A customer asks their AI assistant to pay a utility bill from their bank account. The assistant logs in, navigates to bill pay, fills in the form, and gets blocked. Ten minutes later, a credential-stuffing script tuned to look human walks straight through the same defenses.
This is happening today, at banks and retailers that run serious bot protection. The reason is simple: bot detection was built to answer “is this a machine?” AI agents are machines. But the question that now matters is different: whose machine is it, and what is it trying to do?
Built for a binary world
Bot detection grew up with a clean assumption: humans are legitimate, automation is hostile. For two decades that was close enough to true. Scrapers, credential stuffers, scalpers and card testers were all scripts, and almost no real customer ever sent a script to their bank.
So the industry optimized one classifier: human or not. Every signal, model and challenge was tuned to push automation out. CAPTCHAs, device fingerprinting, behavioral biometrics and IP reputation all serve that single verdict.
Agentic AI breaks the assumption. Now a legitimate customer can send automation on their behalf, and a binary model has no box to put it in.
Why agents trip every alarm
Agents and bots share the same plumbing, so they leave the same fingerprints. Most agents today drive a browser through Playwright, Puppeteer or a similar framework, often headless, often from a cloud data center. That is exactly the toolkit attackers have used for years.
| Signal | Why bots show it | Why agents show it |
|---|---|---|
| Automation framework artifacts | Scripts run on Playwright or Puppeteer | Browser agents are built on the same frameworks |
| Headless or virtualized browser | Cheap to run at scale | Agents run in sandboxed cloud browsers |
| Data-center IP addresses | Attack infrastructure lives in the cloud | Agent platforms host sessions in the cloud |
| Non-human input timing | Programmatic clicks and keystrokes | The model acts through synthetic events, not a hand on a mouse |
| Direct, efficient navigation | Scripts go straight to the target page | Agents complete the task without browsing around |
| Unusual session patterns | Many sessions, few signals of a real person | Sessions start cold, with no prior history on the device |
Every row is a signal a detection engine treats as risk. An agent doing a perfectly legitimate task scores like an attack, because on the surface it is built like one.
Meanwhile, sophisticated bots have spent years learning to hide these exact traits. The result is inverted: honest automation looks guilty, while dishonest automation looks human.
The real question is intent, not automation
“Is this automated?” used to be a good proxy for “is this malicious?” It no longer is. An AI assistant paying a bill and a script draining accounts are both automated. What separates them is who sent them, what they are allowed to do, and what they are actually doing.
That means three questions replace the old one:
- What is it? Which agent platform or framework is behind this session, and is it a known, reputable one?
- Who does it act for? Is there a real, authenticated customer who delegated this task?
- What is it trying to do? Does its behavior match a legitimate task, or does it look like reconnaissance, enumeration or fraud?
A human-or-bot score answers none of these. It was never designed to.
Getting it wrong costs both ways
Block every agent, and you block your customers. Agentic commerce and AI-driven banking are moving from demos to daily use. A retailer that blocks shopping agents loses the sale to one that doesn’t. A bank that blocks assistants pushes customers to work around it, often by sharing credentials with tools the bank can’t see at all.
Allow every agent, and you open a new door for fraud. Attackers already wrap their tooling in agent frameworks. If “looks like a known agent” becomes a free pass, it becomes the new disguise. And even a legitimate agent can be hijacked by a prompt injection on a page it visits.
Turning the bot score up or down does not fix this. It only moves the damage from one column to the other.
What agent-aware detection looks like
The fix is not a better bot score. It is a different model, one that treats agents as a third category with their own identity, permissions and risk.
- Classify the agent. Tell browser-use from OpenAI Operator from Claude computer use from a custom Playwright script. Each has distinct, researchable traits, and knowing which one you face changes the right response.
- Infer intent from behavior. Watch what the agent does across the session, not only how it clicks. A bill payment and an account-takeover probe follow very different paths.
- Tie the agent to a customer. Link the session to an authenticated user who delegated it, with scopes and a time limit, instead of guessing from device signals.
- Keep a human in the loop for risk. Let agents handle routine tasks, and hold high-risk actions, such as new payees or large transfers, for the customer’s explicit approval.
- Investigate, don’t just block. Give fraud and security teams visibility into which agents touch their apps, what they did, and where they failed.
This is the approach Transmit is taking: accurate classification of agent traffic, investigation tools built for it, and ongoing research into what each agent platform can do.
From “block the bots” to “know your agent”
The industry spent twenty years learning to know its customers. The next few years will be about knowing their agents: what they are, who sent them, and what they are allowed to do.
Banks and retailers that keep asking “human or bot?” will keep blocking the customers they want and missing the attackers they fear. The ones that ask “which agent, for whom, doing what?” will be ready for the way customers are about to show up.
