Battling bots in the age of AI

Malicious bots have become masters at aping legitimate human behaviour. Traditional bot defence relies on browser signals such as CAPTCHAs, JavaScript puzzles, device and machine fingerprints, as well as TLS characteristics. But attackers can now run real browsers that can solve CAPTCHAs, pass puzzle runtimes, and present clean fingerprints at scale,making these bots indistinguishable from real customer sessions.

In fact, these bots can rotate through behavioural profiles so rapidly that any policy written against an individual signature becomes obsolete before it can even be enforced. In one recent attack, 297,556 distinct behavioural profiles were generated in a 24-hour window. That’s one new variant every 300 milliseconds, which means any approach based on identifying and blocking signatures will continually lag behind.

What’s more, these verification methods are fast becoming redundant because of the shift to autonomous agentic AI. Native agentic commerce is already live across ChatGPT, Amazon, Google's Agent Payments Protocol (AP2), Visa's agentic commerce standard, and Stripe's payment primitives. In these purchasing chains, verification is often no longer relevant because the AI agents operating on behalf of real customers are operating in headless environments where these puzzles don’t even run.

Then there’s the matter of the architecture. Agentic AI typically utilises MCP servers due to the ease with which they provide access and this has catapulted MCP to become a major commerce channel to rival that of web, mobile, and APIs. Those agents traversing MCP don’t even need to use browsers at all, neatly sidestepping verification altogether. And lastly, fast-moving AI-driven companies are finding these verification measures are just too time- and resource-intensive.

Not fit for purpose

What this reveals is that existing client-side protection mechanisms aren’t architected for AI-driven traffic. Even fingerprinting the bot, which involves examining the header ordering, encoding declarations, and Accept values of a script and how these differ from a real browser session navigating the same page, is no longer applicable. That sees the same fixed feature set used across every customer, endpoint, and traffic pattern which the attacker can study and when the attacker retools, it can’t be adapted. However, new ways are now emerging of fingerprinting agentic AI traffic and verifying the authenticity of the connection.

It’s now possible to build a behavioural model of intent, for instance, specific to each application. This effectively creates a living map of how real users navigate a particular flow and because the model is application-specific and behaviour travels with the client, one detection layer covers the full surface, be that web, mobile, API, or Agentic AI including MCP.

The intent of a user, bot, or AI agent can then be mapped using five segments to create a composite picture. This composability is key because detection can be assembled from the signals that present a specific threat, rather than from a fixed set the attacker has had time to study. So when the behaviour shifts, the behavioural graph is then able to shift with it, which means that, should the attacker rotate one element of their approach, the other four dimensions still hold true, enabling the behavioural intent to continue to be tracked.

Let’s say a bot attack is underway against a retail platform. The security team initiates blocking policies and the attacker then responds, iterating in real time by rotating identifiers, restructuring request flows, and probing for the edges of what was being blocked. With a traditional static fingerprint, that kind of rotation would eventually succeed because changing enough surface-level characteristics would see most signature-based approaches let the new variant through. But as each change in the attack will only affect one dimension of the behavioural graph, it will not alter the intent of what the attack is trying to accomplish. Each new variant the attacker introduced can therefore be captured and added to the blocking policy automatically, preventing the attacker from moving forward.

How bots can prove they are bona fide

While this helps resolve the issue of agentic AI bot detection, it doesn’t address the problem of verification, however, namely whether the bot is acting legitimately on behalf of a real user. What is needed is a replacement for the current jumble of CAPTCHAs, puzzles, SMS codes, and email verification methods that bots can simply work around and which are becoming less expensive to attack at scale.

However, the problem can be solved by using a hardware-based form of verification which would kick-in when bot detection flags a session that falls outside accepted boundaries. For low-risk actions, agents will be able to operate freely but where verification is required, a human needs to be inserted in the loop. At this point, the human user is compelled to complete a familiar biometric interaction such as Touch ID, Face ID, or Windows Hello, enabling the device to return a signed proof that a real person on a registered device completed the action.

Such an approach removes the barrier created by traditional approaches by only applying verification at the point of the transaction. So, for high-stakes, irreversible actions such as wire transfers, record retrievals, or contract modifications, human verification would only be required at the time of the action rather than at the front door. This has the potential to significantly streamline workflows in financial services, healthcare, B2B commerce, and regulated API surfaces in general.

There’s no doubt that agentic AI is transforming the role of bots across sectors but it’s more imperative than ever that we learn to discern between those bots that are acting legitimately versus those acting maliciously. That’s simply not possible with current approaches to monitoring and verification which bots have learned to defeat. But by rethinking how we deliver behavioural detection and how we can provide friction-less verification across web, mobile, API and agentic AI channels, we can protect these channels and create a secure AI-first ecosystem.