AI agents and customer traffic: what changes for security teams?

TL;DR: AI traffic rose 393% year over year in Q1 2026, converted 42% better than regular customers in March, and is now colliding with faster model capability gains, according to Kasada, while underground marketplaces and booking-data breaches are also changing fraud economics. The result is a governance problem: teams must distinguish legitimate agentic sessions from adversary automation and stop treating agent-shaped traffic as inherently suspicious.

Editorial analysis by NHI Mgmt Group, based on content published by Kasada: “Top Threats We're Tracking in April”.

By the numbers:

• AI traffic rose 393% year over year in Q1 2026.
• AI traffic converted 42% more than regular customers in March 2026.
• The coding benchmark SWE-bench Verified went from 60% to nearly 100% in a single year.

Key questions

Q: How should security teams distinguish authorised AI agents from malicious bots?

A: Start by separating traffic classification from identity assurance.

Q: Why do AI agents change fraud and identity risk so quickly?

A: Because they compress discovery, validation and action into one flow, which reduces the time defenders have to separate legitimate automation from abuse.

Q: What are the signs that agentic traffic is being abused?

A: Look for unusually persistent sessions, high-conversion paths that still trigger support or recovery actions, and traffic that carries the shape of a legitimate referral but behaves like a scripted operation.

Practitioner guidance

• Differentiate legitimate agents from abuse automation Instrument referral source, session cadence, transaction intent and downstream conversion so that agentic shoppers, scraping services and fraud tooling are not forced into the same policy bucket.
• Map fraud controls to brokered supply chains Track the services that enable compromise, including account markets, KYC bypass, SIM supply and laundering channels, then align monitoring and disruption to those dependencies.
• Rebaseline bot and fraud thresholds for agentic commerce Review rules that were tuned for low-conversion automation and update them for high-conversion, high-persistence sessions that may still be abusive.

Bottom line: AI-driven shopping and agent-shaped traffic are now part of normal commerce, which makes simple human-versus-bot assumptions less useful for access and fraud control.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →