicious bot traffic before it ever reaches sensitive systems.

The move comes as agent-driven traffic floods the internet. According to Akamai’s 2025 Digital Fraud and Abuse Report, AI-powered bot traffic surged more than 300% over the past year, with the commerce industry alone seeing more than 25 billion AI bot requests in a two-month period.

“We all continue to be excited about the proliferation of agentic AI use cases,” said Patrick Sullivan, CTO of security strategy at Akamai. “We’re seeing billions upon billions of requests coming from agentic AI use cases.”

When AI becomes the intermediary

For decades, digital commerce has been built around a simple assumption: A human is on the other end of the transaction. Agentic commerce breaks that model.

Instead of navigating a merchant’s site directly, consumers increasingly rely on software to search, compare, and sometimes buy on their behalf. For instance, whereas previously buying a new suitcase might involve exploring a dozen retailer’s sites, soon you might have AI do the legwork for you. That shift introduces a new intermediary—one that can be helpful, harmful, or fraudulent.

“There’s a new entity that’s now sitting in between the merchant and the consumer,” said Rubail Birwadker, Visa’s global head of growth. “Things could go wrong.”

From a consumer standpoint, that raises questions about refunds, disputes, and chargebacks. Whose fault is it if you asked for a black bag and received a dark blue one by mistake? From a merchant perspective, it creates uncertainty around intent, legitimacy, and risk.

“If you’re a merchant, and you’re thinking about your website, there are a lot of changes coming your way,” Sullivan said. “You built your website originally in the era where there was going to be a human on the other end.”

Now, discovery may happen through an AI-powered chat interface. Browsing may be conducted by an autonomous agent. Even the browser itself may be software acting on behalf of a user.

“We need to make sure that it’s still on behalf of the right human and it’s not a fraudster taking advantage of some new evolution in technology,” Sullivan said.

Proving both the agent and the human

At the center of the Visa–Akamai partnership is a dual-identity problem: verifying not just who the human is, but who the agent acting for them is.

“It’s important for us to always know who the human is,” Sullivan said. “But then, as we see these agentic use cases emerge, it’s important for us to get signal from Visa of who that agent is in that interaction.”

Visa’s Trusted Agent Protocol provides authentication signals indicating whether an agent is authorized and whether it intends to browse or pay. Akamai reads and reinforces those signals using behavioral intelligence, often before traffic reaches a merchant’s core systems.

“You’re going to see traffic before it ever reaches a merchant system,” Sullivan said. “That allows us to build a trusted user profile so we can understand that Jim is actually Jim.”

Because Akamai sees end users repeatedly across the internet—shopping, banking, reading news—it can establish consistency and spot anomalies early in the transaction flow.

“That allows us to very, very early in the transaction reduce attempts at fraud and impersonation,” Sullivan said.

Scale changes the threat model

The surge in AI-driven traffic has raised concerns about whether volume itself becomes a security risk. Sullivan argues scale cuts both ways.

“We’ve seen AI bot traffic surge 300 plus percent this year,” he said. “But while the numbers are in the billions, that’s still sort of a rounding error for the overall traffic that we see.”

Still, Sullivan expects automation to accelerate abuse over time.

“Anything that can be automated, it’s just so much more profitable for attackers,” he said. “If you can automate your attack, you can pull off more attacks.”

That’s why both companies emphasize operating at global scale. Visa processes transactions across nearly 200 markets, while Akamai manages traffic and bots at internet-wide levels.

“These are two companies that operate at massive scale,” Sullivan said. “It’s companies like ours that we think will stand up to the pace of these automated processes.”

Why merchants matter most

While consumers may benefit immediately from smoother discovery and purchasing, Birwadker said the heaviest lift lies with merchants adapting their infrastructure.

“A large amount of change really lies on the acceptance side, on the merchant side,” Birwadker said. “Their infrastructure needs to keep up with all the changes that are happening.”

Merchants will need to decide what information agents can access, how pricing and inventory are exposed, and how loyalty and personalization work when an AI, not a browser, is driving the interaction.

“This is just keeping up with changes to consumer behavior,” Sullivan said. “They’re having an AI agent do something on their behalf.”

A compatibility play for the future

Neither Visa nor Akamai claims to know exactly what agentic commerce will look like three years from now. But both frame Trusted Agent Protocol as a compatibility layer—one that allows commerce infrastructure to evolve without losing control.

“Our goal is just to make sure that our ecosystem remains compatible with the agentic world,” Birwadker said. “It’s more about compatibility than about almost anything else.”

As AI agents move from novelty to necessity, that trust layer may determine whether merchants embrace agentic commerce—or shut it out altogether.