AGENTIC AI, MEET AD SPYING: HOW TO LET BOTS ‘RUN’ CAMPAIGNS WITHOUT HANDING THEM YOUR WALLET

Agentic AI isn’t here to replace your media buyer. It’s here to replace your mystery shoppers — and then multiply them by a few million.

The core shift is simple but brutal: your ads and landing pages are no longer selling only to humans. They’re selling to the AI agents that sit between your brand and the consumer’s wallet. Those agents are already evaluating products, enforcing constraints, and in many cases completing checkout on a customer’s behalf. During Cyber Week 2025, roughly $67 billion in global sales — about 20% of all orders — were attributed to AI and agents, according to Salesforce data cited in an analysis of agentic commerce and Google Ads. That wasn’t a forecast. That was last holiday season.

For years, “non-human traffic” was a dirty word in ad tech, associated with fraud, scraping, or at best noise. But agentic AI turns a chunk of that non-human traffic into a legitimate, high-intent audience. Autonomous agents now research products, compare options, and even transact, acting as intermediaries between brands and real consumers. That means your analytics are starting to fill up with visits, impressions, and “reads” from entities that are neither test traffic nor bots in the old sense. As one analysis of the “next audience” in advertising argued, AI agents are creating a dual reality where brands must structure sites and campaigns for both people and the agents working on their behalf, because those agents are increasingly the ones building the consideration set and awarding the “decision win”.

The scale of that intermediary layer is no longer hypothetical. Cloudflare data cited in the same piece shows that website traffic from bots and AI agents has already eclipsed human traffic. Some of that is still junk: fraud, unauthorized crawlers, low-value background automation. But buried inside that sea of noise is a new class of non-human visitor that actually represents a live shopper and a high-intent query. Your problem is no longer “how do I filter non-human traffic out of my reporting?” It’s “how do I tell which non-human traffic is an agent I absolutely want to influence, and how do I do it without letting that agent run off with my budget?”

Publishers are answering that question faster than most brands. Time has already started serving FAQ-style, sponsored brand content explicitly to AI bots in an attempt to monetize the surge of agent traffic, a move detailed in coverage of its experiment with monetizing bots. Startups like Blankspace plug into CDNs like Cloudflare and Akamai so they can serve ads to AI agents at the precise moment a user asks a question — not unlike programmatic auctions, but the “user” is an agent, and the “organic result” the human sees may already be pre-shaped by whoever won that agent-level auction.

If that sounds abstract, look at where Google is going. In Shopping and Performance Max, agents don’t care about your clever copy or your on-brand lifestyle images. They read your structured data, pricing, availability, policies, and specs, and use those to make or break the shortlist before a human ever sees you. The product feed has effectively become a bidding signal and a negotiation script for agents, not just a catalog, as explained in the evolving rules of Google Ads for agentic commerce. Google’s Buy for Me checkout and Direct Offers format turn AI Mode into a surface where agents and platforms negotiate deals in real time on behalf of shoppers.

Behind the scenes, standards bodies are scrambling to make this safe enough for enterprise budgets. The IAB Tech Lab’s AAMP 2.3 release, for example, is less about adding new AI tricks and more about giving organizations governance, privacy checks, and workflow integrations so agents can operate inside existing buying systems without going rogue. AAMP 2.3 bakes privacy diligence and pricing guardrails directly into buyer workflows and extends support for so-called Agentic Audiences, moving AI agents out of sandbox experiments and into real programmatic infrastructure.

Put all of this together, and agentic AI isn’t the autonomous media buyer you were promised in conference keynotes. It’s the most powerful market intelligence layer you’ve ever had: a swarm of bots that will happily crawl your competitors’ funnels, stress-test your offers against theirs, and tell you exactly how an AI intermediary is likely to rank, filter, and recommend you. The opportunity is to use these agents as spies first and buyers second — to learn how they see the market, then reshape your campaigns and feeds for the real audience that now matters most: the bots quietly deciding which brands humans ever get to see.

