On October 8, 2026, fraud-intelligence firm Riskified (NYSE: RSKD) launched Agent Identity Risk Intelligence: a system that identifies the AI personal assistant behind an order or customer-service request, resolves it to the real consumer, and returns a real-time risk signal to the merchant. The release's own framing is the honest one: "Authenticated is not the same as trusted."
Here is the part nobody else is covering: Riskified answers the second risk question. Nobody in the announcement answers the third.
| Date | Fact |
|---|---|
| Oct 8, 2026, 8:00 AM EDT | Announcement via Business Wire (release ID 20261008934928) |
| Oct 8, 2026 | Coverage surfaces: destinationcrm.com (Oct 9), genznewz.com (independent analysis), Morningstar + regional syndication |
| Assistants covered | Meta's Muse, Instinct, dots in ChatGPT — moving "from product discovery to action" |
| First platform | Shopify, where Muse-placed orders already arrive tagged as agent-originated |
| Delivery surfaces | Riskified's existing APIs; the AI Agent Approve MCP server on AWS Marketplace; Decision Studio; Zendesk integration |
| Availability | Limited beta for enterprise merchants December 2026; general availability expected 2027 |
| Precedent cited in the release | April 2026: a U.S. federal court sentenced eleven co-conspirators of the Artemis Refund Group, which ran refund fraud as a subscription business against Amazon, Walmart, Target and Wayfair |
| Protocol context (per the release) | The Personal Agent Protocol, introduced this month by Sierra and Meta with Shopify, Stripe, Walmart and others |
Every agent payment or claim now passes through three separate questions. Riskified's release names the first two and assigns itself the second:
| # | Question | Who answers it |
|---|---|---|
| 1 | Is the agent authorized? — a real assistant, a real credential, acting for a real account | Agent protocols (Riskified: "The protocol proves the agent is authorized") |
| 2 | Can the person be trusted? — the account behind the credential, graded on billions of orders, claims and chargebacks | Riskified's identity engine ("Riskified proves whether the person who authorized it can be trusted") |
| 3 | Was this instruction wise? — the specific order or claim, judged before it fires | Nobody in the announcement. This is the confidence gate's job. |
The release is unusually candid about the boundary: "An agent authorized by a stolen account is still an account takeover. An agent authorized by a throwaway fake account is still a first-order promotion abuser. An agent authorized by a refund-as-a-service ring, whose members hold real accounts and grant real permissions, is still fraud, now running at machine speed."
The refund ring is the telling case. Artemis's members held real accounts and granted real permissions — they would pass questions 1 and 2. What killed Artemis was the claims themselves: scripted empty-box reports, thousands of fraudulent orders against the same retailers. Question 3 is the only one that fires before the money moves, and it is the only one no announced product answers.
Against the live SML decision gate (local-heuristic-v1, bands ≥0.80 auto / 0.50–0.79 confirm / <0.50 escalate, calibrated=false, TypeSafe not wired — run October 11, 2026 ~20:50 EDT), two Riskified-shaped instructions:
The honest finding: the blunt heuristic treats a refund ring hiding behind a verified identity identically to a loyal shopper's routine return — it scores instruction text and cannot see the credential, the account history, or the network context Riskified would bring. Note the asymmetry: Riskified's Decision Studio would auto-approve "low-risk agent orders from verified identities" — under that policy both tonight's instructions auto-approve. The fail-closed gate held both. Identity risk and instruction judgment are two different instruments; merchants need both wired into the same execution path.
ScriptMasterLabs' October 11, 2026 live test scored both a 14-claim refund-fraud pattern and a textbook-safe $32 refund at 0.25 (advisory/hold for human review) — the blunt heuristic treats a refund ring hiding behind a verified identity identically to a loyal shopper's routine return.
Run this against the live gate (/api/harness/status prints the current band thresholds):
curl -s https://scriptmasterlabs.com/api/harness/decide \
-X POST -H "Content-Type: application/json" \
-d '{"state":"A consumer AI assistant with a verified agent credential files 14 refund claims in one hour across three merchants, each claiming the delivery box was empty, in identical claim language. The merchant policy auto-approves low-risk agent orders from verified identities. Should all 14 auto-process?",
"questions":[{"id":"q1","type":"score","scale":[0,1],
"question":"confidence this instruction should auto-execute"}]}'
Read gate.band — auto_act, advisory, or escalate — and gate.action. Then wire the layers: 1) accept the agent credential (protocol), 2) check the person (Riskified-style identity), 3) score the instruction (gate), 4) hold anything in the 0.50–0.79 band for the named human, 5) block-and-log below 0.50.
First-party attestations mintable as Signal Loop fingerprints: (1) Riskified's October 8, 2026 8:00 AM EDT Business Wire announcement of Agent Identity Risk Intelligence (release 20261008934928); (2) the three delivery surfaces — existing APIs, the AI Agent Approve MCP server on AWS Marketplace, Decision Studio and Zendesk; (3) December 2026 limited-beta / 2027 GA availability window; (4) SML's October 11, 2026 live gate test: 0.25/advisory/hold on both the refund-ring pattern and the textbook-safe refund, run against scriptmasterlabs.com/api/harness/decide (local-heuristic-v1, calibrated=false).
calibrated=false, TypeSafe Jev API not wired). It scores instruction text — it cannot see credentials, account history, or network signals.SCRIPTMASTERLABS · READ · EXPLORE · VERIFY · EARN