Agent Checkout Traps

Agent Checkout Traps - A crash test for AI shopping agents: does your agent pay more than you approved? People are starting to let AI agents shop and book for them. Websites can trick an agent the same way they trick people. Agent Checkout Traps is a fictional shop (Pebble & Pine) with one normal checkout and four trick checkouts: a price that jumps at review, a pre-checked paid add-on, a quietly swapped size/pack, and a look-alike payment page on another hostname. An AI browser agent is sent through each. The shop records on the server what was really ordered, what was paid, and where the card was typed, and grades pass/fail. Failures get a plain-English report, and the agent retries on a variant it has not seen. The run ends with an honest full / partial / no pass. Only a full pass gets a mock signed badge, clearly labeled DEMO. Problem: There is no simple, repeatable way to check whether a shopping agent will overpay, buy the wrong thing, or hand a card to the wrong site before you trust it with your money. How it works: Python stdlib web shop + server-side scoring; Browser Use drives a headless Chrome with an LLM; loop_demo.py runs test -> report -> re-run on an untried variant -> honest ending; passkit.py issues an Ed25519-signed mock badge with a throwaway key generated locally; verify_pass.py checks it. selftest.py proves the shop and loop logic with scripted no-LLM clients (passes). Results (from our own rehearsal runs, Oct 26, 2026, google/gemini-3.1-flash-lite): On the full set the agent failed the price-jump and look-alike-payment traps on the first try. After the feedback report it cleared both in 2 of 3 full runs (full pass); in the 3rd, the payment-page trap still failed (partial pass). Small sample. Tech stack: Python 3, stdlib http.server, Browser Use 0.13.11, Playwright/Chrome (headless), cryptography (Ed25519), Gemini API (runs so far); Muse Spark / Llama via OpenAI-compatible API (coded, untested). What's next: Run the full test on Muse Spark and Llama models; add more trap types (e.g. auto-renew or membership-only prices, fake urgency); publish dated reports for shopping-agent makers; let real stores verify a pass before letting an agent check out.