“Hands-free” media buying sounds like a time-saver; in practice, it’s a governance booby trap.

The problem isn’t that agentic AI can’t optimize. It’s that optimization is being confused with delegation. When you tell an agent, “go buy media and hit ROAS 3.0,” you’re not delegating a task. You’re delegating judgment, risk, and, in the worst case, legal liability to a system that has no skin in the game and no lived sense of consequences.

You can see why the fantasy is seductive. Programmatic has already normalized real‑time bidding, algorithmic allocation, and automated optimizations. In the U.S., more than 90% of digital display now runs through programmatic pipes, with over $271 billion transacted via automated systems, as one overview of modern media buying explains in a piece on how AI is optimizing media buying and campaign performance. Agentic AI is simply the next click of that ratchet: instead of tools that suggest tweaks, you get self‑optimizing agents that independently adjust bids, budgets, audiences, and even creatives.

From an efficiency lens, that’s terrific. One agency profiled in that same analysis cut cost per lead by 60% and sales cycle time by 40% by letting an agent make optimization decisions every few hours instead of weekly. But efficiency isn’t governance. The more you let an agent “run” the show, the more you collide with three ugly realities.

First, consumers explicitly do not want autonomous spending. In research on agentic commerce, shoppers welcomed AI doing the heavy lifting on comparison shopping and shortlists, but only 20% were comfortable with AI acting independently on purchases, and making a purchase without sign‑off was cited as the single biggest trust‑breaker by 55% of consumers, according to a survey on how agentic AI is rewriting the rules of value and monetization in commerce media. If your internal posture is “let the bot spend the budget,” while your external promise is “we’ll never let AI touch your wallet without permission,” you’ve just created a trust gap that regulators and plaintiffs’ attorneys will happily walk through.

Second, “hands‑free” quickly becomes “sight‑free.” As agents start to integrate directly with buying platforms and ad servers, the mechanics disappear behind APIs and opaque policies. The latest release of IAB Tech Lab’s AAMP framework, for instance, doesn’t add sexier algorithms; it adds deployment options, pricing guardrails, privacy checks, and standardized workflows so agents can plug straight into Meta, Amazon Bedrock AgentCore, and Google Ad Manager, as described in a report on how IAB Tech Lab gets AI agents ready for real advertising. Those standards exist precisely because marketers need proof that an agent is using accurate data, respecting privacy rules, and staying inside hard financial limits.

If your operating model is “turn it on and trust the black box,” you’re ignoring the very scaffolding being built to keep you out of trouble.

Third, optimization pressure will push agents toward gray zones unless you explicitly fence them off. We’re already seeing publishers experiment with formats that blur the line between “organic” answers and paid influence for bots. When Time started serving FAQ‑style sponsored content to AI crawlers to monetize bot traffic, and when startups like Blankspace began injecting ads into the very moment an agent fetches recommendations, the result was that an AI might present a paid‑influenced hotel as if it were an objective top pick, as one summary of this trend noted when it covered how Time began serving ads to bots. Now imagine your own buying agent learning that nudging inventory into those quasi‑organic placements materially improves ROAS and lifetime value. If you haven’t constrained acceptable tactics, the agent will happily entangle your brand with practices that regulators, platforms, or consumers later decide are deceptive.

This is why “full automation isn’t the goal” has become a kind of quiet consensus. In that same commerce media research, industry leaders overwhelmingly preferred AI that surfaces insights and proposes actions, with humans retaining final decisions, a point that was underscored as practitioners described how full automation isn’t the goal. The question isn’t whether agents can buy better than your team at 3 a.m.; it’s whether you can explain, audit, and defend what they did six months later when a regulator, a CFO, or a consumer advocate asks.

In other words, “hands‑free” media buying is a governance nightmare not because the tech is reckless, but because it invites you to be. The only sustainable posture is “agentic, not autonomous”: bots doing the legwork, humans holding the keys.

