All Articles

You may have heard the statistic that there are more bots on the internet than humans now (Cloudflare data from 2025). An increasing segment of that traffic is AI agent visitors. Most of these are not directly harmful. They might be crawlers or chatbot agents fulfilling tasks for users. But a small minority of them cause massive damage.

They test stolen credit cards. They create fake profiles to redeem rewards. They make fake purchases that lead to chargebacks.

None of those fraud vectors are new. But AI agents make it cheaper and easier for attackers to deploy attacks. Oh, and they are much better at avoiding detection.

The side's internal testing showed 81% of their test runs slipped past bot detection from major platforms like Cloudflare and Akamai. Researchers at the University of California arrived at a similar conclusion from a different angle. That investigation showed that traditional detection tools caught just 1 out of every 7 browser agents. The same research pointed to browser fingerprinting and behavioral analysis as the strongest detection methods available, something cside's browser engineers have also validated through live testing. Some examples of behavioral signals to watch for are covered in the article How to Detect AI Agent Traffic on Your Website.

cside’s Future of Web Security 2026 report concluded a number of findings:

1. User discussions of bot traffic that got through traditional defenses spiked by 275% throughout 2025.
2. The usual suspects when it comes to automated traffic (China, Iran, and Russia) continue to take the lion's share of ‘malicious’ bot traffic (either directly malicious or with no apparent commercial intent, using up server resources).
3. Of web security practitioners surveyed, only 37% said they were adding specialized mechanisms against AI agents. The majority (63%) are still relying on traditional bot detection like CAPTCHAs. But of the segment that is using specialized mechanisms there was a common thread that they witnessed traditional bot detection failing. It may be that certain teams are lagging behind and waiting for a clear catalyst to push them towards specialized tooling.

It is clear that new detection methods are required to properly stop AI agent fraud on websites. Different AI agent detection solutions are tackling this differently. Enterprise bot management platforms are adding “agentic trust” features that require you to buy into the whole platform while other companies give mid-market or small business teams the data they need to fight against this fraud without needing to buy a full suite.

The blurring line between helpful and harmful

Not all AI agents on your site are a problem. The challenge is that the dangerous ones are designed to be indistinguishable from the helpful ones.

Platform crawlers are straightforward. OpenAI's bot crawls your site to train models and index content. Google does the same for search. These agents serve the platform, not any individual user, and they almost always identify themselves.

Consumer agents are the new category that's growing fast. When someone asks ChatGPT to check flight prices or uses a browser extension to auto-fill an application, an AI agent hits your site on their behalf. These are doing legitimate work for a real person.

Malicious agents look almost identical to consumer agents in their technical fingerprint. Same real browsers. Same interaction patterns. But instead of filling out one form for one user, they're testing stolen credit cards across thousands of sites, stuffing credentials into login pages, or scraping your content for resale.

A consumer agent filling out a form on your site and a fraudulent agent doing the same thing on 10,000 sites can produce nearly identical signals in your server logs. That's the core problem.

AI is rewriting the account takeover playbook

Account takeover isn't new. What's new is how AI compresses the entire attack chain into something faster, cheaper, and harder to catch.

Getting the credentials

The first step in any account takeover is acquiring a valid username and password. AI has opened up vectors here that didn't exist two years ago.

Voice cloning is the most unsettling one. An attacker scrapes a few public interviews of a company executive, trains a voice model, and sends a convincing voice message to an employee asking for login credentials. The tools to do this are commercially available and improving monthly.

Then there's the password supply chain problem. The explosion of AI-generated apps (sometimes called "vibe-coded" apps) has created a massive new surface area for credential leaks. These apps ship fast, often with security holes that a traditional dev process would catch. Users sign up with passwords they reuse across their bank, their email, their work tools. When the app gets breached, those credentials end up on dark web marketplaces and become ammunition for the next stage of the attack.

Testing at scale with reasoning

Traditional credential stuffing is a numbers game. Throw thousands of username-password combos at a login page and see what sticks. AI-driven stuffing is fundamentally different because the agent can reason.

Consider this scenario: an attacker buys a leaked password but doesn't have the associated work email. A traditional bot would be stuck. An AI agent can search the company's website, find the employee's name on the team page, infer the email format from the domain, and start testing. That's not brute force. That's reconnaissance compressed into seconds.

These agents also defeat the defenses that were built for dumb bots:

• CAPTCHAs get solved at rates that match or exceed human accuracy
• Request timing gets varied so rate limiters don't trigger
• Each attempt routes through a different residential IP, making it look like normal traffic from different locations
• The agent runs in a real browser, so headless-browser detection sees nothing unusual

Why the old playbook doesn't work

Traditional bot detection was designed around a simple question: is this a bot or a human? The signals it looks for (headless browsers, data center IPs, scripted timing patterns, missing browser APIs) assume bots are fundamentally different from real users.

AI agents broke that assumption. They use real browsers. They come from residential IPs. They interact with pages in ways that look organic. The binary "bot or not" framework produces false negatives on the agents you need to catch and false positives on the consumer agents you should be letting through.

The detection gap shows up in hard numbers. In the UC Davis study, their behavioral detection system identified all seven AI agents tested. The industry-standard bot detection they benchmarked against caught one out of seven. That's not a marginal improvement. That's a category difference.

What actually works now

The tools that are getting results against AI agents have moved past the binary question entirely. Instead of asking "bot or not," they're asking three things:

1. Is this an AI agent? Using a combination of browser-level artifacts and behavioral signals that are difficult to fake even in a real browser.
2. Which agent is it? Identifying whether it's a known platform (Perplexity, Claude, ChatGPT) or an unknown entity trying to stay hidden.
3. What does the behavior suggest? One form fill is normal. Hundreds of login attempts with varied credentials from rotating locations is not.

The UC Davis research confirmed something practitioners in this space have been seeing: browser fingerprints alone aren't enough because many AI agents share the same underlying browser engine. But behavioral fingerprints (typing cadence, scroll patterns, mouse dynamics) are highly distinctive. They reliably separate AI agents from humans and from each other.

The two paths for defenders

The market is splitting into two camps for companies that want this capability.

Full-platform solutions bundle AI agent detection into larger anti-fraud suites. They offer deep behavioral analysis and managed workflows, but they come with enterprise pricing (tens of thousands annually) and long contracts. If you have a dedicated fraud team and budget, they deliver.

Focused detection tools take the opposite approach. They surface the raw behavioral signals and let you integrate them into your existing fraud logic. The tradeoff is more DIY setup, but you're paying hundreds instead of tens of thousands and you can be running in days instead of months. For teams that already have fraud workflows and just need the AI-agent signal layer, this is often the faster path.

The uncomfortable forecast

The same capabilities that make AI agents useful for booking flights and filling out forms make them devastating for fraud. They reason, adapt, and blend in with legitimate traffic. Every improvement in consumer AI agents is simultaneously an improvement in the attacker's toolkit.

Account takeover losses hit $17 billion in 2025. The Merchant Risk Council's latest report flags it as a top attack vector for online merchants. And we're still in the early innings of AI agents becoming mainstream.

The companies that will weather this well are the ones treating AI agent detection as its own discipline, not an afterthought bolted onto legacy bot protection. The detection methodology exists. The question is whether you adopt it before or after the credential stuffers find you.