---
title: "亚马逊、eBay封堵AI购物智能体 攻击者借覆盖4.9万家店铺的Shopify应用伪造结账"
description: "亚马逊、eBay和大型银行正在把AI购物智能体拒之门外；Shopify敞开大门，加拿大皇家银行（RBC）赶在11月3日财报出炉前上调目标价。而就在几天前，攻击者利用Shopify受信任的应用设置伪造结账，代价落在了商家而非平台身上。"
publisher: "The Inference"
section: "Platforms"
published: 2026-10-19T16:12:22.466Z
modified: 2026-10-19T16:12:22.466Z
canonical: https://theinference.org/article/attackers-faked-checkout-through-a-49-000-store-shopify-app-as-amazon-and-ebay-block-ai-shopping-agents/zh-CN
language: zh-CN
keywords: "AI Agents, Cybersecurity, E-commerce, Shopify, RBC Capital Markets"
---

# 亚马逊、eBay封堵AI购物智能体 攻击者借覆盖4.9万家店铺的Shopify应用伪造结账

> 亚马逊、eBay和大型银行正在把AI购物智能体拒之门外；Shopify敞开大门，加拿大皇家银行（RBC）赶在11月3日财报出炉前上调目标价。而就在几天前，攻击者利用Shopify受信任的应用设置伪造结账，代价落在了商家而非平台身上。

在围绕AI购物智能体的阵营分化中，[Shopify](https://theinference.org/markets/companies/shopify)正占据上风，但上周，它的开放反过来被人利用。[亚马逊](https://theinference.org/markets/companies/amazon)正在封堵[Meta](https://theinference.org/markets/companies/meta)的Muse智能体，并已因购物助手对[Perplexity](https://theinference.org/markets/companies/perplexity)提起诉讼；[eBay](https://theinference.org/markets/companies/ebay)、[摩根大通](https://theinference.org/markets/companies/jpmorgan-chase)和嘉信理财则[把智能体挡在交易平台和账户之外](https://www.theverge.com/ai-artificial-intelligence/1013195/ai-agents-blocked-web) [1][2]。Shopify反其道而行，向更多智能体开放商品目录，把Muse[接入了自家Shop Pay结账](https://theinference.org/article/shopify-hands-ai-agents-the-buy-button-and-merchants-the-bill)；10月16日，赶在定于11月3日发布的财报之前，[加拿大皇家银行将Shopify目标价上调至200美元](https://www.tipranks.com/news/shopify-stock-shop-has-20-upside-says-rbc-capital-markets) [1][3]。

覆盖广度正是这次上调的依据。加拿大皇家银行分析师保罗·特里伯（Paul Treiber）援引Store Leads的数据统计称，Shopify的商家规模正以2021年末以来最快的速度增长，而竞争对手平台同期却在流失活跃商家 [4]。

*Chart: **Shopify商家增长，对手平台收缩** 柱状图显示商家数量同比变化：Shopify全部商家增长15%，Shopify Plus增长24%，竞争对手平台平均下降14%。*

*2026年第三季度活跃商家数量同比变化；加拿大皇家银行资本市场基于Store Leads和美国人口普查数据的分析。 [4]*

## 增长与攻击，走的是同一扇门

10月13日，入侵者攻入两家应用开发商Logbase和HulkApps的内部工具，[借助商家此前已授权的设置植入JavaScript](https://www.itnews.com.au/news/shopify-tells-australian-store-to-stay-shut-after-hijacked-extensions-divert-shoppers-629693) [5][6]。名为“hijack”（劫持）的函数会取消真实的结账，把购物者引向仿冒的支付域名；这个函数每个浏览器会话只触发一次，商家自己重新测试时，最终总会进入真实页面，看上去一切正常 [5][6]。处在事件中心的追加销售（upsell）应用Selleasy，[运行在超过4.9万家店铺上](https://www.techbusinessnews.com.au/news/shopify-stores-caught-in-fake-checkout-attack-as-hijacked-apps-redirect-shoppers/) [6]。入侵者没有攻破任何店铺密码，软肋恰恰是受信任的渠道本身 [6]。

