Cut code review time—and bugs—in half.
CodeRabbit gives fast-moving engineering teams AI-powered code reviews that catch bugs, suggest fixes, and learn your team’s coding preferences directly inside your workflow.
Trusted by 15,000+ teams and used across 6M repositories, CodeRabbit helps developers ship faster without sacrificing code quality.
2-click install. Available in PRs, CLI, and IDE.
The web security industry has spent decades asking a deceptively simple question:
Is this visitor a human or a bot?
That question is rapidly becoming obsolete.
AI agents can now navigate websites, interpret interfaces, fill forms, compare products, authenticate to services, call tools, complete transactions and react to what happens next. More importantly, the person and the agent do not necessarily exist in separate sessions anymore. A user might manually browse an ecommerce site, ask an AI assistant to compare products, hand the checkout process to the agent, intervene to approve payment and then resume control afterward.
The same session can therefore move between human behavior and machine behavior several times. Recent observations of agentic traffic point toward exactly this kind of transition, making point-in-time classification increasingly inadequate.
The security problem has changed.
The challenge is no longer simply identifying automation. It is determining whether the current actor, action and intent should be trusted.
That distinction could reshape bot management, fraud prevention, application security and identity architecture across the web.
Traditional bots were comparatively predictable.
A scraper downloaded pages. A credential-stuffing bot attempted logins. A ticket scalper hammered an inventory endpoint. Search crawlers fetched URLs according to relatively recognizable patterns.
Modern AI agents operate differently.
An LLM-powered browser agent can inspect a page, decide which element to click, observe the result, change its plan and continue working toward an objective. Research published in July 2026 found that modern browser agents can combine normal browser execution, adaptive reasoning, automated interaction and external CAPTCHA-solving capabilities rather than relying on the brittle scripts associated with earlier generations of automation.
This matters because many security systems implicitly depend on automation being less capable than the interface it is attacking.
That assumption is weakening.
OWASP already distinguishes automated abuse from conventional vulnerability exploitation because many automation attacks simply misuse legitimate application functionality: scraping content, creating accounts, scalping inventory, stuffing credentials or manipulating application workflows.
Agentic automation increases the sophistication of that problem.
Instead of scripting:
an attacker can increasingly specify:
Find the available inventory, determine how the purchase flow works, recover from errors, and keep trying until successful.
The agent figures out much of the workflow itself.
This is why simply labeling an entire session BOT or HUMAN becomes increasingly meaningless.
The identity of the actor may change while the session persists.
There is an important conceptual separation security teams need to make between risk and trust.
Risk asks:
How dangerous does this particular action appear?
Trust asks:
What accumulated evidence do we have that this actor should be allowed to perform it?
They are related, but they are not opposites.
Imagine a well-established customer suddenly refreshing an order-status page unusually quickly. The behavior might produce an elevated automation signal, but years of account history, a known device, successful authentication and a low-risk action could justify allowing it.
Now reverse the situation.
A completely unknown browser arrives from a fresh environment, immediately creates accounts, rapidly cycles inventory queries and initiates high-value transactions.
Even if every individual interaction superficially resembles legitimate browser activity, the session deserves much less trust.
The important shift is therefore:
Bot detection → trust evaluation
And trust should not be a single score calculated when the visitor arrives. It needs to evolve throughout the interaction.
CAPTCHAs were created around another increasingly fragile assumption: completing a challenge is expensive for machines and easy for humans.
That economics has changed.
A 2026 controlled evaluation of several commercial CAPTCHA-solving services found near-perfect bypass rates against some challenge-based defenses, with reported pricing reaching roughly $0.10 per 1,000 solves in the evaluated services. The same research found stronger resistance from non-interactive systems, but also discovered that browser-environment authenticity—persistent cookies, browser history and fingerprinting characteristics—could matter more than visibly human-like interaction patterns.
That finding deserves attention.
It suggests that security is moving away from asking:
Did you solve the puzzle?
toward:
Does everything about this session make sense?
CAPTCHAs are not necessarily disappearing tomorrow. They can still introduce friction and stop low-sophistication automation.
But they should increasingly be viewed as one signal inside a larger trust system, rather than a definitive proof of humanity.
