Impersonated AI agents complicate customer identity defenses
Automated traffic is increasingly difficult to classify by its declared identity alone. Examples tracked by Cequence Security in October show both attackers posing as consumer AI agents and genuine agents behaving like ordinary browsers. For organizations that manage customer sign-ins and account actions, the distinction matters most when traffic reaches authentication, payments or account-control functions.
In one week in October, an online marketplace recorded 414,210 visits that identified themselves as a widely used consumer AI agent. Every visit targeted the sign-in page and returned an error. Cequence said the traffic was actually a credential-stuffing operation, in which attackers used stolen username and password combinations against the marketplace. The volume attributed to the fake agent was about 1.5 times the total of genuine agent visits Cequence counted across five industries during the same week.
Legitimate agents can resemble routine browser traffic
A separate case involved a Tier 1 telecommunications carrier. The day after a major consumer platform launched a personal agent in September, automated traffic began appearing on the carrier’s sites. Over three weeks, activity grew from roughly 100 requests per day to a sustained 19,000 to 32,000 requests daily.
The agent traffic signed in, completed multi-factor authentication, reviewed bills, checked trade-in eligibility and added devices to carts. It presented itself as an ordinary desktop browser rather than identifying clearly as an agent. More than 270,000 transactions were scored as automated but not malicious, and the carrier allowed them to continue under monitoring.
Cequence described a browser-version change as a clue to the traffic’s automated operation. After a new version shipped, the carrier’s customers took about two weeks to adopt it. The agent traffic’s use of that version rose from almost none to around 98% in about 48 hours. The abrupt change was consistent with an operator updating a managed fleet of cloud browsers, according to the account of the incident.
These cases illustrate why a request’s user-agent label, or a bot score in isolation, may not be enough to establish whether a session is safe. A name associated with a recognized AI service can be imitated, while a legitimate agent may not distinguish itself from a conventional browser. Defenders therefore need to consider the sequence and purpose of actions within a session, not just the identity string accompanying the request.
Risk depends on what the session does
Most agent visits in Cequence’s separate sample were comparatively low impact. Across five industries in mid-October, the company examined 281,627 agent visits. It reported that 85% were reading pages or comparing products. About one in seven went further, entering workflows such as booking, buying, signing in or managing an account.
Those higher-impact activities intersect directly with customer identity controls. A session that reaches account access or account management can present a different risk from one that only reads public pages. The examples do not mean all agent traffic is malicious; rather, they show that organizations must distinguish useful automation from abusive activity while protecting sensitive actions.
Cequence recommends evaluating session behavior. In the marketplace example, repeated visits to the sign-in page that all fail were a sign of abuse regardless of the name the traffic claimed. The company also recommends applying added friction, including step-up verification and rate limits, at consequential points such as payments, payee changes and changes to account control. This approach aims to reserve stronger checks for actions with greater potential impact while allowing legitimate agents to access less sensitive parts of a service.
Behavioral signals can complement bot detection
Cequence also cited activity at a global consumer brand where behavioral analysis blocked 3.51 million unauthorized login attempts over 31 days. About 82% of that traffic scored too low to trigger conventional bot detection, the company said. In that case, analysis of behavior was the signal that exposed the attempts.
For identity and fraud teams, the reported figures underline a practical challenge: automated traffic can combine familiar browsing patterns, valid account workflows and misleading labels. Bot scoring remains one input, but session patterns and the sensitivity of the requested action can help determine when to allow, monitor or challenge a user or agent. The cases also point to the value of monitoring permitted automation, as the carrier did, rather than treating every automated transaction as either automatically benign or automatically hostile.
As consumer agents become part of online shopping and account management, customer-facing organizations will need controls that accommodate automation without relying on self-identification alone. The evidence presented by Cequence centers on a clear operational distinction: observe what a session attempts to do, and apply stronger identity checks where that activity could affect an account or transaction.
