Agentic Commerce on Black Friday & Cyber Monday: What Retailers Need to Know

Most retail teams have Black Friday and Cyber Monday prep down to a routine, from load-testing their site to pushing paid media as far as the budget allows. What’s changed is who, or what, shows up once the sales start. This is the first holiday season where AI agents will play a meaningful role in how people shop online, with agent visits to retail sites more than doubling in a year. Agents shopping alongside humans affects conversion for ecommerce leaders and where ad spend lands for marketing teams. For analytics and CRO, it raises a harder question about whether peak-season data can be trusted at all.

This article breaks down the types of AI traffic now reaching retail sites and shares new findings from CHEQ’s Agentic Black Friday Report, including what the data shows about AI traffic during peak season and what it means for retailers trying to protect revenue, spend, and decision-making when the stakes are highest.

What Is Agentic Commerce?

Agentic commerce is shopping carried out by AI agents on behalf of a person. The shopper tells an AI assistant what they want, and the agent searches for products, compares prices, and, in some cases, completes the purchase without the shopper ever visiting the retailer’s site. This hybrid customer journey is one of the clearest examples of the agentic web, where AI agents browse and act alongside the people they work for. For retailers, this means some of the most valuable visitors during Black Friday and Cyber Monday won’t be people at all.

How is an AI shopping agent different from a bot?

A traditional bot performs automated tasks over a network, following rigid, pre-defined rules. Some are useful, like search crawlers or a retailer’s own price tracker. Others exist to cause harm, such as bots that try stolen passwords against customer accounts, test stolen cards at checkout, hoard limited inventory, or scrape pricing for a competitor. 

An AI shopping agent is a type of bot driven by a large language model. It reads a page, decides what to do next, and adapts as it goes, all on behalf of a real shopper who handed it a task, like finding an air fryer under $100. The complication is that agents can be authorized by a real customer, unauthorized, or spoofed by adversarial software posing as a known assistant, and all three can look the same on the surface. Retailers need to understand how to tell the difference to ensure trusted agents can shop and malicious agents get turned away.

Can AI agents make purchases on retail sites?

Yes, though it’s still early. Today, agents primarily do the research and hand the final decision back to the shopper, who clicks buy. However, this is starting to change. Visa and Mastercard have launched ways for verified agents to pay with a customer’s card within set spending limits, and Stripe and Google have built agent checkout into their platforms. Meta also launched Meta Muse, where the agent can check out with Link built by Stripe. With agentic commerce on the rise and here to stay, retailers need guardrails in place to handle this agentic traffic, both good and bad.

Why does agentic commerce matter during Black Friday and Cyber Monday?

Agentic commerce matters during Black Friday and Cyber Monday because the season is built around price comparison and limited-time deals, which is exactly the work shoppers are starting to hand off to AI agents. According to CHEQ’s Agentic Black Friday Report, AI agent visits to retail sites more than doubled year over year, and the retail industry now receives nearly 1 in 5 of all AI agent visits across the entire CHEQ network. 

These buyers also arrive with intent and are higher-converting. More than half of agent visits to retail sites land on search results, product and pricing pages, or category listings, and nearly 1 in 25 reaches the cart or checkout. Adobe’s May data backs this trend up, finding AI-referred traffic converts 54% better than non-AI channels. Retailers who can recognize legitimate agents can capture those sales. Those who can’t risk blocking buyers or letting malicious activity through during the busiest period of the year.

What Types of AI Traffic Visit Retail Sites During Black Friday and Cyber Monday?

AI traffic reaches retail sites in four main forms, including AI shopping agents, AI referrals, LLM crawlers, and unauthorized scrapers. Each one shows up alongside your human customers during Black Friday and Cyber Monday, and each calls for a different response. Some of this traffic is worth welcoming, some is worth managing, and some should be kept out entirely.