Human computer interaction is surprisingly messy.
People hesitate.
They overshoot buttons.
They reposition their cursor.
They scroll slightly too far and scroll backward.
Their typing cadence changes.
They pause between reading and acting.
Automation often behaves differently.
Behavioral biometrics research has explored mouse trajectories and interaction dynamics for years. Earlier research demonstrated that mouse movement patterns can differentiate synthetic and human interactions, although accuracy and practical deployment limitations remain important considerations.
AI browser agents introduce another interesting dimension.
Research released in 2026 showed that browser-agent interaction traces—such as timing, clicks and navigation behavior—could sometimes reveal which underlying AI model was operating the browser. Across the experiments, classifiers reached up to 96% F1 when identifying agents from UI interaction traces.
That means behavior can potentially reveal multiple things simultaneously:
Is this automation?
What kind of automation is it?
Has its behavior changed?
Does this activity match previous sessions?
But there is an important caveat.
Behavior cannot become the new CAPTCHA.
If defenders construct a fixed checklist of human characteristics, attackers can eventually optimize against it. Mouse movement generators already demonstrate that synthetic interactions can be deliberately designed to resemble human trajectories.
The solution is therefore not another deterministic test but rather a continuous, multi-signal evaluation.
Trust isn’t settled once. It is continuously recomputed.
There is another reason human-versus-bot classification will struggle.
Increasingly, websites will want agents to visit.
Imagine an AI travel assistant trying to book a hotel. A purchasing agent ordering replacement components. Or a coding agent accessing documentation.
Blocking these because they are automated makes little commercial sense. Instead websites will need to know:
Which agent is this?
Who operates it?
Which human or organization delegated authority to it?
What is it authorized to do?
How long is that authorization valid?
Can that authority be revoked?
These questions are already moving into standards discussions. NIST launched an AI Agent Standards Initiative in February 2026, while its NCCoE work is examining standards-based approaches for identifying software and AI agents and controlling the resources and actions they can access.
IETF work is exploring similar territory. Current drafts examine treating AI agents as workloads with independent identifiers and credentials, allowing services to authenticate an agent before deciding whether that agent is authorized to invoke a tool or resource.
Separately, early W3C community work is exploring cryptographically verifiable agent credentials and mechanisms that could bind an agent to its controlling organization. These efforts remain emerging community initiatives rather than settled web standards, but their direction is significant.
The web may eventually need something analogous to Know Your Agent.
Not because an agent is inherently trustworthy, but because identity creates accountability.
A verified identity should never mean unlimited access.
A legitimate agent can still behave badly.
Its credentials could be stolen.
Its prompt could be manipulated.
Its operator could change its behavior.
The user’s authorization could expire.
An otherwise legitimate shopping agent could accidentally place hundreds of orders because of an orchestration failure.
This is why agent identity and behavior must eventually converge.
Identity answers:
Who are you?
Authorization answers:
What can you do?
Behavior answers:
What are you actually doing?
Trust requires all three.
This also resembles the direction enterprise zero-trust architecture has been moving for years: identity does not permanently grant trust. Authorization is contextual and continuously reconsidered.
Agentic systems extend that principle to autonomous actors.
Web security is ultimately an adversarial economic system.
The attacker asks:
How much does bypassing this defense cost?
The defender asks:
How much security can I add before legitimate users leave?
Traditional defenses frequently increase costs for both.
A CAPTCHA makes automated attacks harder, but it also annoys humans.
Aggressive rate limits stop scrapers, but they may disrupt legitimate automation.
Repeated authentication improves security, but damages conversion.
Agentic defense should instead try to create asymmetric economics:
Increase attacker cost dramatically while keeping legitimate interaction cheap.
Continuous analysis helps because the attacker no longer needs to fake one convincing request.
They need to maintain a convincing identity, browser environment, interaction pattern and application history across an entire workflow.
The longer the defender evaluates the interaction, the more expensive consistency becomes.
But defenders should be careful about relying solely on secrecy. Any static detection rule that produces predictable outcomes eventually becomes something an adversary can probe.
A more resilient architecture adjusts responses according to confidence and consequence.
