A man asks the internet for Diwali sweets.
He gets televisions, refrigerators, washing machines and smartphones instead. The orders are placed in his name, the deliveries arrive at his door and the payment obligation lands on someone who never agreed to buy any of it.
Madurai influencer Veeramani had apparently discovered that asking the internet for a favour could produce unexpected results. This time, the joke went too far. He ended up pleading with people to stop placing orders.
His new definition of DND was rather memorable:
Do Not Deliver.
The gentleman may have tried his luck a little too often. Some people evidently decided to take that as an invitation to play a prank at his expense.
But the incident exposes a weakness that deserves more attention than the joke itself.
The systems involved were apparently willing to initiate a chain of commercial activity without adequately establishing whether the person at the receiving end had actually authorised the purchase.
Now replace the pranksters with autonomous AI agents.
Replace a handful of unwanted deliveries with thousands of orders across multiple marketplaces. Add automated procurement, dynamic pricing, warehouse allocation, payment authorisation and last-mile logistics.
The joke could become a supply chain incident.
The problem changes when the buyer becomes software
Agentic commerce is moving beyond product recommendations and conversational shopping.
An AI agent could compare products, negotiate within a budget, select a seller, place an order, arrange payment and track delivery. A business could deploy agents to replenish inventory, source components or respond to changing demand without requiring a human to approve every transaction.
That is a compelling proposition. It also changes the nature of commercial risk.
A conventional e-commerce transaction usually begins with an identifiable user taking an action. The platform has a familiar set of controls around accounts, payments, order confirmation and fulfilment.
An agent introduces another layer.
The human may have defined a goal, but the agent chooses the steps. It may call tools, interact with multiple services and make decisions based on incomplete or stale information. Other agents may be doing the same on behalf of sellers, logistics providers and marketplaces.
The transaction is no longer simply a customer clicking a button.
It is a chain of decisions made by software, with each participant trusting that the previous participant has done the right thing.
Automation can accelerate a valid transaction. It can accelerate a bad one just as efficiently.
Five ways agentic commerce could go wrong
These are plausible failure scenarios, not claims that every agentic commerce system will exhibit them. Their significance lies in how quickly a local error could spread across connected systems.
1. The agent mistakes a request for permission
Suppose a consumer tells an assistant, “Find me the best television under ₹80,000.”
The agent has permission to research products.
Does it have permission to buy one?
What if the user wanted a shortlist for a family discussion? What if the budget was a preference rather than a hard spending limit? What if the agent interprets “best” as the highest-rated premium model and treats a vague statement as purchase authorisation?
The distinction between intent, recommendation and consent must be explicit.
In a corporate setting, the equivalent is an agent asked to identify a supplier that autonomously issues a purchase order.
The agent may have completed its task as it understood it. The business may still have incurred an unauthorised commitment.
2. A compromised agent turns one instruction into thousands of orders
Consider an agent operating across several marketplaces.
A malicious instruction, a compromised account or a poorly designed workflow tells it to purchase a particular product. The agent begins placing orders, encounters inventory limits and retries elsewhere.
Other agents may interpret the resulting activity as evidence of rising demand.
Sellers reserve inventory. Warehouses allocate stock. Payment systems initiate authorisations. Logistics providers schedule pickups.
A process designed to be resilient through retries could become an engine for multiplying the damage.
The important distinction is between a single fraudulent order and an automated system that keeps trying to fulfil an invalid objective.
3. Agents create demand that never existed
This is where the Madurai incident becomes particularly relevant.
Imagine a malicious actor instructing hundreds of agents to order the same product using fabricated identities or compromised accounts. Some orders are cash on delivery. Others use stolen payment credentials or payment methods that are later disputed.
A marketplace sees a sudden surge in demand and signals it to suppliers.
A supplier increases production or shifts inventory from other channels. A distributor commits to replenishment. A warehouse makes space. A carrier books capacity.
By the time cancellations and failed deliveries reveal the pattern, the commercial damage has spread well beyond the original orders.
Demand signals are useful only when the system has a reasonable basis for believing that the demand is real.
4. One agent’s mistake becomes another agent’s instruction
Agentic commerce will involve multiple software systems with different owners and objectives.
