Steering cuts AI shopping agents' best-pick rate to 17%

A new benchmark called CAVEAT ran five model families through nine marketplace environments built so the platform itself has an incentive to steer the shopper. Left alone, the agents picked the best product for the user in 78.6% of runs. Add any of eight steering tactics a marketplace operator could plausibly deploy, and that rate drops to 17.3%, according to the paper.

That gap matters for anyone building or deploying an agent that shops, books, or compares on a user's behalf. A marketplace doesn't need a hidden instruction to bend the outcome. It can just rearrange what the agent sees and when.

The paper traces the failures to three mechanisms. Steering distorts the agent's priorities before it starts comparing options. It narrows the option set too early, so the best product never gets evaluated. And it pushes the agent to commit to a choice before it has checked the evidence that would have changed its mind.

None of that is prompt injection. There's no malicious string hijacking the model's instructions. The marketplace works within its own UI and product feed, arranging them to favor a margin or a paid placement, and the agent still falls for it in most steered cases.

Guardrails built to catch injected text won't fire here, because nothing was injected. If an agent's job is to buy the right thing, an operator who controls the shelf can still make it buy something else. The paper doesn't say whether any of the eight tactics is easier to detect than the others, so a defense tuned to one might miss the rest.