If you want to understand what AI agents are genuinely good at, stop looking at “hands‑free” media buying dashboards and start looking at agentic commerce.

In retail, the agent’s job isn’t to “be creative” or “own the brand.” It’s to grind through comparison work at a scale and speed humans won’t touch: normalize feeds, reconcile specs, check constraints, weigh trade‑offs, and surface a shortlist. That is exactly the layer where consumers are comfortable letting AI operate — research and recommendation, not decision and payment. In one large commerce study, 64% of shoppers were happy to let AI filter, compare, and suggest brands they might not usually consider, but only 20% were comfortable with AI acting independently, and making a purchase without approval was named as the biggest trust‑breaker by a majority of respondents, according to research summarized in Marketing Dive.

Translate that to advertising: agents should not be your autonomous media buyers; they should be your ruthless, never‑tired comparison shoppers.

Look at how the web is already changing under agent pressure. AI crawlers and agents like GPTBot, ClaudeBot, and PerplexityBot now make up the bulk of “search” traffic for many sites. Between late 2025 and early 2026, AI agent activity was up 150% month‑over‑month, and 88% of visits originating from search were already agents, with agent traffic on track to overtake human‑driven search before the end of 2026, according to data cited in Search Engine Journal’s analysis of the emerging agent ecosystem. These systems aren’t browsing like humans. They’re scanning, structuring, and comparing — deciding whether your offer even makes the candidate list they will present back to a person.

Commerce media leaders are voting with their budgets. When asked how they plan to win in an agentic world, 84% said they would invest in opportunities designed to increase visibility inside AI‑generated answers and recommendations, and 61% said that spend would come out of performance and search budgets, according to Marketing Dive’s coverage of agentic commerce investment patterns. That is not a story about “more impressions.” It’s a story about systematic comparison: if you’re not in the shortlist, you’re invisible.

Time and a handful of startups are already experimenting with turning that shortlist into an ad surface. Time is serving FAQ‑style sponsored content not to people, but to bots, in the hope that influencing an agent will change what shows up in a user’s “organic” answer, as AdExchanger reported in its coverage of Time’s bot‑targeted formats. Blankspace plugs into CDNs to auction off recommendation slots at the moment an agent fetches information for a query like “best hotels in Austin.” Whoever wins that auction isn’t buying a click; they’re buying a better position in the agent’s internal comparison set.

So what, exactly, are these agents doing well?

• Normalizing inputs. Agents are excellent at turning messy product feeds, landing pages, and price tables into comparable schemas. If your creative and offers are inconsistent, they won’t “average it out” — they’ll just quietly discard you in favor of merchants with clean, machine‑readable data.
• Enforcing constraints. Budget, shipping windows, compatibility, loyalty perks, inventory, and user preferences are all hard constraints. Agents are relentless at applying them the same way every time, something human buyers and media planners routinely fumble.
• Ranking on multi‑factor criteria. Agents can weigh dozens of signals — ratings, return rates, warranties, promotions, sustainability flags — and build composite scores that drive shortlists. This is the same type of work you want them doing in media: systematically testing channels, formats, and placements against outcomes, not freelancing strategy.

• Keeping humans in the loop. In streaming TV, nearly half of buyers say AI’s biggest near‑term value is campaign planning and optimization, but only 22% are open to fully autonomous campaign management, according to FreeWheel’s buyer research summarized in AdExchanger’s look at AI’s role in CTV. Practitioners want agents to surface options, not to pull the trigger.

The lesson for ad spying is straightforward: treat your agents as comparison infrastructure, not as autonomous spenders. Point them at your own performance history and at competitors’ observable behavior. Let them collect, normalize, and compare — creative patterns, price points, offer structures, placements, frequencies, landing‑page flows — across thousands of campaigns and publishers. Then force the critical line: the agent proposes moves, humans approve budgets and changes.

That’s how agentic commerce actually works in the wild: the machine does the grinding comparison; the human still owns the wallet. Your media practice should mirror that split.

