The RealReal's 20-minute cart hold assumed a human. Check every limit you set by the clock.

The RealReal is tightening its bot defenses this week because its 20-minute cart hold, built for people, let Meta's Muse agent keep items held for hours. Gizmodo reported on October 27 that The Verge's reporters used Muse to keep items on hold, so other shoppers couldn't buy them. The RealReal is now making it harder for agents to log in, add to cart and check out.

The flaw isn't the agent. It's the timer. Twenty minutes is a guess about how long a person needs to decide. An agent doesn't need twenty minutes, and it doesn't stop after one hold.

Here's what I'd do. List every rule you set by the clock: trial lengths, held demo slots, coupon windows, rate limits per session. Ask what each one does when the visitor never sleeps. Then cap the count per account, not just the minutes per visit.

Blocking every agent is the blunt fix. Per TokenPost's October 26 report, agents can still surface The RealReal's listings, and Muse can still send people to product pages. Keep that door open. An agent reading your site is often a real buyer doing homework.