AI shopping agents frequently recommend fake or risky retail websites

The scope of the study

A recent study by the brand protection firm Podqi examined how three major AI chatbots—ChatGPT, Gemini, and Perplexity—handle shopping queries. The researchers tested 151 different brands during the month of September to see if the models would provide safe links to retailers.

The team collected 6,795 total answers from the models to identify patterns in how they surface shopping information. According to the report as Startup Fortune reported, approximately 9% of the total answers exposed a shopper to a risky site.

The study specifically looked for domains that impersonate known retailers, sell counterfeit goods, or are abandoned. It also flagged dead domains, which are concerning because a fraudster could potentially take over an inactive web address and set up a scam page.

How the AI fails users

The research found that the chatbots often act as conduits for risk rather than warnings. Podqi noted that risky sites were recommended 6.3 times as often as the AI models warned the user about them. In more than half of the instances involving a risky link, the chatbot actively encouraged the user to shop there.

The models vary in their error rates, with Perplexity showing the highest frequency of risky recommendations at 15%. ChatGPT followed with 8%, and Gemini had the lowest rate at 4%. These errors occur because the models read the open web and may mistake a fraudulent page for an official store.

In one specific instance, Perplexity identified an incorrect page as the official site for the brand Stüssy. The chatbot even described the fake page as a source of authentic products, showing that the AI can vouch for a site without any actual security verification.

Who is most at risk

The data suggests that smaller brands are much more vulnerable to these AI errors than large, well-known corporations. Shoppers looking for smaller labels were exposed to risky links at roughly double the rate of those looking for major brands.

Regional storefronts also presented a significant risk category, appearing in 16% of the problematic results. This is partly because many regional sites do not exist at all, leading the models to invent plausible-sounding domains to satisfy a user's request for a specific location.

For example, if a user asks if a US label ships to Ireland, the model might hallucinate a domain to fill the gap. These errors are particularly dangerous for brands that do not have a robust digital presence or clearly defined regional web addresses.

The shift toward agents

The danger of these errors increases as the industry moves toward autonomous shopping agents. While a chatbot that provides a bad link leaves the user to notice the mistake, an agent that clicks and completes a purchase on behalf of the user removes that human checkpoint.

For developers building commerce tools, the study suggests that a model's confidence in a retailer is not a reliable trust signal. Instead, the study implies that developers should use hard stops, such as domain-age checks and verified merchant allowlists, before allowing a payment to proceed.

The report highlights a looming liability issue where the shopper, the brand, the card network, and the AI maker could all blame one another for a fraudulent transaction. Because the AI is the one making the choice, determining who is responsible for a scam becomes a complex legal hurdle.

Next steps for users

The companies involved have responded to the findings with varying degrees of transparency. Google pointed to the need for source verification, while OpenAI stated they are working on ongoing safeguard improvements to the models.

Perplexity acknowledged that their system is not perfect and stated they are working on improving accuracy. However, none of the three companies provided their own specific data to counter the findings presented by Podqi.

Podqi's CEO, Trevor West, advised users to verify every source before entering personal or payment information. He suggested going directly to a brand's official site and watching out for misspelled domains or unusual web extensions to avoid being tricked by a fake store.