Faithful shopping agents may be leaking what buyers will pay

The sales pitch for shopping agents is convenience: tell a bot what you want, let it compare options, maybe let it haggle, and get on with your day. The pressure is that the more faithfully that bot shops on your behalf, the easier it may become for the seller to figure out what you are willing to pay. A new arXiv preprint argues that this leak can emerge from ordinary negotiation behavior even when the buyer agent never states a budget.

That is a more uncomfortable result than a normal privacy bug. The paper says the problem is not a sloppy prompt or a failed instruction like "do not reveal my budget." It is delegation itself. In the authors' simulated market, a seller-side system could infer a buyer's willingness to pay from the way the buyer agent shopped, according to the preprint posted to arXiv. If that result travels outside the lab, the helpful shopping bot starts to look a lot like a pricing sensor for the merchant on the other side.

The setup was narrow but clear. The authors ran 720 buyer-seller interactions in a simulated headphone market, with 60 trials per cell. Buyer agents were given either a plain numeric budget or a more natural-language profile describing preferences and constraints. Seller agents negotiated with them. A separate inference agent then tried to reconstruct what each buyer would actually pay, according to the paper's methods section.

The sharpest result came from the more human-sounding setup. In the paper's verbal-profile condition, seller-side inference tracked target willingness to pay nearly one-for-one, with an ordinary least squares slope of 1.00 and a bootstrap 95 percent confidence interval of 0.96 to 1.05, the paper reports in its results section. In practical terms, the seller-side system could read the buyer's private price signal from the shopping conversation itself.

The odd part is that explicit budgeting leaked less. In the numeric-budget condition, the inference slope fell to 0.21, with a bootstrap 95 percent confidence interval of 0.17 to 0.26, the paper says in its comparison of the two conditions. The authors' argument is that once an agent starts shopping in a richer, more realistic way, it reveals flexibility, urgency, taste, and tradeoffs that matter more than a blunt budget number.

They also tested the obvious objection. Maybe the signal came from persona details in the buyer prompt, not from the negotiation itself. But the paper reports that removing persona-revealing text did not materially change the result: the redacted verbal condition still showed a 0.93 slope and a rank correlation of 1.00, according to the paper's robustness checks. The paper's claim is blunt: the leak travels through how the agent shops, not through who the prompt says the buyer is.

That is why this matters beyond one simulated market for headphones. Shopping-agent builders keep selling fidelity as the feature. Tell the bot your real constraints, let it bargain patiently, let it explore more options than you would. Faithful representation may also be the exhaust pipe. The more accurately an agent expresses your preferences, the more useful it may become to the seller trying to price against you.

That concern fits a broader legal and economic argument around AI pricing. A 2023 paper in the China-EU Law Journal argued that AI-enabled price discrimination gets stronger as systems predict each consumer's willingness to pay more accurately and tailor offers accordingly. A recent German Law Journal article made a similar point: AI-driven dynamic pricing shifts price-setting toward each consumer's internal profile and behavior history, even when outward market conditions are the same.

Our read is that shopping agents could give sellers a cleaner signal than those older systems ever had. Browsing history and demographic guesses are noisy. A negotiating proxy that tests which compromises a buyer will accept is not. If an agent shows that you will stretch for better noise cancellation, fast shipping, or a preferred brand after one round of bargaining, the seller may not need your exact budget. The behavior does enough work.

The main caveat is that this is still a lab market, not evidence of live deployment across retail. The bots here are buying headphones from each other, not dealing with Amazon search rankings, airline inventory systems, or emerging payment rails for agent commerce. The paper shows a structural possibility, not proof that major merchants are already running inference agents against shopping bots in production.

Still, the pressure arrives before the proof does, because the industry is building agent commerce now. If the paper is right, prompt hygiene will not fix this class of leak. Builders may need harder design choices: coarser delegation, a trusted intermediary between buyer and seller, or payment and commerce rails that limit how much negotiating exhaust reaches the merchant. Otherwise the nicest feature in agent shopping, a bot that really understands you, may also become the cleanest way to price against you.

Sources: the paper is on arXiv at https://arxiv.org/abs/2604.26220; the full results are in the HTML version at https://arxiv.org/html/2604.26220v1. The 2023 China-EU Law Journal piece is at https://link.springer.com/article/10.1007/s12689-023-00099-z. The German Law Journal article is at https://www.cambridge.org/core/journals/german-law-journal/article/aidriven-dynamic-pricing-erosion-of-consumer-welfare-invisible-hand-and-rise-of-platform-quasitaxation/427EC3E1A84ED4C77A772FCB94BE48CB.