• AI shopping agents: AI shopping agents are AI tools that research products, compare prices and, in some cases, complete purchases for a real person.
• AI referrals: AI referral traffic comes from people who ask an AI assistant a question, read the answer, and click through to a retailer’s site. The agent or assistant does the early research, then hands the decision back to the shopper.
• LLM crawlers: LLM crawlers are automated tools that fetch content from websites to train AI models, build search indexes, and generate answers. They’re how your products end up in AI responses when shoppers ask where to find a deal. CHEQ’s report found AI crawler traffic grew roughly fourteenfold between June and August 2026. There’s an important caveat, though. A single operator drove 96% of that increase, making it a good reminder that headline AI traffic numbers are often dominated by one or two very large crawlers.
• Unauthorized scrapers: Unauthorized scrapers are bots that pull pricing, inventory, product content, and promotions from a retail site without permission. During Black Friday and Cyber Monday, competitors use them to undercut prices and resellers use them to track limited stock, often timing their activity to match a retailer’s price changes. Many disguise themselves as legitimate crawlers or ordinary browsers.

How Much of Black Friday Retail Traffic Is Invalid?

Invalid traffic, often called bot traffic, is any visit that doesn’t come from a real shopper or a legitimate source acting for one, including scrapers, malicious bots, and spoofed identities. CHEQ’s data shows summer 2026 invalid retail traffic at 20%, which is up from 7.1% of retail visits during Black Friday 2024 and 11.7% during Black Friday 2025. That’s nearly triple what retailers saw two seasons ago. And in November 2025 alone, retail sites on the CHEQ network absorbed 382 million invalid visits, with roughly 13 million of those coming through paid channels.

Attackers plan around the same retail calendar you do. As peak season brings more traffic, busier teams, and plenty of unusual activity that’s easy to explain away, it becomes the perfect time for invalid traffic to hide. Last year, between September and November, invalid visits to retail sites grew 64% while total traffic grew 16%. In other words, invalid traffic grew about four times faster than real traffic heading into the peak.

Here’s what that can look like in dollars. Imagine a hypothetical retailer that spends $500,000 on paid media during Black Friday and Cyber Monday. CHEQ found that 1 in 12 paid retail visits is still invalid after the ad platform’s own filtering, which means roughly $41,700 of that budget would go to clicks that were never going to convert. Those same fake visits then feed the bidding algorithms, steering the rest of the budget toward more traffic like them.

How Can Retailers Tell Good AI Traffic From Bad?

Retailers can tell good AI traffic from bad by establishing three things about every visit. These are the entity, the identity, and the intent. All three have to be established together, from evidence rather than from what the traffic claims about itself. Get one wrong and the result is a confident mistake, whether that’s a blocked customer, a polluted ad audience, or an attacker waved through at checkout.

Entity

The entity is what’s technically present on your site, whether that’s a human, an AI agent, an LLM crawler, a scraper, or an attack tool. This used to be easy to read, because browsers and crawlers announced themselves in user-agent strings. That honor system has broken down. Many legitimate AI agents now run inside standard browser engines and look like ordinary Chrome at the network level. CHEQ resolves the entity from evidence, such as client-side signals and deterministic markers of agent activity, rather than taking the traffic’s own label at face value.

Identity

Identity is who or what the visitor actually is, verified rather than claimed. It matters because declared AI agent identity now fails in both directions. The traffic retailers want typically doesn’t announce itself, and the traffic they don’t want often announces itself falsely. According to CHEQ’s Agentic Black Friday Report, 1 in 7 invalid visits to retail sites involves False Representation, known as user agent spoofing. A scraper can call itself a known AI crawler, and a bot can present as a regular shopper. Verification is what separates a real agent acting for a real customer from automation dressed up as one.

Intent

Intent is what the visitor came to your site to do, read from how it behaves once it arrives. The same entity can show up with very different goals. An automated session that touches login, account and checkout pages might be a customer’s agent completing a purchase, or it might be an account takeover attempt. The behavior looks alike while the intent is opposite. CHEQ reads intent from on-site activity so retailers can let verified agents finish what they came to do, keep invalid traffic out of analytics and ad spend, and route malicious sessions to security controls.

