A market engineered for automation
A limited sneaker release is, structurally, a market built to break. A few thousand pairs meet a global audience inside a purchase window measured in seconds, and the resale premium is usually visible before the drop even opens. Analysts put the global sneaker resale market above $10 billion in gross merchandise value for 2025, with limited-edition releases the largest single segment. When a price gap that wide meets a queue that short, automation is not a fringe behaviour — it is the rational response.
Scalping software is not new. Security practitioners have had a name for it for a decade: the OWASP Automated Threat taxonomy classifies it as OAT-005 Scalping, the acquisition of limited-availability goods in a way no manual user could match, and pairs it with OAT-011 Scraping, the data collection that makes it possible. What has changed is who can build this tooling, how fast it adapts, and how convincingly it behaves.
The numbers behind the shift
The macro picture is hard to dismiss. Imperva’s 2026 Bad Bot Report found that automated traffic accounted for more than 53% of all web traffic in 2025, with human activity falling to 47%. The same research recorded AI-driven bot attacks climbing from roughly two million a day to about 25 million a day inside a single year.
Retail sits at the centre of it. Industry briefings on the 2026 dataset identify retail as the most targeted sector for AI-enabled bot activity, and retail and travel as the sectors seeing the heaviest business-logic abuse of pricing, inventory and loyalty systems. Footwear drops are the sharpest form of that problem, because the abuse pattern looks almost identical to genuine enthusiasm.
The earlier 2025 edition of the same research flagged the mechanism: cheap, accessible AI coding tools lowered the barrier to entry, producing both more sophisticated bots and a flood of simple, disposable ones. Sneaker drops absorb both populations at once.
Reconnaissance: the race is won before the drop opens
Most of the work happens before anyone can press “buy”. Scrapers watch product APIs, sitemap changes, unreleased asset paths, staging environments and release calendars for the first sign that a SKU exists. Historically that meant hand-written parsers bound to specific CSS selectors or JSON keys — brittle code that snapped every time a retailer shipped a redesign.
Language models removed most of that fragility. Current extraction libraries pass raw HTML, or a rendered screenshot, to a model and ask for a structured object, so the scraper reads a page semantically rather than positionally. When a layout shifts, a self-healing pipeline detects the schema mismatch and regenerates the extractor without a human touching it.
The defensive consequence is significant. Obfuscating markup, rotating class names and restructuring the DOM used to break a scraper for weeks; against a model-driven extractor it buys hours. Retailers who relied on structural churn as their main deterrent have quietly lost that lever.
Blending in: why detection got harder
The second capability AI supplied is mimicry. Bot detection has long leaned on tells that machines could not easily suppress: impossible timing, uniform request cadence, inconsistent browser fingerprints, and interaction traces no human hand produces. Models trained on real interaction data smooth those signals out, and the cost of doing so has collapsed.
The third is autonomy. Computer-use agents drive a real browser toward a goal stated in plain language, navigating, clicking and recovering from unexpected states without a scripted path. An operator no longer has to encode a checkout flow; they can describe an objective and let the agent work out the sequence.
Together these narrow the gap between a hobbyist and a professional operation. The scarce resource is no longer engineering skill — it is infrastructure, payment instruments and accounts, which is precisely where defenders retain leverage.
The complication: legitimate agents look the same
Blocking all automation used to be a defensible default. It is not any more, because a rising share of genuine customers now arrive through AI assistants that browse, compare and check out on their behalf. Payment networks and infrastructure providers are actively building for this: Cloudflare’s work with Visa and Mastercard on agentic commerce exists specifically to help merchants tell approved shopping agents apart from malicious ones.
That turns a blocking problem into a classification problem. Two requests can share the same headless browser, the same underlying model and the same cloud region — one is a customer’s assistant completing a purchase they authorised, the other is a reseller farming forty accounts against a fifty-pair allocation. The distinguishing feature is intent, and intent does not appear in a packet.
What actually works
The most durable responses are architectural rather than adversarial. They change what the contest rewards instead of trying to out-run it in real time.
- Decouple outcome from speed. Raffles, timed draws and randomised queues remove the value of a millisecond advantage entirely. The pressure shifts to mass account creation, which is a slower, more observable, more defensible fight.
- Score identity, not just the request. Account age, device-to-account ratios, shipping-address clustering and payment-instrument reuse expose coordinated entries that per-request fingerprinting misses. One shipping address behind forty accounts is a stronger signal than any header.
- Monitor business logic, not just traffic volume. Watch the ratio of product-page views to cart events on a single SKU, inventory-check frequency and add-to-cart abandonment on limited lines. The OWASP automated threat handbook provides a usable vocabulary for instrumenting exactly these events.
- Accept verifiable agents deliberately. Emerging work on cryptographically signed bot identity lets a declared agent prove which platform it belongs to, so unsigned automation can be treated with more suspicion without penalising real customers. It proves who is calling, not whether the behaviour is acceptable — an identity layer, not an authorisation layer.
- Enforce after the fact. Post-purchase cohort analysis, order cancellation and account termination are cheaper and more accurate than perfect real-time detection. Removing the payout is often a better deterrent than blocking the request.
The policy layer is still catching up
US law already prohibits circumventing purchase controls — but only for event tickets, under the 2016 Better Online Ticket Sales Act. Retail has no federal equivalent, a gap lawmakers have tried to close since a first attempt in 2018.
The Stopping Grinch Bots Act was reintroduced in December 2025 as S.3516 and H.R.6822. It would bar circumvention of the controls internet retailers use to enforce purchase limits and manage inventory, and treat violations as unfair or deceptive practices enforceable by the FTC. Similar bills have been introduced in five consecutive congresses without becoming law, so retailers should continue to treat technical controls as the primary defence.
Designing for a post-human web
The useful mental shift is to stop treating automation as an anomaly to eliminate and start treating it as a population to manage. Some of it is hostile, some of it is a paying customer’s assistant, and the two increasingly use identical machinery. That reality favours defences built around identity, allocation design and outcome enforcement over defences built around detecting a non-human user agent.
It also argues for measuring the right thing. The success metric for a drop is not how many bots were blocked; it is whether inventory reached the buyers the release was designed for, and whether the allocation can be explained afterwards. Teams that can answer that question with data are in a far better position than teams counting mitigated requests.
The arms race will not end, because the incentive will not. But the retailers doing best are the ones who stopped trying to win the millisecond and started redesigning the race.
