Why is an agentic commerce transaction still so difficult?
Agentic commerce success rates are all over the map.
In our own testing at Skyfire, we’ve seen merchants where AI agents successfully complete more than 90% of attempted transactions. At others, success rates hover between 30% and 40%. And at some merchants, agents fail 100% of the time.
Perhaps even more frustrating, success is often non-deterministic. An agent can successfully complete a purchase one day, only to be blocked attempting the exact same transaction the next.
Same merchant. Same agent. Same customer. Different outcome.
And we’ve observed something even more concerning: agent success rates can actually decline over time.
As personal agents operate at greater scale, their traffic patterns become increasingly recognizable to security providers. Behaviors that initially pass undetected can eventually trigger bot detection and fraud prevention systems as those systems learn to identify the traffic.
In other words, the more successful an agent platform becomes at scaling its traffic, the more likely its agents may be to encounter blocks.
Why is this happening?
The answer lies in 30 years of internet security infrastructure designed around a fundamental assumption: the legitimate customer is a human operating a browser.
That assumption is now breaking.
Introducing the Agentic Commerce Gauntlet
When an AI agent attempts to purchase something on the open web, it doesn’t simply navigate to a website and click checkout.
It must survive a gauntlet of security technologies, each independently deciding whether the traffic should be trusted.
Consider the layers an agent might encounter:
- CDN and Web Application Firewall (WAF)
Before an agent even reaches a merchant’s website, providers like Akamai, Cloudflare, Imperva, and F5 may inspect its traffic. Automated behavior, unusual request patterns, or unfamiliar browser characteristics can trigger a block.
- Bot Management
Specialized bot detection providers like Datadome analyze whether traffic is human or automated. The irony? An AI agent is supposed to be automated. Yet these systems have historically been designed to distinguish desirable human traffic from potentially malicious automation.
- CAPTCHA and Behavioral Challenges
An agent that passes the first two layers might encounter hCaptcha, reCAPTCHA, or another challenge designed to prove that a human is present.
- Login and Account Security
If the agent needs to authenticate, another set of security systems comes into play. Account takeover detection, device fingerprinting by providers like Fingerprint, behavioral analytics like Biocatch, and identity verification from IDV players like Trulioo and Proof may challenge or reject unfamiliar access patterns.
- Merchant Fraud Prevention
Even after successfully navigating the website, the agent may be evaluated by fraud and risk providers like Forter. These systems assess whether a transaction is legitimate, often relying on signals that look very different when an AI agent is operating on behalf of a customer.
- Checkout and Payment Providers
Payment service providers and checkout platforms introduce additional risk controls, authentication requirements, and transaction validation.
- Card Networks and Issuing Banks
Finally, a successful checkout submission doesn’t guarantee a successful purchase. Card networks and issuing banks have their own fraud models and authorization logic.
An agent can pass every preceding checkpoint and still have the payment declined.
The worst part is that failure rates in the gauntlet compound:
The Compounding Problem: 85% Success Becomes 32%
Here’s what makes the Agentic Commerce Gauntlet particularly difficult.
Each provider operates with its own security models, signals, and decision-making processes. Passing one layer doesn’t necessarily improve an agent’s chances of passing the next.
Even relatively high individual success rates can compound into poor end-to-end performance.
Hypothetical: Imagine an agent must pass seven independent checkpoints, each with an 85% success rate.
The probability of completing the entire journey is:
0.85⁷ = 32.1%
Even if every security provider independently approves 85% of legitimate agent traffic, only about one in three attempted transactions would successfully make it through all seven layers.
This is an illustrative calculation assuming independent decisions, rather than a measured industry-wide outcome. Real-world results depend on which controls apply, how their decisions correlate, and how retries are handled.
But the principle matters: agentic commerce is only as successful as the complete transaction journey, not any individual checkpoint.
It also helps explain why results can be inconsistent. Dynamic fraud scores, changing bot detection thresholds, session behavior, and transaction-specific risk signals can produce different outcomes across seemingly identical attempts.
The Scaling Paradox: Why Agents Can Become Less Successful Over Time
One of the more surprising findings from our testing at Skyfire is that personal-agent success rates don’t necessarily improve as agents become more capable.
In some cases, we’ve seen the opposite.
As agent traffic scales, success rates can deteriorate.
Early on, a personal agent might successfully navigate a merchant’s website. Its traffic is relatively unfamiliar, and its behavioral patterns may not yet trigger the merchant’s security controls.
But as more agents from the same platform begin interacting with websites, recognizable patterns emerge.
Security systems can begin identifying common characteristics across sessions: browser fingerprints, navigation patterns, request timing, infrastructure, and other signals associated with automated traffic.
What previously looked like an isolated browsing session starts to look like a coordinated source of automation.
And the security infrastructure responds exactly as it was designed to: by challenging or blocking suspicious traffic.
This creates a troubling dynamic for the agentic commerce industry.