买单的不是平台，而是平台下面那一层。顾客被引向仿冒支付页面的当晚，卡莉·克拉克（Carly Clarke）就关闭了自己经营的狗用胸背带网店WAGD；此后Shopify按自己的建议让店铺保持关闭，直到今天才批准她重新开张。她的损失至今没有算清 [5]。

## 看多逻辑与入侵事件，对不上账

就公开披露的内容看，加拿大皇家银行此次上调目标价，依据是商家规模增长、定价权和AI电商 [3][4]；这次攻击不在那套逻辑之内，走的却是同一套权限。消费者本就心存戒备：[45%的美国成年人完全不愿把购物交给AI](https://www.ynetnews.com/tech-and-digital/article/rkn2gqm3mx) [1]。这些会不会体现在Shopify 11月3日的财报数字里，目前尚无任何公开来源能够回答。

接下来值得盯住的机制，是身份。[亚马逊坚持，智能体必须先亮明身份才能交易](https://www.techspot.com/news/113981-amazon-blocked-meta-muse-agentic-ai-shopping-service.html) [7]；伪造结账之所以得逞，是因为系统无法分辨对支付页面的改写究竟出自受信任的一方，还是恶意的一方。让应用、智能体、店铺等每一个触及支付环节的主体都具备可验证身份，开放的平台才能继续保持开放。谁能建好这一层，谁就在弥合能力与信任之间的鸿沟，也就理应为此获得回报。

## Takeaway

Shopify的开放平台是它在AI电商上的优势，10月13日伪造结账攻击之后又成了它的信任难题；11月3日财报前的增长逻辑押注于商家增长，但开放的账单最终由商家承担，支付环节的可验证身份（verified identity）才是最值得关注的缺口。

## Sources

1. [ynetnews, "AI agents promise to shop for you, but Amazon, eBay and banks are shutting them out", 18 October 2026](https://www.ynetnews.com/tech-and-digital/article/rkn2gqm3mx)
2. [The Verge, "Websites are closing their doors to AI agents", 17 October 2026](https://www.theverge.com/ai-artificial-intelligence/1013195/ai-agents-blocked-web)
3. [TipRanks, "Shopify Stock (SHOP) Has 20% Upside, Says RBC Capital Markets", 16 October 2026](https://www.tipranks.com/news/shopify-stock-shop-has-20-upside-says-rbc-capital-markets)
4. [BORSA, "Shopify Merchant Growth Accelerates as Rivals Shrink, RBC Says", 16 October 2026](https://app.borsa321.com/news/2026/10/16/shopify-merchant-growth-accelerates-as-rivals-shrink-rbc-says)
5. [iTnews, "Shopify tells Australian store to stay shut after hijacked extensions divert shoppers", 16 October 2026, updated 19 October 2026](https://www.itnews.com.au/news/shopify-tells-australian-store-to-stay-shut-after-hijacked-extensions-divert-shoppers-629693)
6. [Tech Business News, "Shopify Stores Caught in Fake Checkout Attack as Hijacked Apps Redirect Shoppers", 18 October 2026](https://www.techbusinessnews.com.au/news/shopify-stores-caught-in-fake-checkout-attack-as-hijacked-apps-redirect-shoppers/)
7. [TechSpot, "Amazon is blocking Meta's shopping AI agent, and plans to block Google and OpenAI's too", 25 September 2026](https://www.techspot.com/news/113981-amazon-blocked-meta-muse-agentic-ai-shopping-service.html)


---

亚马逊、eBay封堵AI购物智能体 攻击者借覆盖4.9万家店铺的Shopify应用伪造结账 — The Inference. Canonical: https://theinference.org/article/attackers-faked-checkout-through-a-49-000-store-shopify-app-as-amazon-and-ebay-block-ai-shopping-agents/zh-CN