AI agent traffic is rewriting fraud prevention and access trust

At a glance

What this is: Arkose Labs argues that agentic AI traffic is blurring the line between legitimate automation and fraud, so conventional bot signals are no longer enough to separate trusted activity from abuse.

Why it matters: IAM, fraud, and access teams now need classification and authorisation controls that can distinguish authorised agents, ambiguous automation, and malicious traffic without blocking legitimate integrations.

Context

Agentic AI traffic now reaches login and signup surfaces in ways that make benign automation and attacker activity appear technically similar. In practice, that means the old fraud model, which relied on obvious bot signals, is breaking down at the exact point where access decisions are made.

For identity and access programmes, the problem is not simply volume. It is that autonomous systems can behave like users, partners, or adversaries at the same time, forcing teams to shift from binary bot blocking to trust classification and governance at the point of entry.

Key questions

Q: How should security teams detect AI agent traffic without blocking legitimate customers?

A: Security teams should use layered detection that combines browser, network, and behavioural signals rather than relying on a single indicator. The goal is to classify traffic in real time, distinguish trusted automation from malicious bots, and apply policy only when confidence is high. That reduces payment fraud and avoids unnecessary friction for legitimate users and customers.

Q: Why do traditional fraud controls miss agentic AI abuse?

A: Because many old signals, including proxies, automated browsing, and fingerprint changes, now describe both legitimate integrations and attacker tooling. The controls fail when they assume automation equals maliciousness. Effective programmes need contextual signals that bind traffic to a known business function and a verified actor.

Q: What breaks when login and signup controls only look for bots?

A: You either block real integrations or allow hostile automation through, and both outcomes are expensive. A binary bot model cannot separate partner workflows, customer automation, and account takeover traffic when they share the same technical footprint. The failure is at classification, not just detection.

Q: What should teams do when an automated actor cannot be confidently identified?

A: Contain it, limit it, and force a faster review path before it reaches high-value actions. The goal is not to reject every unknown system, but to prevent unidentified automation from inheriting trust by default. Ambiguity should trigger restricted access, not broad permission.

Technical breakdown

Why traditional bot signals no longer separate agents from attackers

Classic fraud controls look for impossible travel, device fingerprint drift, repeated login failures, and proxy abuse. Agentic AI changes the shape of the problem because both legitimate automation and malicious campaigns can use browsers, residential infrastructure, synthetic identities, and API-driven flows. The key technical issue is that the observable transport layer no longer reveals intent. That means the control surface moves upward from traffic features to authorization context, business correlation, and verified identity of the calling system. In other words, the question is no longer whether a session is automated, but whether the actor behind it is expected and permitted to perform that action.

Practical implication: classify traffic by authorised actor and allowed action, not by automation alone.

How modern fraud detection distinguishes legitimate automation from abuse

The article points to newer signals such as endpoint behaviour consistency, rate-limit boundary respect, robots.txt adherence, correlation with real business events, and failure patterns that remain stable across repeated challenges. These are stronger than old bot heuristics because they test whether an agent behaves like a known business process rather than a random scraper or stuffing operation. The technical challenge is that these indicators are probabilistic, not definitive. That pushes detection away from a single block or allow decision and toward layered scoring, identity binding, and contextual policy enforcement at login, signup, and account recovery.

Practical implication: build multi-signal scoring around business context and action intent, not just network or device fingerprints.

Why access trust is becoming a governance problem

The article reframes the issue from fraud detection to governance because blocking all automation breaks valid integrations, while allowing all automation creates abuse paths. That creates an identity decision problem: who may act on behalf of a customer, a processor, or an internal workflow, and under what conditions? For practitioners, this is where classification and entitlement design meet runtime enforcement. A traffic source that is technically identical to an attacker may still be legitimate if it is authenticated, bounded, and mapped to an approved business function. The governance gap is that many access models still assume a human behind the request.

Practical implication: move authorisation decisions closer to runtime and bind every agent to a known business role or workflow.

Threat narrative

Attacker objective: The attacker aims to obtain trusted access, complete fraudulent account actions, or scale account takeover while avoiding ordinary bot-detection controls.