A buyer’s agent might optimise for price. A seller’s agent might optimise for conversion. A marketplace agent might optimise for fulfilment speed. A logistics agent might optimise for route efficiency.
Each can make a locally rational decision while producing a globally irrational result.
For example, an agent may repeatedly switch sellers when stock appears unavailable. Another may reserve stock while awaiting confirmation. A third may retry a payment after receiving an ambiguous response.
Without shared transaction identifiers, idempotency controls and a clear source of truth, one purchase attempt can become several commitments.
This is not a hypothetical problem unique to AI. Distributed systems already struggle with duplicate messages, inconsistent state and retries. Autonomous agents make the problem harder because they can generate new actions rather than merely repeat an existing technical request.
5. Nobody knows who should stop the transaction
The buyer says the agent misunderstood.
The agent provider says it followed the instructions it received.
The marketplace says the order was validly submitted through an authorised interface.
The seller says it picked and packed the goods.
The logistics provider says it followed the delivery instructions.
Who pays for the inventory, shipping, return handling and lost selling time?
Who is authorised to cancel the order? Who has the evidence needed to establish what happened?
Unless those questions are settled before deployment, the investigation may take longer than the transaction itself.
Our technology debt makes this harder
There is a temptation to believe that agentic commerce is mainly an AI problem. It is not.
AI adds new decision-making capabilities to systems that already struggle with fragmented identities, inconsistent data, disconnected workflows and old integration patterns.
Many organisations still operate with separate customer, product, inventory, order, payment, warehouse and transport systems. Some share data through batch updates. Others depend on custom APIs, manual reconciliation or business rules buried in legacy applications.
That architecture is manageable when people can pause, ask questions and resolve exceptions.
It becomes less forgiving when autonomous agents can initiate actions around the clock.
Consider a few familiar weaknesses:
Identity debt: The system can authenticate an account but cannot establish whether the agent has authority to spend a particular amount on behalf of that account.
Data debt: Inventory shown to the agent is stale. Multiple sellers believe they have the same stock available.
Integration debt: An order is accepted by one system but the acknowledgement never reaches another. The agent retries and creates a duplicate.
Process debt: Cancellation, refunds and returns depend on manual intervention, even though ordering is fully automated.
Governance debt: Nobody has defined which decisions an agent may make independently and which require human approval.
There is also a less visible problem: many organisations have never designed their commercial processes around a shared, end-to-end transaction state.
They can tell you an order was placed. They may struggle to establish whether the payment was authorised, the stock was reserved, the shipment was dispatched and the delivery was accepted as one coherent sequence of events.
Adding agents to that environment will not magically repair the underlying architecture.
It will expose its weaknesses at a much higher speed.
Ten things suppliers and marketplaces need to do before they scale agentic commerce
The answer is not to ban autonomous purchasing. The commercial upside is too significant to ignore.
The answer is to make the buying authority, transaction boundaries and recovery mechanisms as sophisticated as the agents themselves.
1. Establish verifiable agent identity and authority
Every agent should have a verifiable identity linked to its owner, purpose and permitted actions.
A consumer shopping assistant should not automatically receive the same authority as an enterprise procurement agent. Nor should an agent authorised to compare products inherit permission to purchase them.
Use scoped credentials, delegated permissions and short-lived tokens where appropriate. Make revocation fast and ensure every transaction can be traced to the agent and the authority under which it acted.
2. Introduce transaction-level spending and quantity limits
Set limits on spend, order value, quantity, frequency and cumulative exposure.
A ₹5,000 purchase may be automatically approved. A ₹5 lakh order may require a second check. An order for 500 units may trigger a review even if the unit price is low.
Limits should apply across channels and sessions, not merely within one conversation. Otherwise, an agent can bypass a threshold by splitting purchases into smaller transactions.
3. Separate discovery, commitment and fulfilment
An agent that can search for a product should not automatically be able to buy it.
Treat product discovery, cart creation, purchase authorisation, payment capture, stock reservation and dispatch as distinct stages with explicit permissions.
For high-risk transactions, require a clear confirmation before the commercial commitment becomes irreversible.
The goal is not to introduce friction everywhere. It is to put friction at the points where a mistake becomes expensive.
4. Build a proper transaction state machine
Every order needs a consistent, auditable lifecycle.