This is a better objective than trying to achieve perfect bot detection.
Perfect classification probably isn’t achievable.
Making abuse economically irrational might be.
There is an uncomfortable consequence of intelligent attackers: defenses cannot remain static.
AI agents can retry.
They can interpret error messages.
They can change their navigation strategy.
They can learn which sequences fail.
They can experiment far faster than a person.
That means security controls built around permanent signatures and fixed thresholds become progressively easier to map.
Detection systems will instead need to learn from changing traffic patterns while preserving guardrails around automated policy changes.
There is a danger here as well.
A fully self-modifying defensive system could produce unpredictable false positives or create operational incidents of its own.
The goal should therefore not be unconstrained autonomous defense.
A better model is:
adaptive detection + bounded policy + observable decisions + reversible mitigation.
The detector can evolve quickly.
The enforcement boundaries remain controlled.
This transition will turn bot management into an observability problem as much as a security problem.
Traditional dashboards frequently emphasize numbers such as blocked requests or bot percentage.
Those metrics become less useful once legitimate agents represent a meaningful portion of traffic.
Platform teams will need to understand agent outcomes.
A useful operational model would track metrics such as authorized-agent completion rate, suspected-abuse completion rate, false-positive rate, step-up verification rate, trust-state transitions and the latency added by trust evaluation.
The most valuable signal may eventually be the transition itself.
For example:
trusted → uncertain → high risk
during checkout is more informative than simply knowing that 47% of the requests in the session appeared automated.
Teams should also observe where humans repeatedly take control back from agents. Those handoff points may expose exactly where agent permissions, application UX or authorization policies are insufficient.
This turns agent traffic telemetry into both a security signal and a product signal.
Another likely development is machine-readable access negotiation.
Today’s websites primarily communicate with crawlers through crude mechanisms such as allowlists, robots.txt conventions and bespoke API agreements.
Agents need something richer.
A website may eventually want to communicate:
You may search the catalog.
You may compare prices.
You may retrieve availability.
You may place items into a cart.
You may not purchase without explicit user authorization.
That is very different from:
bot = block
or:
bot = allow.
It represents capability-based access for autonomous software.
And the moment financial transactions, account changes and enterprise workflows become common agent activities, these distinctions become critical.
Current identity and authorization work at NIST, IETF and OpenID reflects this broader challenge: determining not merely that software exists, but establishing which authority it carries when acting across systems.
There is one major tension hidden inside continuous behavioral verification.
The more accurately a website can characterize behavior, the more accurately it may also be able to characterize individuals or software agents.
Research showing that UI traces can fingerprint underlying AI models illustrates the issue particularly clearly: security telemetry can become identification telemetry.
Organizations therefore need to distinguish between signals required for immediate security decisions and signals retained for long-term profiling.
Continuous trust should not become an excuse for unlimited behavioral surveillance.
Data minimization, retention limits, aggregation and clear governance will matter just as much as classification accuracy.
The Internet spent decades building security around users, sessions and applications.
Agents introduce another principal.
They sit somewhere between software workload, delegated user, API client and autonomous decision-maker.
Trying to squeeze them into the old category of bot will eventually become inadequate.
The better abstraction is a continuously evaluated actor possessing:
identity, authority, reputation, context and behavior.
Once that becomes the security model, a much more nuanced Internet becomes possible.
Search crawlers can remain accessible.
Legitimate AI assistants can perform useful tasks.
Customer-directed agents can transact within clearly defined boundaries.
Unknown automation can be slowed.
Suspicious behavior can trigger additional verification.
Confirmed abuse can be blocked.
And trusted agents can earn lower-friction access without pretending to be human.
That last point may be the most important.
For years, automation developers have been incentivized to make machines look human because web defenses treated automation itself as suspicious.
The next generation of Internet security should create the opposite incentive:
Don’t pretend to be human. Identify yourself, declare what you are trying to do, operate within the authority you were given and behave consistently with that declaration.
If the industry gets that model right, the future of bot management will not really be about detecting bots at all.
It will be about building a trust layer for autonomous actors on the Internet.
Today’s newsletter is also brought to you by:
No posts
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.