1. Entry occurs through login, signup, and account recovery surfaces where AI agents can blend in with legitimate business traffic or attacker automation.
2. Credential abuse follows when malicious agents use stuffing, high-speed retries, or other automated access attempts that resemble normal integrations at the transport layer.
3. Impact appears as account takeover, fraud escalation, or disrupted operations when defenders cannot reliably separate authorised automation from hostile traffic.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Authorization is replacing bot detection as the decisive control plane. Once agentic AI traffic can look the same as legitimate business automation and attacker tooling, the old fraud question loses value. The control boundary shifts to whether the actor is known, bound to an approved purpose, and limited to an expected workflow. Practitioners should treat this as a runtime access-governance problem, not just a fraud-signal problem.

Trust classification is the new perimeter for login and signup surfaces. A traffic source that is technically identical to an attacker can still be legitimate, but only if it is authenticated, attributable, and tied to a defined business function. That changes the security model from block-or-allow to classify-or-contain, which is a material shift for IAM, fraud, and partner-access teams.

Modern fraud indicators create a named control gap: identity ambiguity at the point of entry. The article shows that behavioural signals, proxy use, and synthetic fingerprints no longer map cleanly to malicious intent. That means programmes built on legacy bot heuristics are now under-detecting abuse and over-blocking valid integrations. The practitioner conclusion is that access governance must start before the session is trusted, not after it is judged.

Agentic traffic forces identity programmes to unify customer access, partner access, and machine access thinking. The same surface can host a customer service bot, a payment processor, and a stuffing campaign. That convergence means teams can no longer keep fraud, IAM, and non-human access decisions in separate operating lanes. The practical outcome is a single classification policy for automated actors across external and internal flows.

Economic disruption is becoming a control strategy, not just a fraud side effect. When unknown agents must be evaluated fast and malicious agents are forced to spend more requests to achieve the same outcome, the attacker economics change. That does not remove the need for authorization, but it does show that governance can be used to raise cost and reduce scale. Practitioners should measure trust decisions by how well they separate value from abuse.

From our research library:

• 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
• 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Security Guide

What this signals

Identity ambiguity at the point of entry: this is the control problem that agentic traffic exposes. When login and signup surfaces cannot reliably distinguish a partner workflow from a hostile automation run, programme owners need classification, attribution, and policy binding before access is granted.

Fraud teams and IAM teams are converging on the same decision point: whether the actor is permitted to do what it is trying to do. That means machine access governance, partner access governance, and customer access governance can no longer be treated as separate problems.

The strongest programme response is not to chase every new fingerprint. It is to reduce trust in unknown automation until the system can prove purpose, provenance, and acceptable action scope.

For practitioners

• Define an agent classification policy Separate known partners, ambiguous automation, and malicious traffic into distinct decision paths at login, signup, and recovery surfaces. Bind each path to an explicit allowed action set and business owner so runtime decisions are auditable.
• Replace binary bot rules with scored authorisation Use behavioural consistency, rate-limit respect, business-event correlation, and challenge response patterns together. Do not let any single fingerprint or proxy signal decide trust on its own.
• Inventory all automated entry points Map where customer service tools, payment processors, crawlers, and internal automations touch authentication flows. Identify which systems can present as human-like traffic and which require dedicated non-human identity handling.
• Create a fast review path for ambiguous agents Route unidentified automation to temporary restrictions until its role, purpose, and provenance are confirmed. Keep the review workflow separate from standard user support so access decisions stay fast enough for operational use.

Key takeaways

• Agentic AI traffic is collapsing the old distinction between bot detection and access authorisation at consumer and partner-facing entry points.
• The practical failure is not just missed fraud, but also false positives that block legitimate integrations and customer automation.
• Teams need classification, attribution, and runtime policy binding so unknown automation is restricted before it is trusted.

Key terms

• Agentic Traffic: Traffic generated by software that can act on behalf of a user or process with some degree of independent decision-making. In fraud prevention, it includes both legitimate assistants and malicious automation, so the control question becomes intent and behaviour, not automation alone.
• Trust Classification: Trust classification is the policy distinction between approved instructions and untrusted content. It matters because agentic systems must treat low-trust input as data, not directive content, or prompt injection can convert ordinary text into unsafe behaviour.
• Authorization Context: Authorization context is the information used to decide whether an identity should be allowed to act. It can include workload state, environment, time, risk, and task intent. In modern PAM, richer authorization context is what separates a secure decision from a merely authenticated one.
• Behavioural Signal: A pattern in how a user acts over time that can help distinguish normal activity from abuse. In fraud operations, behavioural signals include timing, repetition, device consistency, channel switching, and claim history. They are most useful when combined with human review and case context.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.