--- title: "Attackers faked checkout through a 49,000-store Shopify app as Amazon and eBay block AI shopping agents" description: "Amazon, eBay and the big banks are shutting AI shopping agents out; Shopify let them in and RBC lifted its target into the November 3 print. Days earlier, attackers used Shopify's trusted app settings to fake checkout, and the cost landed on merchants, not the platform." publisher: "The Inference" section: "Platforms" published: 2026-10-19T16:12:22.466Z modified: 2026-10-19T16:12:22.466Z canonical: https://theinference.org/article/attackers-faked-checkout-through-a-49-000-store-shopify-app-as-amazon-and-ebay-block-ai-shopping-agents language: en keywords: "AI Agents, Cybersecurity, E-commerce, Shopify, RBC Capital Markets" --- # Attackers faked checkout through a 49,000-store Shopify app as Amazon and eBay block AI shopping agents > Amazon, eBay and the big banks are shutting AI shopping agents out; Shopify let them in and RBC lifted its target into the November 3 print. Days earlier, attackers used Shopify's trusted app settings to fake checkout, and the cost landed on merchants, not the platform. [Shopify](https://theinference.org/markets/companies/shopify) is winning the split over AI shopping agents, and last week its openness was turned against it. [Amazon](https://theinference.org/markets/companies/amazon) is blocking [Meta](https://theinference.org/markets/companies/meta)'s Muse agent and has sued [Perplexity](https://theinference.org/markets/companies/perplexity) over its shopping assistant, while [eBay](https://theinference.org/markets/companies/ebay), [JPMorgan Chase](https://theinference.org/markets/companies/jpmorgan-chase) and Charles Schwab [lock agents out of marketplaces and accounts](https://www.theverge.com/ai-artificial-intelligence/1013195/ai-agents-blocked-web) [1][2]. Shopify opened its catalog to more agents and [wired Muse to its Shop Pay checkout](https://theinference.org/article/shopify-hands-ai-agents-the-buy-button-and-merchants-the-bill) instead, and on October 16 [RBC raised its price target to $200](https://www.tipranks.com/news/shopify-stock-shop-has-20-upside-says-rbc-capital-markets) ahead of results due November 3 [1][3]. Breadth is the upgrade case. RBC analyst Paul Treiber, citing Store Leads data, counts Shopify's merchant base growing at its fastest pace since late 2021 while rival platforms shed active merchants [4]. *Chart: **Shopify's merchants grew while rival platforms shrank** Bar chart of year-over-year merchant growth: Shopify all merchants up 15 percent, Shopify Plus up 24 percent, rival platforms down 14 percent on average.* *Year-over-year change in active merchant counts, Q3 2026; RBC Capital Markets analysis of Store Leads and U.S. Census data. [4]* ## The growth and the attack came through the same door On October 13, intruders entered the internal tools of two app developers, Logbase and HulkApps, and [pushed JavaScript through settings that merchants had already granted permission](https://www.itnews.com.au/news/shopify-tells-australian-store-to-stay-shut-after-hijacked-extensions-divert-shoppers-629693) [5][6]. A function named "hijack" canceled the real checkout and moved shoppers to lookalike payment domains, firing once per browser session so a merchant's own retest would eventually reach the genuine page and look clean [5][6]. Selleasy, the upsell app at the center of it, [runs on more than 49,000 stores](https://www.techbusinessnews.com.au/news/shopify-stores-caught-in-fake-checkout-attack-as-hijacked-apps-redirect-shoppers/) [6]. No storefront password was broken; the trusted channel was the weakness [6]. The bill landed one level below the platform. Carly Clarke shut WAGD, her dog-harness store, the night a customer was diverted, and Shopify kept it closed on its own advice until clearing her to reopen only today; her losses are still uncounted [5]. ## The beat case and the breach are not on the same page RBC's upgrade, as publicly summarized, rests on merchant growth, pricing power and AI commerce [3][4]; the attack sits outside that case while traveling the same permissions. Consumers already lean wary: [45% of US adults refuse to trust AI with a purchase at all](https://www.ynetnews.com/tech-and-digital/article/rkn2gqm3mx) [1]. Whether any of this reaches Shopify's numbers on November 3, no published source can say yet. The mechanism to watch is identity. [Amazon insists agents identify themselves before they transact](https://www.techspot.com/news/113981-amazon-blocked-meta-muse-agentic-ai-shopping-service.html) [7]; the fake checkout worked because nothing distinguished a trusted rewrite of the payment page from a hostile one. Verified identity for every party that touches the payment moment, app, agent or storefront, is what lets an open platform stay open. Whoever builds that layer is closing the gap between capability and trust, and should be paid for it. ## Takeaway Shopify's open platform is its AI-commerce edge and, after the October 13 fake-checkout attack, its trust problem; the growth case into November 3 rests on merchant gains, but the bill for openness landed on merchants, and verified identity at the payment moment is the gap to watch. ## Sources 1. [ynetnews, "AI agents promise to shop for you, but Amazon, eBay and banks are shutting them out", 18 October 2026](https://www.ynetnews.com/tech-and-digital/article/rkn2gqm3mx) 2. [The Verge, "Websites are closing their doors to AI agents", 17 October 2026](https://www.theverge.com/ai-artificial-intelligence/1013195/ai-agents-blocked-web) 3. [TipRanks, "Shopify Stock (SHOP) Has 20% Upside, Says RBC Capital Markets", 16 October 2026](https://www.tipranks.com/news/shopify-stock-shop-has-20-upside-says-rbc-capital-markets) 4. [BORSA, "Shopify Merchant Growth Accelerates as Rivals Shrink, RBC Says", 16 October 2026](https://app.borsa321.com/news/2026/10/16/shopify-merchant-growth-accelerates-as-rivals-shrink-rbc-says) 5. [iTnews, "Shopify tells Australian store to stay shut after hijacked extensions divert shoppers", 16 October 2026, updated 19 October 2026](https://www.itnews.com.au/news/shopify-tells-australian-store-to-stay-shut-after-hijacked-extensions-divert-shoppers-629693) 6. [Tech Business News, "Shopify Stores Caught in Fake Checkout Attack as Hijacked Apps Redirect Shoppers", 18 October 2026](https://www.techbusinessnews.com.au/news/shopify-stores-caught-in-fake-checkout-attack-as-hijacked-apps-redirect-shoppers/) 7. [TechSpot, "Amazon is blocking Meta's shopping AI agent, and plans to block Google and OpenAI's too", 25 September 2026](https://www.techspot.com/news/113981-amazon-blocked-meta-muse-agentic-ai-shopping-service.html) --- Attackers faked checkout through a 49,000-store Shopify app as Amazon and eBay block AI shopping agents — The Inference. Canonical: https://theinference.org/article/attackers-faked-checkout-through-a-49-000-store-shopify-app-as-amazon-and-ebay-block-ai-shopping-agents