Your Agentic Buyer Doesn't Know What It Shouldn't Trust

A buying agent that stays within budget can still burn your brand. PropellerAds' Q2 2026 Ads Safety data makes the case concretely: while total rejected campaigns fell 42% quarter over quarter (from 36,085 to 20,790), antivirus and malware-related rejections rose from 23.3% of rejected campaigns in Q1 to 45.9% in Q2, with the absolute count climbing about 14%. Fewer bad campaigns overall, but a sharply higher concentration of the dangerous kind. An autonomous agent optimizing on CPA alone would have chased that traffic harder, not slower.

That's the core problem, and it maps to a gap most B2B media ops teams haven't closed: performance signals and security signals live in different systems, governed by different teams, on different timelines. When a human is making every call, the mismatch is annoying. When an agent is making calls at machine speed, the mismatch is operational risk.

Spend Caps Are a Fence, Not a Filter

IAB's July 2026 Digital Video Ad Spend & Strategy Report found that 40% of buyers want humans in the loop for agentic AI, 36% want an audit trail, and 31% want explicit guardrails limiting what agents can do. The industry has internalized one half of the governance equation: constraining what the agent is allowed to do.

PropellerAds argues the other half matters more. Spend caps limit exposure, but they don't validate whether the inputs the agent acts on are trustworthy. A cap tells the agent "stop at $10K." It says nothing about whether the conversions inside that $10K came from clean traffic or from a source whose landing page behaves differently depending on who's looking.

Cloaking is the textbook example. PropellerAds' moderation data showed cloaking accounted for 67.3% of advertiser suspensions in Q2, barely changed from 68.1% in Q1. It persists because it exploits exactly the kind of context gap an autonomous agent can't see on its own: content that varies by location, device, or moment of inspection. The dashboard shows a clean storefront. The user gets the side door.

Two Feedback Loops, One Decision

PropellerAds frames the fix as a "second set of traffic lights" layered onto the performance loop. Green: both performance and security signals look clean, so the agent scales. Amber: a mild anomaly appeared, so the agent slows while gathering evidence. Red: a high-confidence security alert fires, and the agent pauses spend regardless of how strong the CPA looks.

For B2B SaaS teams, this mental model works even outside PropellerAds' platform. Security signals need enough authority to override a performance-driven scaling decision when confidence is high. That's a governance design choice, not a tooling question. It means defining, before the agent runs, which signals can trigger a pause and at what confidence threshold.

The trade-off is real. Adding a security-signal layer introduces latency. Some legitimate cheap inventory will get caught in amber while the system gathers evidence. Teams that skip the friction get speed; teams that accept it get fewer incidents where "the model decided" is the only post-mortem explanation anyone can offer.

Where Humans Still Earn Their Keep

IAB's 2026 Outlook found 96% of buyers are aware of agentic AI for ad buying, and 66% are increasing their focus on it. Meanwhile, an earlier IAB survey of 125 U.S. advertising executives found that 70% had experienced at least one AI-related incident, and 40% had to pause or pull ads. Awareness is high. So is the incident rate.

PropellerAds' own agent, NIKO, takes a position on this: it handles lookups (rates, targeting options, account stats) autonomously, but anything touching a campaign or budget requires explicit confirmation with full parameters shown before execution. That's a defensible design pattern for any team. Define three tiers: (1) actions the agent takes without approval (reads, lookups, recommendations), (2) actions requiring human sign-off above a threshold (budget changes, new inventory sources, targeting shifts), and (3) actions that trigger an automatic pause pending review (security flags, traffic-quality anomalies, supply-path changes).

The audit trail sits underneath all three. What did the agent see? Which signals weighted its decision? What changed between the last approved state and the current one? Reed Smith's legal guidance reinforces this: define an agent's authority contractually and pair vendor assurances with independent audits, advertiser-side measurement, and access to log-level data.

The Guardrail You're Probably Missing

Most teams building agentic buying workflows start with spend limits and approval gates. Those are necessary. They're also the easy part. The harder question is whether your agent can distinguish between a conversion that's genuinely cheap and one that only looks cheap because the traffic behind it hasn't been flagged yet.

PropellerAds' contribution here is specific: treat malware and traffic-quality signals as first-class inputs to the optimization loop, not as a post-hoc audit. For B2B brands, where trust and security posture are part of the product story, that principle extends beyond ad fraud into brand credibility. An ad served alongside malicious content doesn't just waste budget. It contradicts the thing you're selling.

If you're standing up agentic buying, the hypothesis worth testing: add a security-signal layer that can override scaling decisions at high confidence, then measure whether incident rate drops without a proportional loss in qualified pipeline. The stop-loss: if qualified volume falls more than 15-20% with no corresponding improvement in traffic quality or incident reduction, the layer is too aggressive and needs recalibration. But start with the layer in place. Loosening guardrails is always easier than explaining to the board why the agent scaled into a malware source while the CPA looked great.