Bots pose as AI agents, AI agents pose as humans, and defenses believe both
Bots impersonate AI agents and humans, leading to credential stuffing and account takeover attempts.
Attackers are using bots to impersonate widely used AI agents and even humans, leading to credential stuffing operations and unauthorized access. One marketplace saw over 414,000 visits from a fake AI agent targeting its sign-in page. Another campaign involved automated traffic posing as a desktop browser, which successfully bypassed multi-factor authentication and engaged in account management activities before being identified by a browser update.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonAttackers are deploying sophisticated bots that masquerade as legitimate AI agents and human browser sessions, enabling large-scale credential stuffing and unauthorized account access. One marketplace recorded over 414,000 fraudulent visits to its sign-in page from a single fake AI agent, while another campaign successfully bypassed multi-factor authentication by mimicking desktop browser traffic. This matters because organizations increasingly trust AI agent traffic as benign, and attackers are exploiting that implicit trust to slip past both MFA and bot-detection controls. Without robust bot fingerprinting, behavioral analytics, and anomaly detection on authentication flows, defenders have no reliable way to distinguish legitimate automated agents from malicious imposters.
What helps against this
How we list vendors- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.