TL;DR: AI agent security in 2026
- AI agents drive real browsers, pass fingerprint checks, and transact at machine speed. Traditional bot vendors miss them.
- Behavior is the only reliable separator: deterministic mouse paths, DOM burst reads, CDP artifacts, no viewport scroll before the query.
- Score agent trust 0-100 per session. Allow, challenge, or block per request in real time.
What AI agents are and why they create a new security problem
AI agents are software programs that autonomously operate web browsers to complete tasks. They can book appointments, fill in forms, make purchases, run checkout flows, complete KYC processes, claim promotional bonuses, and scrape structured data, all without a human in the loop.
This is a meaningful shift from traditional bots. Traditional bots send HTTP requests directly. They do not render pages, do not execute JavaScript, and do not produce a genuine browser fingerprint. They are visible at the network layer precisely because they do not behave like browsers.
AI agents do. They control a real browser, Chromium in most cases, and operate it the way a human would. They render the full page, execute JavaScript, resolve CAPTCHA challenges, and generate a browser fingerprint that is indistinguishable from a human user's at every checkpoint a WAF or CDN bot filter inspects.
The result is a category of automated threat that existing security infrastructure was not designed to see.
Why existing security tools are blind to AI agents
WAFs and CDN-level bot management were built around a specific threat model: high-volume automated requests from known data center IP ranges, with missing or spoofed browser attributes. That model does not describe AI agents.
Consider what a WAF or CDN bot filter actually checks. The user-agent string: an AI agent running inside Chromium sends a genuine one. The request rate: AI agents operate at human speed, sometimes slower. The IP address: AI agents typically route through residential connections, not data center ranges that blocklists recognize. JavaScript execution: AI agents pass JavaScript challenges because they are running a complete JavaScript engine.
At every checkpoint a network-layer tool can inspect, an AI agent looks like a human. That is inherent to how these tools work. They are browsers, operated by software instead of people, so there is no separate evasion step to catch.
A WAF cannot see an AI agent. Neither can a CDN-level bot filter. The problem is structural rather than a configuration gap: these tools inspect the network, and the evidence lives in the browser.
The signals that actually reveal AI agents
Detection requires moving the analysis to the browser layer, where differences between AI agents and human users become visible. Four signal categories are reliable discriminators.
The first is canvas fingerprint entropy. Browser canvas rendering is shaped by the specific combination of GPU hardware, font rendering engine, and operating system a device is running. Real user devices produce canvas fingerprints with high entropy because of the variation in their hardware configurations. AI agents running in minimal or virtualised browser environments produce fingerprints with abnormally low entropy, fewer GPU-rendered variations than a real hardware configuration generates. This is measurable.
The second is session cadence. Human interaction with a browser involves natural timing variation. A person typing their email address into a form does so with slightly different intervals between keystrokes each time, influenced by attention, familiarity with the keyboard, and dozens of other physical factors. AI agents execute events at mechanically precise intervals. A form field filled with exactly 1,200 milliseconds between each character, repeated consistently across multiple events, is not a human pattern.
The third is cursor geometry. Human mouse paths are curved, they accelerate and decelerate, and they include micro-corrections. AI agents either produce geometrically perfect paths, straight lines or precise arcs, or no cursor movement at all between interactions. Real users almost never produce straight-line cursor paths between elements.
The fourth is the font and WebGL fingerprint. Real user devices have a full set of system fonts installed and a GPU that produces consistent WebGL output. AI agents running in minimal environments have a restricted font set and virtualised or absent GPU hardware. The combination of missing fonts and an anomalous WebGL signature is a strong discriminator.
None of these signals are visible at the network layer. All of them require a script running inside the browser session to observe them.
Named AI agents and what their detection signatures look like
Different AI agent tools produce distinct signal profiles, and it is possible to identify them specifically rather than classifying them generically as automation.
OpenAI Operator runs in a Chromium-based environment. Its canvas entropy is low, its session cadence is mechanical, and its interaction patterns reflect the underlying model's task execution rather than human decision-making rhythms.
Claude for Chrome operates as a browser extension that controls the active session. Detection focuses on session cadence anomalies, since the extension architecture means the browser itself is genuine but the interaction pattern is not human.
Playwright and Puppeteer are headless by default. Even when basic evasion techniques are applied, such as setting a genuine user-agent or disabling the navigator.webdriver flag, their browser environments are missing APIs that real browsers expose, their canvas entropy is low, and their behavioral signals remain mechanical.
Selenium produces a similar profile to Playwright and is detectable through driver-injected window properties that persist even when other evasion techniques are applied.
cside detects all of these from a single script tag, using browser-layer signal analysis and no changes to your application code. It returns a real-time verdict that flags AI-agent and automated sessions and, where possible, names the specific agent. See how AI agent detection works.
Where AI agent detection matters most
US account takeover losses reached $13.5 billion in 2025, up from around $11.4 billion the year before. AI agents running automated credential stuffing and account-creation campaigns are a growing share of that total, operating at human speed through real browsers.
| Year | US account takeover losses |
|---|---|
| 2024 | ~$11.4B |
| 2025 | $13.5B |
Source: Javelin Strategy & Research, 2026 Identity Fraud Study.
The use cases where AI agent activity creates real business harm are concentrated in a few verticals.
In iGaming, agents claim welcome bonuses, complete automated KYC flows, and withdraw funds at scale. The economics are straightforward: if the bonus is worth more than the cost of the agent operation, it is a profitable attack.
In fintech, agents open mule accounts to launder funds, often completing identity verification steps that are designed to require human interaction.
In e-commerce, agents conduct card testing: running small transactions through checkout flows to validate stolen card numbers before using them for larger purchases. Card testing is damaging both for the fraud losses it enables and for the chargeback volumes it generates. The Verizon Data Breach Investigations Report 2026 found that stolen credentials appear in 39% of all data breaches, the same credentials that AI agents are increasingly used to validate at scale through checkout and login flows.
In SaaS, agents scrape pricing pages, product catalogues, and customer-facing data at scale, often to feed competitive intelligence operations.
Each of these use cases involves an agent completing a workflow that was designed for a human user. The damage comes from the outcome, a workflow completed without authorisation, rather than from the request pattern itself.
AI agent security is not about blocking all automation
Not all automated traffic is malicious, and AI agent security should not be framed as blocking every non-human session. Search engine crawlers, accessibility tools, legitimate API integrations, monitoring tools, and internal testing frameworks are all forms of automation that websites depend on. Blocking all of them would cause more harm than the threats being addressed.
The goal is to separate authorized automation from abuse rather than to eliminate automation entirely. That calls for a per-session risk decision based on the signals a session produces, not a binary rule applied to all non-human traffic.
The right architecture returns a risk signal per session, with enough context to identify the specific agent type where possible, and lets the application decide how to respond. Some sessions warrant a challenge. Some warrant a block. Some, from crawlers the site owner recognizes and permits, warrant no action at all.
For how per-session risk decisions work in practice, see AI agent detection. For how this fits into a complete account takeover prevention stack, start there.
Further reading
