Automation Is Not Intent: Measuring and Fixing Fraud-Model Failures on Legitimate AI Shopping Agents

Fraud models learned that "bot-like" means "risky": no mouse movement, instant form fills, headless browsers, datacenter IPs. AI shopping agents now make legitimate purchases with exactly these signals. We call this the bot-fraud conflation and measure it. We introduce AgentRisk, an open semi-synthetic benchmark of nine session classes, including four agent-era attacks: fraud via unverified agents, laundering through lax agent platforms, prompt-injection hijacking of a user's own agent, and signature spoofing. Agent telemetry is grounded in real measurements of the automation primitives agent frameworks use. At a 2% human decline rate, a standard gradient-boosted fraud model declines 94.6% of legitimate agent purchases. The obvious fixes each fail differently. Retraining on agent traffic creates a safe harbor: catch rate on fraud via agents falls from 98.4% to 53.6%. Allowlisting verified agents stops none of the laundering or hijacks. Agent-identity features make hijacks harder to catch (0.2%). Labeling agent-era fraud brings the false declines back. Identity standards say who acts, not for whom or within what scope. We propose AgentGate, a verify-scope-score policy combining agent identity, a delegation chain with credential binding, and mandate-consistency checks, with step-up instead of decline for unattested automation. It cuts false declines on verified agents to 1.7% and stops 92.7% of laundering and 70.2% of hijacks, none seen in training, with human-traffic performance unchanged. Sessions from a real production agent confirm the pattern: the legacy model declines 88.5% of them when cloud-hosted, while AgentGate declines 1.9% once they are verified. We release the benchmark, telemetry harness and evaluation protocol. Code and data: https://github.com/RishabhPande/agentrisk