AI-powered attack defense is exposing gaps in MFA and bot controls

At a glance

What this is: This is an Arkose Labs analysis of how AI-powered attacks are outpacing legacy bot, MFA, API, and awareness controls.

Why it matters: It matters because IAM and security teams need controls that detect adaptive abuse in real time, not just static authentication failures or obvious bot patterns.

Context

AI-powered attacks are changing the assumptions behind identity and access controls. When bots can mimic human interaction, relay MFA codes in real time, and distribute requests across networks, programmes built around static challenge-response logic or obvious anomaly thresholds stop being reliable.

For IAM, PAM, and fraud teams, the question is no longer whether MFA or rate limiting exists. The issue is whether those controls can detect adaptive abuse at the moment credentials, sessions, or API flows are being abused, before the attacker normalises traffic and blends into legitimate activity.

Key questions

Q: What breaks when AI-powered bots can mimic human behaviour at scale?

A: Static CAPTCHA and rule-based bot controls break first because they assume a stable difference between automation and real users. When bots adapt their timing, navigation, and interaction patterns, defenders need behavioural controls that evaluate sessions continuously instead of relying on a single challenge outcome.

Q: Why does reverse-proxy phishing create so much risk for MFA protected accounts?

A: Reverse-proxy phishing works because it relays a user’s login in real time, capturing both credentials and the MFA challenge response. The victim sees a legitimate looking site, while the attacker sits between the user and the real service. That allows session takeover even when the user successfully completes MFA, which undermines assumptions that a second factor alone stops account compromise.

Q: How should security teams reduce bot abuse without blocking legitimate users?

A: Use layered detection and adaptive friction rather than blunt blocking. Combine device intelligence, behavioural signals, velocity checks, and escalating challenges so suspicious traffic pays more to continue, while normal users retain a low-friction path. The goal is to raise attacker cost enough that abuse becomes uneconomical without breaking customer journeys.

Q: How should organisations connect fraud detection and IAM for AI-enabled attacks?

A: They should investigate bot activity, authentication events, and downstream account or transaction anomalies as one chain of trust failure. That gives fraud, IAM, and application teams a shared view of where the attack entered, how it persisted, and where containment should happen.

Technical breakdown

Why AI-trained bots break static challenge and CAPTCHA models

Traditional bot controls assume a visible difference between humans and automation. AI-trained bots reduce that gap by learning timing, cursor movement, navigation depth, and request patterns that resemble legitimate behaviour. Static CAPTCHAs and fixed rules struggle because the attacker is not trying to beat a single test once; they are continuously adapting to the control itself. That shifts bot defence from one-time verification to behavioural inference across sessions, devices, and transaction sequences. The more predictable the challenge, the faster it becomes part of the attacker’s training set. The real architectural problem is not volume alone but adversarial adaptation against the control surface.

Practical implication: Treat bot detection as an adaptive control loop, not a one-off gate.

How MFA compromise works through reverse-proxy phishing

MFA compromise in this context usually means reverse-proxy phishing, where an attacker relays the user’s real authentication flow through an intermediary site and captures the valid code or token in real time. The control failure is not MFA itself, but the assumption that possession of a second factor proves session integrity. Once the attacker can relay the challenge, the login looks legitimate to the identity provider. This is why real-time compromise detection matters: the decisive signal is not whether MFA was used, but whether the authentication path shows relay behaviour, impossible timing, or session characteristics inconsistent with the enrolled user.

Practical implication: Add compromise detection that evaluates authentication path integrity, not just successful second-factor use.

Why adaptive rate limiting is different from simple throttling

Simple throttling counts requests. Adaptive rate limiting evaluates the context of requests, including source diversity, interaction speed, session consistency, and whether behaviour looks human across distributed infrastructure. That matters because sophisticated bots do not need to exceed obvious thresholds. They can spread activity across many IPs or accounts and still achieve abuse at scale while staying under fixed limits. For API and web protection, the control has to understand the transaction pattern, not just the request count. In practice, adaptive traffic monitoring becomes a behavioural authorisation layer that separates legitimate variability from coordinated abuse.

Practical implication: Use behavioural rate controls for APIs and login flows that can distinguish distributed abuse from normal burst traffic.

Threat narrative

Attacker objective: The attacker seeks to obtain trusted access that can be reused for fraud, account takeover, and business-flow abuse without setting off legacy controls.

1. Entry begins when AI-driven bots imitate human interaction well enough to bypass legacy challenge systems and join login or API flows without triggering obvious automation flags.
2. Credential or session abuse follows when reverse-proxy phishing relays MFA codes in real time, allowing the attacker to capture an authenticated session rather than merely a password.
3. Escalation occurs as distributed traffic, credential stuffing, and human-targeted social engineering expand the attacker’s reach across accounts, endpoints, and business flows.
4. Impact is fraudulent access, unauthorized transactions, and wider service abuse that persists until adaptive detection, containment, or session invalidation interrupts the campaign.

