TL;DR: AI agent traffic can be detected today using updated versions of familiar antibot techniques, according to HUMAN, because many agents still rely on Selenium, Playwright or Puppeteer while varying browser, network and interaction signals. The governance shift is from origin-based blocking to intent-aware control that classifies what an agent does, not what it claims to be.
At a glance
What this is: This research argues that AI agent traffic is already detectable through updated antibot methods, with recurring fingerprints in browser behavior, extensions, DOM changes and interaction patterns.
Why it matters: It matters because IAM and security teams need to govern agent activity by intent and privilege, not assume every automated session is either fully trusted or fully hostile.
Context
AI agent detection sits at the intersection of web security, fraud controls and identity governance because the challenge is no longer only whether a session is automated, but whether the automation is acting with delegated authority. Traditional allow or block rules break down when an agent can present as a browser, inherit consumer device characteristics and still execute actions at scale.
The article’s core problem is visibility into sessions whose outward signals resemble normal traffic while their behaviour reveals machine-driven execution. That is a familiar control gap in modern security programmes: when identity and intent are inferred from weak signals, defenders lose confidence in whether access should be treated as human, benign automation or delegated agent activity.
Key questions
A: Security teams should classify automated traffic server-side before it reaches the application, then apply controls based on trust, intent, and observed behaviour. That means separating legitimate automation from malicious bots, scraper activity, and partner integrations, while using risk-based scrutiny for anything not yet trusted. The goal is to preserve access for valid automation without creating openings for fraud, account takeover, or abuse.
Q: Why do browser fingerprints and user-agent strings fail to identify many AI agents?
A: Because modern agents can inherit consumer-like device characteristics, rotate identifiers and operate inside real browser environments that look legitimate at the header level. Simple indicators often miss the injected scripts, helper components and behavioural patterns that reveal automation. Effective classification requires combining header data with runtime evidence, not relying on a single field.
Q: What are the signs that an AI agent session is drifting out of policy?
A: Look for unexpected tool calls, suspicious command sequences, credential exposure attempts, memory manipulation, or changes that exceed the user's stated objective. Those signals indicate that the agent is no longer acting within the intended task boundary. The key is to evaluate the whole sequence, not any single isolated event.
Q: What is the difference between benign automation and delegated agent activity?
A: Benign automation performs predefined tasks within a narrow scope, while delegated agent activity makes runtime decisions, executes actions in a live browser and may change tactics as context changes. The governance difference is critical: delegated agent activity needs policy, audit and revocation controls because it can act with operational latitude that simple scripts do not have.
Technical breakdown
How AI agents inherit familiar automation fingerprints
The article shows that most AI agents still run through established automation engines such as Playwright, Selenium and Puppeteer. That matters because these frameworks leave detectable traces in browser execution, DOM structure and scripting behaviour even when the agent tries to mask itself. A browser session may look human at first glance, but injected elements, helper scripts and execution artifacts can reveal the automation layer underneath. In practice, the defensive question is not whether automation exists, but whether the session is behaving like a controlled browser process or an ordinary user interaction. See the Agentic AI Security Guide.
Practical implication: Treat automation-framework fingerprints as one signal in a layered detection model, not as a standalone trust decision.
Why network and browser signals alone are not enough
AI agents can reuse consumer-like device characteristics, rotate identifiers, inherit hosted infrastructure and operate inside full browser environments. That means IP address, user agent string or static browser version checks often provide only partial visibility. Effective detection needs correlation across network context, browser authenticity, execution environment and interaction behaviour. This is especially important where a session is technically valid but still misaligned with policy, because the same infrastructure can support benign automation, scraping, fraud or agentic commerce depending on intent. Read Zero Trust for AI Agents.
Practical implication: Correlate network, browser and behavioural signals before you classify a session as safe, abusive or suspicious.
How DOM and extension fingerprints expose agent activity
The article’s examples show how agent-specific DOM elements and bundled browser extensions create durable fingerprints. A persistent injected div, a known extension resource or a helper script can become a reliable marker that a session came from a specific AI agent rather than a human browser. These are not new attack techniques, but they are high-value detection opportunities because they can be tied to a named agent and used for session attribution, triage and policy enforcement. The mechanism is simple: what the browser loads and modifies often tells you more than what the header claims. See the AI Agent Observability, Audit and Incident Response Guide.
Practical implication: Log agent-specific DOM and extension artefacts so you can attribute sessions and apply policy consistently.
Threat narrative
Attacker objective: The attacker objective is to operate at scale inside browser-mediated workflows while avoiding detection, attribution and policy enforcement.
- Entry begins when an AI agent launches a browser session and interacts with a target site through ordinary web flows or APIs.
- Credential or identity signals are then obscured by automation libraries, inherited device characteristics, spoofed browser traits or bundled extensions.
- Escalation occurs when defenders fail to distinguish delegated agent activity from trusted human use, allowing policy drift, scraping or abuse to continue at scale.
- Impact is the loss of reliable session attribution and enforcement, which weakens fraud controls and identity governance across the customer journey.
Breaches seen in the wild
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
- AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
AI agent detection is becoming a governance problem, not just an antibot problem. The article makes clear that the question is no longer whether automation exists, but whether the organisation can distinguish benign automation, delegated agent activity and abusive use in time to act. That pushes the control boundary from perimeter blocking toward session-level policy, attribution and revocation. For identity teams, this is a direct challenge to static trust models built around a single login event.