Most “agentic” ad tools on the market today are just glorified optimization knobs. They tweak bids, rotate creatives, and call it a day. An autonomous intelligence layer sitting on top of your ad‑spying stack is doing something very different. It’s treating the entire performance media universe as a living dataset to be crawled, compared, and reasoned about continuously – then turning those observations into concrete, reviewable recommendations rather than unapproved spend.

Concretely, that layer does four big jobs.

First, it turns spying into structured competitive intelligence. A human media buyer can open a competitor’s landing page, peek at which networks fire, and log that somewhere. An agent can “spy” on hundreds of sites and apps at once, fingerprinting their tags, placements, and partners, then normalizing that into a common schema: who’s buying what, where, with which formats, and at what apparent intensity. Tools built on standards like the IAB Tech Lab’s updated AAMP 2.3 already expose hooks for agents to ingest log‑level delivery, deal metadata, and content classifications. Your layer uses those hooks to keep an always‑current map of the auction terrain: supply paths, deal IDs, PMPs, contextual clusters, retail media shelves, and streaming pods your competitors are leaning into.

Second, it performs the “agentic commerce” work your team doesn’t have time for: relentless, rules‑driven comparison. In ecommerce, shoppers are happy to let AI shortlist products but balk at letting it swipe their card; only 20% are comfortable with AI acting independently, yet 64% welcome AI‑mediated discovery, according to research on agentic AI in commerce media. The same division of labor applies to media. Your agent should not own the credit card; it should own the grind:

• It reconciles performance data from your accounts with the competitive footprint it spies: “Brands like you are consistently present on these 17 inventory clusters you never touch.”
• It normalizes creative patterns: message angles, offers, lengths, hooks, and formats that show up again and again in winning flows.
• It applies constraint checks: brand rules, geo and regulatory limits, frequency caps, and pricing guardrails from frameworks like AAMP’s governance layer to filter out anything you wouldn’t legally or reputationally run.

What comes back is not “we raised your bid 12%.” It’s a ranked set of moves: “Add these five publishers to your allowlist; mirror this type of bundle in streaming CTV; test this offer archetype in high‑intent answer‑engine traffic.” You still decide which ones clear the bar.

Third, it optimizes for influence, not just placements. In an agentic world, what matters is whether you show up in the shortlist that AI systems present to people, not whether you bought the prettiest slot on the page. Commerce leaders already recognize that “influence is the new placement,” with 84% planning to invest in visibility within AI‑generated answers and recommendations, and many reallocating budget from paid search to those touchpoints, as recent commerce media analysis shows. Your intelligence layer uses ad‑spying inputs to reverse‑engineer how competitors are earning that influence: which FAQ‑style placements they buy to seed answer engines, which sponsorship formats surface inside recommendation widgets, how they structure content so conversational agents can parse and favor it.

It also watches the emerging ecosystem where publishers are literally serving ads to bots. When outlets like Time experiment with FAQ‑formatted sponsored content that targets AI agents in flight – so that the “organic” response a user sees is quietly shaped by a prior auction – they’re creating a new class of inventory your agent can monitor and model. As one AI contextual startup founder put it, influencing a single agent instance can mean influencing “potentially all” of that system’s responses, a dynamic described in coverage of AI‑targeted ad experiments. Your layer’s job is to watch where those influence points emerge, estimate their true impact on downstream human behavior, and recommend whether they’re worth testing for your category and brand.

Fourth, it coordinates actions across platforms without dissolving your governance. In streaming and CTV, buyers say their priority is not full autonomy – only 22% are even open to it – but better execution support: planning, pacing, and performance monitoring that augment human expertise, as survey data on AI in streaming TV buying makes clear. Your intelligence layer sits in exactly that role. It pulls in campaign diagnostics from DSPs, streaming platforms, walled gardens, and commerce networks; correlates them with what it spies competitors doing; and then pushes back proposed changes via standardized APIs and workflows.