A request should not move from submitted to fulfilled because one component assumes another component succeeded. Systems should distinguish between pending, authorised, reserved, confirmed, dispatched, delivered, cancelled and refunded states.
Use idempotency keys, durable event records and reconciliation processes to prevent retries from creating duplicate orders.
If an agent receives an ambiguous response, it should check the transaction’s actual state before trying again.
5. Detect abnormal demand before it reaches the warehouse
Marketplaces and suppliers need risk controls that look beyond individual orders.
Watch for unusual order velocity, repeated delivery addresses, suspicious account relationships, high cancellation rates, mismatched payment and delivery patterns, and sudden demand spikes for specific products.
Combine these signals with historical demand and inventory movement.
An order can look legitimate in isolation and still be part of a coordinated attack. Risk scoring needs to account for that possibility.
6. Make cash-on-delivery and other payment risks explicit
Cash on delivery shifts a portion of the risk downstream. The seller may pack and dispatch the product before discovering that the recipient never intended to buy it.
For expensive or frequently abused categories, consider additional confirmation, order limits, address verification or deposits where commercially and legally appropriate.
Payment authorisation must also be distinguished from payment settlement. A successful API response is not the same thing as final, irrevocable payment.
7. Create a trusted product, price and inventory layer
Agents are only as reliable as the information they receive.
Suppliers should publish accurate product identifiers, current prices, stock availability, delivery constraints, warranty conditions and return policies through machine-readable interfaces.
Marketplaces should make the freshness and reliability of those signals visible.
Inventory reservations must be coordinated across channels. A product shown as available should not be simultaneously promised to several buyers unless the system can honour those commitments.
8. Establish a kill switch and an incident response process
Every participant needs a way to suspend a rogue agent, revoke its credentials, block further orders and cancel eligible transactions.
The response must work across connected systems. Stopping the agent is not enough if thousands of orders are already queued for fulfilment.
Define who can trigger an emergency stop, how orders are quarantined and how suppliers, marketplaces, payment providers and logistics partners are notified.
Run simulations before a real incident forces the organisation to discover its dependencies.
9. Make accountability and liability contractual
Agent providers, marketplaces, suppliers and payment partners need clear agreements covering authorisation, fraud, erroneous orders, cancellations, refunds, evidence retention and loss allocation.
The contract should answer a practical question: if an agent creates an order that no human intended to place, who bears the cost at each stage of fulfilment?
Logging must preserve enough information to reconstruct the chain of decisions without exposing unnecessary personal data.
Accountability cannot be outsourced to an algorithm.
10. Stress-test the entire ecosystem, not just the agent
Most organisations test whether an agent can complete a successful purchase.
They should also test what happens when everything goes wrong.
Simulate duplicate orders, stale inventory, compromised credentials, prompt injection, malicious product listings, payment timeouts, cascading retries, cancellation storms and coordinated fake demand.
Measure the time needed to detect the problem, stop new commitments, recover inventory and reconcile financial exposure.
A successful demo proves that an agent can buy something. A serious readiness test proves that the business can survive when the agent should not have bought it.
The commercial opportunity is real. So is the cost of getting it wrong.
Agentic commerce could reduce search costs, improve procurement, help smaller sellers reach customers and automate decisions that currently consume hours of human effort.
But a marketplace is not merely a collection of product listings and checkout buttons. It is a network of commitments between buyers, sellers, financial institutions, warehouses and delivery partners.
Each commitment has a cost.
When a human makes a mistake, the damage is often limited by the speed at which that person can act. An autonomous agent can make the same mistake repeatedly, across systems, before anyone notices.
That is why the next phase of e-commerce cannot be measured only by conversion rates, average order value or the number of tasks agents complete.
It must also be measured by how well the ecosystem handles invalid intent, conflicting instructions, fraudulent demand and failed transactions.
The companies that solve this will earn the right to automate more of commerce. Those that do not may discover that a small failure in the buying interface can become a very expensive problem in the warehouse.
Veeramani wanted Diwali sweets. He got an unwanted lesson in the economics of digital mischief.
The lesson for commerce leaders is considerably less amusing.
Before we let agents buy at machine speed, we need supply chains that can question, contain and reverse a bad decision at the same speed.
Otherwise, the future of shopping could turn into a very modern version of Do Not Deliver.