Behavioral biometrics can tell you that something on your site doesn’t move like a person. It can’t tell you what that something is, who sent it, or what it should be allowed to do. With AI agents now logging in, browsing and transacting on behalf of real customers, those are the questions that matter.
When banks and retailers first see agentic traffic in their logs, the instinct is to reach for the tool that has caught bots for a decade: watch how the session types, scrolls and moves the mouse, and flag anything that isn’t human. It’s a reasonable first move. It’s also a strategy with an expiration date.
What behavioral biometrics was built for
Behavioral biometrics answers one question well: is this interaction coming from a human or a script? It earned its place against credential stuffing, scraping and account-takeover bots.
Those attacks shared a weakness. Scripts typed at perfectly even intervals, clicked the exact center of buttons, teleported the cursor and never hesitated. Against that kind of automation, behavior was a strong signal, because the attacker had no reason or ability to fake being human.
Agents can learn to look human
AI agents remove that weakness. Behavior is just output, and output is exactly what these systems are good at generating. Curved mouse paths, variable typing cadence, reading pauses, the occasional typo and correction: all of it can be synthesized, and open-source libraries already do much of it.
The economics favor the agent. A defender has to model human behavior across millions of real users, devices and accessibility tools. An agent platform only has to produce one plausible trace per session, and it can test against detectors as often as it likes. Every new behavioral model becomes a training target for the next version of the agent.
There’s a second problem: many agents will never need to fake anything, because they aren’t adversaries. A consumer’s assistant buying groceries or paying a bill has every commercial reason to behave smoothly. As agent platforms compete on reliability, the gap between agent behavior and human behavior will shrink by design, not just through evasion.
Behavior can’t name the agent
Even when behavioral biometrics does catch automation, it stops at “not human.” It can’t reliably tell you whether the session belongs to ChatGPT agent, Claude, Gemini, Perplexity’s Comet browser, an open-source framework like browser-use, or a custom Playwright script someone wrote last night.
That’s because behavior isn’t a property of the platform. Most agents drive a standard browser through the same automation layers, so their low-level input looks alike. The same platform behaves differently depending on the model version, the task, the site and the prompt. And any distinctive pattern a platform shows today can change with its next release.
Naming the agent requires different evidence: how the client is built, how it talks to your APIs, what its runtime environment exposes, and how it handles the moments where an automated flow breaks. Behavior is at best a weak supporting signal in that analysis.
A binary answer to a question that isn’t binary
At its best, behavioral biometrics feeds one decision: block anything that looks automated. That made sense when automation meant attack. It doesn’t anymore.
Customers are starting to send agents to do legitimate work: check balances, compare prices, file disputes, complete checkouts. Blocking all of them means breaking the experiences your customers chose, and pushing them toward competitors who figured out how to say yes safely. Allowing all of them means handing an unknown actor the full power of a logged-in session.
The decisions that matter sit between those extremes, and behavioral biometrics can’t inform them:
| Question | Can behavioral biometrics answer it? |
|---|---|
| Is this session automated? | Partially, and less every year |
| Which agent or platform is this? | No |
| Is it acting for the account holder, or for an attacker? | No |
| What is it trying to do? | No |
| What should it be allowed to do, and for how long? | No |
| Should a risky action wait for the customer’s approval? | No |
What a sustainable approach looks like
A durable answer treats agents as a new class of actor to identify and govern, not a bot to wave away. That means four capabilities working together:
- Identify. Classify the specific agent and platform from evidence that’s hard to fake: client and runtime fingerprints, API-level traffic patterns, and how the agent behaves when a flow fails. This takes ongoing research into each platform as it ships new versions.
- Attribute. Tie the agent to the person it claims to represent, so a customer’s assistant and an attacker’s automation stop looking the same.
- Authorize. Decide what this agent may do, on which accounts, for how long. Give it a scoped grant the customer approved, rather than the full power of their session.
- Monitor. Keep the customer in the loop with visibility into what their agent is doing, a way to stop it, and approval holds on high-risk actions like new payees or large transfers.
Behavioral signals still have a role here, as one input among many. They just can’t be the foundation.
The bottom line
Behavioral biometrics was a good answer to “is this a bot?” That’s no longer the question. Agents are getting better at looking human, and the platforms behind them can’t be told apart by how they move a cursor.
The organizations that handle agentic traffic well will be the ones that can say which agent is at the door, who sent it, and exactly what it’s allowed to do once inside. That’s where we’re focusing our work at Transmit.