This is where “AI‑native” operations come to life. Instead of campaign‑by‑campaign setups, you’re running continuous experiments across the surfaces that matter: classic search and social, retail and commerce media, answer engines, and agent‑facing placements. Agents can continuously test small reallocations, creative variants, and targeting tweaks, as long as they operate under explicit boundaries: spend ceilings, brand suitability rules, and escalation thresholds. Thoughtful frameworks for AI‑native advertising stress that the goal is not blind automation, but systems that “enable continuous testing, learning, and optimization” while keeping strategy and brand governance in human hands, a balance outlined in guidance on.

So the intelligence layer doesn’t “run” your campaigns in the sense finance worries about. It runs the comparison engine no human can: spying, normalizing, checking, and proposing. You’re still the one who says yes, no, or “explain that again,” before a single additional dollar leaves the account.

You don’t let a junior media buyer walk in on day one and wire your Amex to every channel in the plan. You stand them next to a live account, hand them a read‑only login, and say: “Watch what happens. Then tell me what you’d do differently.”

Treat agentic AI the same way.

The near‑term opportunity is not “hands‑free campaigns.” It’s using agents as ruthless, tireless watchers of the performance media universe – and routing everything they see through a human approval layer. Consumers are already telling you this is the right side of the line: they’re happy for AI to research and shortlist on their behalf, but deeply uncomfortable with systems that spend autonomously, with only one in five saying they’d accept independent purchases. Your operating model should mirror that comfort boundary.

A practical playbook looks like this.

First, define the agent’s scope as “observation and recommendation,” not “execution.” Your intelligence layer can crawl competitor placements, scrape pricing and promo patterns, log which brands dominate AI‑generated shortlists, and continuously capture what agents like ChatGPT, Perplexity, and Gemini are saying about your category. It can then translate that firehose into structured outputs: opportunity lists, anomaly alerts, and proposed tests. But it doesn’t touch budgets, bids, or creative without a human in the loop.

Second, formalize the approval workflow instead of treating AI suggestions as ad‑hoc tips. Think of a weekly “Agent Review” the way you think of a standup around performance dashboards:

• The agent delivers a digest of what it saw across search, social, and commerce ad surfaces, plus AI‑mediated environments like Google’s conversational shopping and Direct Offers.
• It proposes ranked actions: “Increase budget here,” “Test this promo mechanic,” “Adjust feed attributes for these products.”
• A named owner – not “the team” – approves, modifies, or rejects each item, and the decision is logged.

This satisfies the industry’s own preference that AI suggest and humans decide, which leaders in commerce media already identify as the desired equilibrium rather than full automation, according to research on agentic AI in commerce.

Third, point your agents at the right surfaces. Non‑human traffic is no longer just fraud to be filtered; consumer‑directed agents are becoming a “legitimate, high‑intent audience” you need to understand and shape, as one analysis of non‑human traffic in advertising argues. That means instrumenting:

• How often AI crawlers and agents hit your product and category pages.
• Where your brand appears (or doesn’t) in AI answers for key commercial queries.
• Which competitors are consistently surfaced alongside you in those answers.

Your own logs will likely echo the broader pattern that AI agents are now a double‑digit share of site traffic and on pace to rival search‑driven visits, a trend already visible in agent traffic analyses. Use your agents to watch those agents – map which content, specs, and offers they latch onto, and what they ignore.

Fourth, keep spend controls boring and strict. Even if you eventually let agents push changes directly into platforms, you can force everything through guardrails:

• Budget floors and ceilings per channel and per campaign.
• Hard limits on bid ranges and pacing changes.
• Whitelists for formats and surfaces the agent is allowed to touch.
• Mandatory human review for any move that changes spend allocation between major channels.

This is especially important as media shifts from “visible placements” to paid inclusion inside AI systems themselves. Publishers are already experimenting with serving ads directly to bots via FAQ‑style sponsored content that agents consume and remix into “organic” answers, as recent reporting on agent‑targeted ads makes clear. When agents start recommending paid ways to influence other agents, someone with a P&L needs to sign off.