Breaches seen in the wild

• BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.
• Malwarebytes breach 2021: SolarWinds attackers added a certificate to a dormant email security app's service principal at Malwarebytes and read internal email via Microsoft Graph.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI-powered attack defense is exposing a trust gap, not just a detection gap. The problem is not that enterprises lack security tools. It is that many controls still assume attackers behave in obvious, repeatable ways, while AI-enabled abuse adapts to the control in motion. That makes behavioural verification, session integrity, and response timing the decisive variables for identity programmes.

Bot defence has become an identity governance problem. Once bots can mimic legitimate users, the boundary between customer identity, fraudulent automation, and trusted session state becomes harder to maintain. Teams that treat bot controls as a web layer issue miss the governance question: who or what is being authenticated, and what level of trust is actually being granted? Practitioners need to align fraud, IAM, and app security around the same trust decision.

Reverse-proxy MFA compromise invalidates assumptions about second-factor assurance. MFA was designed for interactive users, not for adversaries that can relay a challenge in real time through an intermediary. The assumption that a completed MFA prompt means the session is trustworthy no longer holds when the authentication path itself can be hijacked. Practitioners must rethink how they evaluate authentication integrity, not just whether MFA was present.

Adaptive rate control is now part of least-trust architecture. Fixed thresholds are too easy to game when abuse is distributed across infrastructure and time. The more AI-enabled the attacker, the more the control must reason over patterns, not counts, and over sessions, not isolated requests. That pushes security teams toward controls that continuously reassess trust during the transaction, not after the fact.

Continuous training is necessary, but it cannot carry the full burden. Phishing simulations and awareness programmes remain relevant because social engineering is still part of the attack chain. But human education cannot substitute for controls that detect relay attacks, bot adaptation, and anomalous traffic paths in real time. Practitioners should treat training as one layer in a broader identity and fraud defence model.

What this signals

AI-powered attack defence now sits at the intersection of identity trust and fraud operations. Enterprises that keep bot mitigation, MFA assurance, and transaction monitoring in separate workstreams will keep missing the combined attack path. The practical shift is to treat authentication integrity and behavioural abuse as one control problem, not two.

Bot resilience is becoming a governance issue for access trust. If a login flow cannot distinguish a trained bot from a person, the access decision is already degraded before privilege is ever granted. That means practitioners should review where their identity programme still assumes static user behaviour and where it now needs continuous trust reassessment.

Continuous verification matters more than static control presence. The article’s core warning is that attackers adapt faster than fixed thresholds, one-time challenges, and periodic awareness campaigns. Security teams should expect their strongest signals to come from session-level correlation, not isolated events.

For practitioners

• Deploy behavioural bot detection Instrument login and transaction flows to detect interaction patterns, timing anomalies, and session reuse that indicate AI-trained automation rather than legitimate users.
• Add real-time MFA compromise detection Monitor for reverse-proxy relay patterns, token replay signals, and suspicious authentication paths so a successful second-factor prompt does not become a false trust signal.
• Replace static throttles with adaptive traffic controls Use source diversity, request sequencing, and transaction context to stop distributed abuse without blocking normal bursty customer behaviour.
• Run continuous phishing and social engineering training Pair awareness simulations with incident playbooks so employees learn to report suspicious prompts, credential capture attempts, and account takeover cues quickly.
• Correlate fraud telemetry with identity signals Join bot indicators, authentication outcomes, and downstream transaction anomalies so fraud and IAM teams can investigate the same attack chain together.

Key takeaways

• AI-powered attack defence is no longer just about blocking bots, because adversaries now adapt their behaviour to look legitimate across authentication and transaction flows.
• Reverse-proxy MFA compromise shows that a successful second-factor prompt does not guarantee session trust when the authentication path itself can be relayed.
• Teams need behavioural detection, adaptive traffic controls, and fraud-IAM correlation if they want to reduce attack success without overwhelming legitimate users.

Key terms

• AI Resistant Challenges: AI resistant challenges are verification methods designed to stay effective even when attackers use automation or generative models to solve them. They are intended to increase the cost of scripted abuse by requiring dynamic, context aware responses that are harder for bots to predict or imitate reliably.
• Reverse Proxy Phishing: A phishing method where an attacker places an intermediary server between the user and the real login service. The user signs in on a fake site that relays the authentication flow, allowing the attacker to capture live credentials and often MFA tokens during the legitimate session.
• Adaptive Rate Limiting: A traffic control method that adjusts blocking decisions based on context such as source diversity, interaction patterns, and session behaviour. It is more precise than fixed throttling because it can distinguish coordinated abuse from legitimate spikes and human variability.
• Session Integrity: Session integrity is the assurance that an authenticated connection remains trustworthy after sign-in. It covers token use, channel validation, and device posture, because attackers often target the session after the login event rather than the login event itself.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.