Behavioural visibility is the missing control plane for agent traffic. IP reputation and user-agent checks are too coarse when agents can inherit consumer characteristics, rotate signals and operate in full browsers. The practical distinction is between what a session claims and what it actually does across time, which is why layered signal correlation matters. Organisations that cannot inspect execution, interaction and browser integrity will misclassify agent sessions. That makes the control plane behavioural, not header-based.
Agent-specific fingerprints create a named concept we should treat seriously: browser-mediated identity drift. When an agent changes the browser environment, injects DOM artefacts or loads proprietary extensions, the identity of the session becomes detached from ordinary user assumptions. That drift is not a technical curiosity; it is the point where access governance starts to fail. Agent identity has to be tied to runtime evidence, not a single authentication event, or enforcement will lag reality.
Intent-based enforcement is the right model for agentic traffic. The article’s three-step framing aligns with a broader principle: access should be governed by purpose and impact, not by origin alone. A session can be automated and still legitimate, or human and still abusive. The mature model is to classify actions as they unfold, then allow, restrict or block according to policy. Practitioners should expect agent governance to converge with identity, fraud and web security controls.
Agent observability is now part of fraud resilience and access governance. If a session can be attributed only after the fact, the organisation has already lost meaningful control. The stronger posture is to identify agent behaviour in-line, maintain auditability and make enforcement decisions before the session drifts outside policy. That is the operational difference between seeing automation and governing it.
From our research library:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
- Read next: AI Agent Observability, Audit and Incident Response Guide
What this signals
Browser-mediated identity drift: AI agents change the practical meaning of a browser session by mixing delegated authority, automation artefacts and human-like presentation. Defenders should expect trust decisions to move from authentication events toward continuous session evidence, because the session itself can no longer be assumed to represent one stable identity.
The control implication is straightforward: teams need policies that classify agent intent in real time and that can narrow or revoke actions as the session unfolds. Without that, organisations will either overblock useful automation or undercontrol sessions that behave like humans only at the surface.
Agent governance will increasingly converge with fraud, web security and identity telemetry, especially where applications expose high-value customer journeys or payment actions.
For practitioners
- Build layered agent detection logic Correlate browser authenticity, network context, execution environment and interaction behaviour before deciding whether a session is human, benign automation or an AI agent.
- Instrument agent-specific fingerprints Log DOM artifacts, helper extensions and injected scripts that recur across sessions so analysts can attribute specific AI agents and triage them consistently.
- Separate allowed automation from abusive automation Define policy states for safe, malicious and misaligned agent activity so the same session can be permitted, limited or blocked based on intent and impact.
- Add session-level governance to identity workflows Treat delegated browser sessions as identities with lifecycle, audit and revocation needs rather than as anonymous traffic events.
Key takeaways
- AI agent detection is no longer about spotting obvious bots. It is about correlating behaviour, browser integrity and execution artefacts to distinguish human, benign automation and delegated agent activity.
- The article’s evidence shows that familiar automation stacks still underpin many AI agents, which means existing antibot techniques remain useful when they are upgraded for runtime correlation.
- Identity and access governance must move toward session-level policy, because a single login event is too weak to govern browser-mediated agents that can change behaviour after authentication.
Related NHI Mgmt Group resources: Agentic AI Identity Guide · Zero Trust for AI Agents · AI Agent Observability, Audit and Incident Response Guide · Agentic AI Security Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI09 — Human-Agent Trust Exploitation | The article centres on distinguishing human users from agent-driven sessions and the trust errors that follow. |
| Recommendation — Model AI agent sessions as trust-sensitive actors and verify behaviour continuously before granting broad actions. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | AI agent traffic is evaluated through browser-session trust and identity signals that can be spoofed or inherited. |
| Recommendation — Require stronger runtime verification for agent sessions instead of trusting static browser or header claims. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about governing what an AI-driven session is allowed to do once it is identified. |
| Recommendation — Map agent activity to entitlement checks and narrow actions when session evidence changes. | ||
| MITRE ATT&CK | TA0003;TA0005 — Persistence; Stealth | The research discusses evasion, spoofing and long-running automated sessions that evade detection. |
| Recommendation — Hunt for stealthy automation patterns that persist across sessions and adapt their presentation. | ||
| NIST AI RMF | GOVERN — AI Governance and Accountability | The article’s intent-aware enforcement model depends on governance over AI system behaviour. |
| Recommendation — Assign governance owners for AI session policy, auditability and response decisions. | ||
Key terms
- AI Agent Traffic: AI agent traffic is the flow of prompts, tool calls, and returned data exchanged between an autonomous agent and the systems it uses. This traffic can carry secrets, sensitive records, or unsafe instructions. Security controls must inspect both the content and the action the agent is allowed to take.
- Browser-Mediated Identity Drift: The weakening of a session’s identity assumptions when an AI agent changes browser state, injects artefacts or operates through a managed extension. The session no longer maps cleanly to a human user, so access decisions must rely on runtime evidence rather than login alone.
- Context-aware Enforcement: Context-aware enforcement is policy that changes based on live conditions such as data sensitivity, environment, or task type. For AI agents, it is the difference between a static permission grant and a control that adapts to what the agent is trying to do right now.
- Automation Fingerprint: A repeatable technical indicator left by an automation framework, browser helper or scripted interaction. It can include DOM elements, extension artefacts, timing patterns or execution inconsistencies that reveal machine-driven activity even when the session appears human-like.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity and machine identity security. It gives identity and security practitioners a common control vocabulary for delegated access, lifecycle governance and policy enforcement.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org