The more agent platforms scale, the more identifiable their traffic becomes. And the more identifiable their traffic becomes, the greater the risk of being blocked.
It’s an arms race that agents cannot reliably win by simply becoming better at imitating humans.
Even improvements in reasoning, browser navigation, and task execution don’t solve the underlying problem.
The agent still lacks a trusted way to identify itself as legitimate.
Why Agents Pretending to Be Humans Isn’t the Answer
Today’s agents often attempt to navigate this infrastructure by behaving more like human browsers.
They use browser automation, manage cookies, maintain sessions, and attempt to interact with websites in ways that resemble human activity.
But there’s a fundamental problem with this approach.
The more an agent tries to look human, the harder it becomes for security providers to distinguish legitimate agents from malicious bots.
And merchants have legitimate reasons to be cautious.
Without reliable identity and authorization signals, a merchant may not know:
- Which agent is accessing its website, or which platform operates it.
- Which customer the agent represents.
- Whether that customer actually authorized the activity.
- What actions the agent has permission to perform.
- Who should be accountable when something goes wrong.
Some merchants may actively want to accept agents but find their existing security infrastructure blocks them.
Others may deliberately restrict agent access because they cannot establish trust or preserve visibility into the customer relationship.
Both problems stem from the same missing ingredient.
Identity.
Solving the Gauntlet With Know Your Agent (KYA)
Instead of asking AI agents to masquerade as humans, what if agents could identify themselves and prove they were acting on behalf of an authorized customer?
That’s the premise behind Know Your Agent (KYA).
KYA is a cryptographically verifiable identity token that can accompany an agent’s requests, providing security providers with trusted information about the agent, its operator, and the end user. Where supported, additional authorization signals can establish the actions the agent is permitted to perform.
Importantly, KYA doesn’t require merchants to replace their existing security infrastructure.
It gives that infrastructure something it’s been missing: a standardized way to recognize and evaluate legitimate AI agents.
Consider how this changes the Agentic Commerce Gauntlet.
At the network edge, participating providers such as Akamai, F5, DataDome, and Fastly can consume KYA signals and make informed access decisions instead of relying exclusively on whether traffic resembles a human.
At login, identity and account security providers can use verified agent identity and user authorization to distinguish legitimate delegated access from potential account takeover.
At checkout, fraud providers such as Forter can incorporate KYA into their existing risk models, helping distinguish authorized agentic purchases from suspicious automation.
At the payment network, Skyfire’s work with Mastercard creates an opportunity for agent identity and authorization signals to support better-informed payment decisions, including at issuing banks.
The result is not a bypass of security. It’s better security decisions, made with better information, at every layer (Without requiring a technical lift from the counterparty that matters the most… the merchant!)
From Seven Independent Decisions to a Shared Trust Signal
The real opportunity is bigger than improving one merchant’s checkout conversion.
Today, every security provider effectively has to rediscover whether an agent is legitimate.
A bot manager evaluates the agent. An account security provider evaluates it again. A fraud provider evaluates it again. And the payment ecosystem performs its own assessment.
KYA creates a common trust signal that can be consumed throughout that journey.
Each provider retains control over its own policies and risk decisions. But instead of starting from zero, participating providers can evaluate verified identity and authorization information alongside their existing signals.
For merchants, that means a path toward accepting legitimate agents without weakening security controls.
For agents, it means fewer unnecessary blocks, fewer retries, and a more predictable shopping experience for customers.
For consumers, it means their authorized agents can actually complete the tasks they’ve been asked to perform.
And for security providers, it means they can continue doing what they do best: protecting merchants and customers while recognizing a new category of legitimate internet traffic.
The goal isn’t to eliminate the seven layers of security or bypass with a new Protocol. It’s to give each of these layers the signals they’re used to using in their existing risk engines.
Agentic Commerce Needs Infrastructure, Not Workarounds
At Skyfire, we’re working with a growing network of security, identity, fraud, and payment providers to make KYA a common trust layer for agentic commerce.
KYA has already been used across more than 2 million agent transactions, and the KYAPay token specification has been published as an active individual Internet-Draft at the Internet Engineering Task Force (IETF).
The specification defines an interoperable token format for agent identity and payment information, allowing different providers to consume trusted signals using a common structure.
You can review the publicly available specification here:
https://datatracker.ietf.org/doc/draft-skyfire-oauth-kyapay-token/
This is an important step toward making agent identity interoperable across the existing internet infrastructure.
We’re entering a world where millions of AI agents will browse, authenticate, shop, and transact on behalf of consumers and businesses.
The internet’s security infrastructure shouldn’t have to choose between blocking these agents and abandoning decades of hard-won fraud prevention.
It needs a way to tell the difference between a legitimate agent and a malicious bot.
And it needs to make that distinction consistently, whether an agent is completing its first transaction or its millionth.
The future of agentic commerce isn’t about teaching agents to look more human. It’s about giving the internet a way to trust them as agents.
That’s how we get through the Agentic Commerce Gauntlet.
