The detection industry spent a decade learning to spot automation that does not look like a browser. The current generation of agents is a browser — sometimes one that is already signed in.
An AI agent is not a scraper with better headers. A scraper has a job — fetch these URLs — and leaves. An agent has a goal: it navigates, holds state, signs in, retries when something fails, and adapts to your interface. Its traffic looks less like a machine hammering an endpoint and more like an unusually efficient person. That is the problem, and it is a different problem from the one bot detection was built for.
Three findings from this year show why the ground moved, and they describe different parts of the same shift.
Agents stopped announcing themselves. Fingerprint's October 2026 survey of 300 US financial institutions found 79% had detected malicious bots or scrapers bypassing perimeter defences by spoofing legitimate AI-assistant or search-crawler identities. Only 45% could mitigate spoofed AI traffic in real time — and 61% were still relying on client-side JavaScript tags, which agents that do not run your script simply ignore.
Agents started appearing inside real sessions. Cequence reported an agent — Meta's "Muse" — present at more than half of the organisations it monitors, presenting as an ordinary browser. Some sessions signed in. Some completed multi-factor authentication.
Agents started operating in parallel. Researchers tracking a Chinese agent fleet observed roughly fourteen agents running concurrently for a week against a mapping service, working around anti-bot tokens using publicly documented techniques. That is a coordinated client, not a script.
Most bot detection is built on identity checks — is this client what it claims to be? Agents break that in a specific and awkward way.
| What you check | Why it worked | Why it stops working |
|---|---|---|
| The User-Agent | Automation rarely bothered to disguise it | An agent driving a real browser has a real User-Agent, because it is one. |
| IP reputation | Attackers reused addresses | Agents run wherever the user runs, including their own connection. |
| Client-side JavaScript | Scripts did not execute it the way a browser does | An agent in a real browser executes everything you send it. |
| Session and cookie state | Bots arrived cold | An agent acting for a signed-in user inherits that user's session. |
| Automation fingerprints | Headless browsers leak tells | Still the best remaining signal — but it targets the automation layer, not the intent. |
That last row is the important one. Automation-layer detection still works, and it is what catches the majority of agent traffic today. The gap it cannot close is an agent operating a session a human already authenticated — there the client genuinely is a real browser, and the question stops being "what is this" and becomes "who is this acting for".
Behaviour, and specifically the unglamorous kind. Peer-reviewed work this year built a dataset of 6,025 sessions and asked which observable features actually separated human, bot and agent traffic. The strongest discriminators were mouse event rate and the standard deviation of click duration. The features everyone expected to matter — the pause-think-act timing of an LLM-driven agent — did not survive feature selection.
The reason is worth internalising: an agent can look convincing in everything it reports about itself, because those are static facts you can set. How something moves over thousands of interactions is an accumulation, and manufacturing that convincingly at scale is a different order of problem. It is also the same reason no single signal settles the question — the honest answer to "will this catch an agent?" is a rate, not a yes.
This is a business question before it is a technical one, and the survey data says most organisations have not settled it. Fingerprint found 40% of financial institutions feared that blocking legitimate AI assistants would push customers to competitors. That is a rational fear with a real basis.
The distinction that holds up is not "AI or not" — it is who the agent is acting for. An agent doing a task for a user who is present and consented is a feature of your site being useful. An agent acting for someone who is not, at a rate no person could sustain, is the thing you are actually defending against. Detection that cannot tell those apart will either let the second through or block the first.
Where ZeroBot fits. Detection runs as an HTTP-level check that returns automation-layer signals — including evidence of automation frameworks, headless rendering and scripted interaction — alongside the verdict. It is browser fingerprinting, available as an optional layer, that produces those signals; the core API scores on IP, ASN and reputation and does not require anything on the page. For agents driving a real browser, the automation layer is the part that still gives them away, and it is the part we detect.
Because a scraper has a job and an agent has a goal. A scraper requests pages and leaves; an agent navigates, holds state, signs in, and adapts when something fails. Its traffic looks less like a machine hammering an endpoint and more like an unusually efficient person.
Increasingly yes, and that is the change. Early agents made HTTP requests; current ones drive a browser — sometimes one the user already has open and signed in. Cequence reported an agent appearing within customer browser sessions at more than half of the organisations it monitors, including sessions that signed in and completed multi-factor authentication.
Partly, and less reliably than it detects a headless browser. A genuine browser driven by automation still exposes automation-layer signals, which is the gap most detection relies on today. Where it gets hard is an agent operating a session a human already authenticated — at that point the client is a real browser and the question becomes behavioural rather than technical.
Probably not, and the survey data suggests most organisations are unsure. Fingerprint found 40% of financial institutions feared that blocking legitimate AI assistants would push customers to competitors. The useful distinction is between agents acting for a user who is present and agents acting for someone who is not.
Behavioural ones. Peer-reviewed work on agent detection found the strongest discriminators were mouse event rate and click-duration variance — not the pause-think-act timing pattern everyone expected. An agent can look human in what it reports about itself; it is harder to look human in how it moves.
One API call, the signals returned to you. $50/mo flat, free tier.
Get started free →