Finally, separate “learning sandboxes” from “money accounts.” Give your agents dummy budgets and simulated auctions where they can over‑optimize, break things, and discover edge cases – without risking brand safety or blowing actual dollars. Then promote only the patterns that survive human scrutiny into your live playbook.

The goal of a human‑in‑the‑loop model isn’t to slow AI down; it’s to keep it on the side of the work where its comparative advantage is enormous: seeing everything, all the time, and never getting tired of making the next recommendation – while you keep the keys to the wallet.

Agents are fantastic at one thing humans get worse at every quarter: paying sustained, structured attention to an insane amount of noise.

So before you ever let an agent touch a bid, let it watch.

Think of a market‑intelligence agent as a cross between a junior strategist and a paranoid competitor analyst. It lives on top of your ad‑spying stack, but instead of you popping in a few times a week to pull screenshots, it’s continuously crawling the performance economy: which brands are showing up where, what offers are being pushed, what formats are surging, which audiences are being fought over, and how all of that shifts hour by hour.

This is exactly where both consumers and marketers are most comfortable with agentic systems. In commerce, shoppers want AI to “filter, compare and shortlist products” but overwhelmingly do not want it swiping their card; only about one in five are comfortable with AI acting independently, and unauthorized purchases are the biggest trust‑breaker, according to research summarized by Marketing Dive. Marketers feel the same way about budgets. They’re happy for AI to surface opportunities and propose moves, but they want a human to say “yes, do that” before money moves.

So you architect your agents to live in that “research and recommendation” band.

A monitoring agent plugged into your spying tools and platform APIs should not be allowed to buy a single impression. Its job is to:

• Track who is scaling and where. If a rival DTC brand suddenly triples its presence in YouTube in‑feed, your agent flags “Brand X shifted video-heavy this week, including these three creatives,” not “let’s copy them and reallocate $50k now.”
• Watch creative and offer rotation. Agents are already used to optimize thumbnails and creatives in environments like Netflix where models test variations and personalize in near real time, as described in a piece on media optimization from MarTech. You’re borrowing that same experimentation mindset, but pointing it outward: what price points, bundles, hooks, and formats are your competitors iterating through, and how fast?

• Map cross‑channel pressure. Because programmatic now accounts for more than 90% of digital display and AI systems routinely adjust bids and allocations on the fly, spend can slosh between channels multiple times a day. A well‑wired agent can watch those patterns from the outside and summarize, “Affiliate pushes dropped this week; paid search and retail media rose for these SKUs.”

The key is that “summarize” piece. You want ruthless compression, not raw feeds.

A good pattern is a daily or even intra‑day “market tape” written by your agent for humans: a short, opinionated memo that says “here’s what moved, here’s why it likely moved, and here’s what we should test next.” That mirrors the direction of the wider industry, where agentic marketing organizations use self‑optimizing systems to evaluate and modify creative, targeting, and budgets frequently, but still within a human‑governed framework, as MarTech notes.

Your job is to keep the agent’s scope ruthlessly narrow:

• Read‑only access to your own platforms and spy tools
• No ability to edit campaigns, budgets, or audiences
• No API keys that can approve spend

Even standards bodies are assuming this “trust, but verify” posture. The latest AAMP 2.3 specification from IAB Tech Lab is less about teaching agents new tricks and more about giving enterprises governance, privacy controls, and pricing guardrails so they can be trusted in production environments, as MarTech reported on the update. That’s the right mental model at the account level as well: if an agent can see everything but spend nothing, you de‑risk experimentation while you learn what it’s good at.

The payoff is that your human buyers stop wasting cognitive load on “what changed since yesterday?” and start focusing on “which 2–3 moves are worth trying because of what changed?” Agents turn the firehose of competitive and channel‑level data into a rolling, structured brief.

Only once you trust those briefs should you even consider giving an agent the keys to propose line‑item changes—and even then, the charge stays the same: watch first, recommend second, and never touch the wallet without a human nod.