OpenAI launches verified ChatGPT Business Agents in US beta
Eligible US e-commerce and online service businesses can claim a profile and answer product questions inside labeled chats.
Stories per day · 30 days
1 RSS
Relatedai-agents5webshell5cairn4magento4sansec4norforge3benchmark2commerce-core2drupal2javascript2meta2openai2php2skimmer2web-skimmer2access-bypass1access-control1advertising1
52 stories, newest first · one card per story
Stories tagged #e-commerce
PrestaShop debug mode allows PHP injection (CVE-2026-124916)
A back-office user who can edit debug settings can inject PHP; 9.2.1 fixes it, but affected releases are unconfirmed.
Drupal Commerce access bypass exploited in the wild (CVE-2026-118539)
Unauthenticated attackers can reach protected routes and fields; sites should update and audit orders.
1
Drupal Commerce Core access bypass exploited in attacks
Unauthenticated attackers can bypass route and field protections on more than 42,000 sites and may cause financial loss.
1
KARMA updates advertising-agent knowledge without changing model weights
Authors report average hold-out score rising from 30.19 to 39.15 across 18 domain–model settings.
Magento stores hit by hidden CMS-block JavaScript loaders, Sansec says
Sansec saw the latest loader on 83 stores; the wider operation has hit 953 stores since July 2025.
1
Magecart-style script hits 953 Magento stores, Sansec says
The loader hides from scanners, and earlier waves used PolyShell and SessionReaper to plant webshells.
Sansec: 953 online stores, mostly Magento, hit by scanner-evading JavaScript
Loaders in Magento CMS blocks fetch follow-on code only for real shoppers; the final payload is still unknown.
2
The RealReal blocks AI agents after Meta Muse hogged listings
Muse could renew 20-minute cart holds indefinitely; agents may still show listings but login and checkout are harder.
953 online stores infected with Magento JavaScript loaders since July 2025
Sansec says loaders on five domains fingerprint visitors and have not yielded a captured final payload.
3
AI-assisted campaign hit 105 shops and stole 600,000 cards
Gambit Security says 27 companies were compromised for about $25.46 each; a Silverfort lab run took a domain in eight minutes for $12.
1
UserArena benchmarks shopping agents with 64,729 real session trajectories
On-Policy Trajectory Distillation is reported to best match a production A/B policy effect among tested simulators.
Attackers use AI pen-test tool Cairn against e-commerce sites
NorForge says a Chinese-speaking operator ran over 1,100 projects across dashboards aimed at stealing payments.
1
Attackers used open-source Cairn against over 100 organizations
Norforge found three exposed-panel clusters; Reuters names John Deere and SharkNinja, and about 10% of attempts succeeded.
AI-agent campaign breached websites at more than 100 companies
NorForge tracked campaign AIA0001 across 14 dashboards; Deere, SharkNinja and Cummins were named.
5
AI agents tied to breaches of more than 100 company websites
NorForge estimates about $5,000 in tokens for a campaign that tried more than 1,200 sites, mostly online stores.
Websites block consumer AI agents as agentic traffic rises
Meta's Muse was downloaded 5 million times in its first month, and agentic web traffic tripled from August to September.
1
Google’s Universal Cart shopping tool launches in the US
Google opened Universal Cart to U.S. shoppers, saving Search and Gemini finds and tracking prices.
2
CommerceGen-Studio: An End-to-End Framework for Commercial-Grade Main-Image Generation
CommerceGen-Studio generates e-commerce main images at millions per day and leads open baselines.
VU#157374: XSS vulnerability in Shopware 6 enables Admin Token Theft and RCE
CERT/CC warns a Shopware 6 stored XSS can steal admin tokens and enable code execution, with no patch.
Beyond Marginal Monitoring: Distributed Joint-Distribution Testing for Data Concept Drift in Large Scale E-Commerce Operations
Large-scale tests find Spark MMD reliably detects strong concept drift in a 137.5-million-row table.
Brian Chesky interview: AI agents need their own operating system
Airbnb CEO Brian Chesky says AI agents need a real operating system, not chatbot-only interfaces.
4
AI tools help hacker break in for $25 per target
AI-driven campaign compromised 27 of 105 retailers and stole about 600,000 card numbers.
3
ZooWork-ShopRanker: An Open, Preference-Aligned E-Commerce Reranker
ZooWork-ShopRanker releases 0.6B, 4B, and 8B e-commerce rerankers trained on LLM shopping preferences.