Turning visibility into policy

Knowing the entity, identity, and intent of every visit is only useful if it shapes what happens next. That’s where policy comes in. Once retailers can see their traffic clearly, they can set rules for each type of visitor, such as letting verified agents complete checkout, limiting how often crawlers fetch high-traffic pages, keeping invalid visits out of analytics and ad audiences, and routing suspicious sessions to security. CHEQ applies those policies in real time on every visit, so the decision follows the evidence instead of a blanket rule that was set months earlier.

How Should Retailers Prepare for AI Traffic Before Black Friday?

The best time to get a handle on Black Friday AI traffic is before the peak, when there’s still room to adjust budgets, rules, and reporting. Retailers should check these boxes before Black Friday’s agentic traffic rush:

1. Know your current traffic mix: Get a clear breakdown of humans, AI agents, crawlers, and invalid traffic on your site today. If you can’t see it now, you won’t see it at its peak.
2. Audit your existing blocks: Look at challenge pages, rate limits, and bot rules to make sure they aren’t quietly turning away legitimate agents.
3. Get an independent read on paid traffic: Measure invalid clicks by channel with a source outside the ad platforms, and set BFCM budgets based on that number.
4. Protect what your algorithms learn from: Filter invalid visits out of analytics, bidding, and audience data so peak-season optimization is built on real shoppers.
5. Put marketing and security on the same page: Agree on how to handle each type of visitor before Cyber Week, so blocking decisions aren’t being debated mid-sale.
6. Stress-test your detection: Make sure it stays accurate at several times normal volume, when traffic patterns change by the day.
7. Confirm your detection keeps up: Ask whether your tools can recognize a brand-new agent or one that looks like ordinary Chrome. A static list of known bots won’t be enough.

Even if some of these land after your change freeze, they’re still worth doing. Peak season produces your most valuable data of the year, and agent traffic will keep growing well past Cyber Monday.

Frequently Asked Questions

How will AI agents change consumer shopping behavior on Black Friday?

More shoppers will hand off deal hunting and price comparison to AI agents. CHEQ’s Agentic BFCM Report found agent visits to retail sites more than doubled year over year, with over half landing on search results, product pages and pricing pages. Most journeys this season will still end with a person clicking buy, so retailers should expect more shoppers arriving already researched and ready to decide.

Should retailers block all automated traffic?

No. Blocking everything automated turns away AI agents shopping for real customers, and blocking LLM crawlers can keep your products out of AI answers. A better approach is to segment traffic, let verified agents through, manage crawlers, keep invalid traffic out of your data and ad spend, and stop malicious sessions.

Do ad platforms filter out invalid traffic?

They filter some of it. Ad platforms and analytics tools mostly catch traffic that identifies itself, like declared crawlers and known bad IP addresses. What they miss is traffic designed to look like a real customer. CHEQ found that 1 in 12 paid visits to retail sites is still invalid after the platforms’ own filtering has been applied. During Black Friday and Cyber Monday, that means paying peak CPCs for clicks that were never going to convert, and training bidding and audience tools on visitors who don’t exist.

Wrapping Up: Taking Control of Your Agentic Traffic This Black Friday

This Black Friday and Cyber Monday, the question isn’t whether AI traffic will reach your site. It’s already there, and growing fast. Agent visits to retail sites have more than doubled in a year, and invalid traffic is close to 20% heading into the season. Retailers who treat all automation the same will either turn away real buyers or let scrapers and fraud through at the moment it costs the most.

The retailers who come out ahead will be the ones who can verify what every visitor is, who it’s acting for, and what it’s trying to do. That’s the job CHEQ Agent Intent was built for. It gives every visit a single verdict based on entity, identity, and intent, so your teams can let verified agents buy, keep invalid traffic out of your ad spend and analytics, and stop malicious sessions before they reach checkout.