Written by Jeremy Souffir Founder, JTS Tech Services
The direct answer first. On 11 November Cequence Security, which sells bot management, published a report with KPMG on what AI agents actually do when they reach a website, and Help Net Security carried the figures on 12 November. Two of them matter to a store. First, the real agents now act rather than browse: across 281,627 agent visits in the week of 15 to 21 October, about one in seven went past reading and comparing to book, buy, sign in or manage an account for a customer, and at one large telecom carrier a fleet of agents presenting as ordinary desktop browsers signed in as customers, passed multi-factor authentication, reviewed bills and added devices to carts. Second, the counterfeits are already bigger than the real thing: one online marketplace took roughly 414,000 visits in a single October week from traffic claiming to be a widely used consumer AI agent, every one of them aimed at the sign-in page, every one of them failing, which is the signature of stolen username and password pairs being tried in bulk. That was about one and a half times every genuine agent visit Cequence counted across five industries that week. We wrote in August that your bot protection was turning AI shoppers away and that the fix was to let the named agents through. That advice stands. What this week's numbers add is that the name is now the cheapest part of the costume, so the decision about who gets in has to move from the door, where the visitor tells you who it is, to the session, where it shows you.
What did the report actually find?
The figures come from Cequence's own customer traffic, which it calls field data, across five industries. From the Help Net Security article, the Cequence post and the report's public summary page, read on 12 November:
- The mix. Of 281,627 AI agent visits between 15 and 21 October, 46 percent read pages, 39 percent shopped or compared products, and about one in seven took an action: booked, bought, signed in or managed an account on a customer's behalf.
- The marketplace. Over one week in October, an online marketplace took 414,210 visits from traffic wearing the name of a widely used consumer AI agent. Every visit hit the sign-in page and every one returned an error. Cequence calls it a credential stuffing operation, and the volume was about 1.5 times all the genuine agent visits it counted across five industries that week.
- The carrier. The day after a major consumer platform launched a personal agent in September, a new automated stream appeared at a Tier 1 telecom carrier. It grew from about 100 requests a day to a sustained 19,000 to 32,000 within three weeks. It signed in, completed multi-factor authentication, reviewed bills, checked trade-in eligibility and added devices to carts, while presenting as an ordinary desktop browser. More than 270,000 transactions were scored as automated but not malicious and allowed to continue under monitoring.
- The tell. Human customers took about two weeks to adopt a new browser version. This traffic went from almost none to around 98 percent on the new version in about 48 hours, which Cequence says fits one operator updating a fleet of cloud browsers it manages. A thousand people do not update on the same afternoon.
- The scores. At a global consumer brand, behavioural analysis blocked 3.51 million unauthorised login attempts in 31 days. About 82 percent of that traffic scored too low to trip conventional bot detection.
- The survey. 65 percent of 202 IT and security leaders in North America and Europe, surveyed for Cequence by Enterprise Management Associates this year, had seen an AI agent act outside its intended scope.
Where does the costume come from?
The marketplace case is one operator and one borrowed name. Cequence's research from 28 October describes the wholesale version. A single actor, working from a major cloud provider, has been scanning organisations in retail, finance, telecom, energy and software since at least late September while posing as about 32 different AI bots: crawlers and assistants from OpenAI, Anthropic, Meta, Perplexity and others. It does not read web pages. It first sends nonsense paths to find sites that answer everything, then works through a list of roughly 90 files that commonly hold secrets: environment configuration files, cloud credential files, private SSH keys and server environment data. Each address fires a burst of 50 to 190 requests in about eight seconds, it used more than 300 cloud addresses in one day and nearly 400 in one week, and none of the late-September addresses were still in use a month later, so a blocklist of them goes stale within days. On one day in October it reached 48 percent of the Cequence-protected organisations that saw any AI bot traffic at all, and at several of them it was more than 80 percent of everything labelled as AI bot traffic. If your analytics told you last month that AI agents were suddenly very interested in your store, this is one of the things that could have been.
The tells are worth knowing because they are the kind a store's own logs can show. The scanner cycled evenly through all 32 identities, something no real bot does; the same machine claimed to be OpenAI, Anthropic, Meta and Perplexity within seconds of itself. Its fake Claude identities all carried the contact address of Anthropic's crawler even when posing as a different Claude agent, which points to a copied-and-pasted string. It never gave a contact address of its own. And the genuine agents are, by comparison, rare: at the most exposed financial institution in the study, agents acting for real customers were fewer than one request in 4,000.
Why does this change the advice we gave in August?
In August we showed how an ordinary bot-protection setting at the edge turns away the agent that was about to recommend you, and we said to let the named agents through: ChatGPT's browsing agent, Google's, Perplexity's, Anthropic's. Most stores that acted on that did the simple thing, which was to add the names to an allowlist. The simple thing assumed the name was expensive to fake. It is a line of text in a request header, and this week's figures show it is now being faked at a volume larger than the real traffic it imitates. An allowlist by name is therefore no longer a door for agents. It is a door for anyone who has read a list of agent names, and the credential stuffers have.
The useful part is that the big platforms give you a better key than the name. OpenAI publishes a machine-readable list of the addresses each of its bots uses: one file for OAI-SearchBot, one for ChatGPT-User, the agent that visits a page because a person asked ChatGPT a question, one for GPTBot and one for its ads checker. A request that calls itself ChatGPT-User from an address outside that list is not ChatGPT, whatever it says. Cloudflare's Web Bot Auth goes further and lets a bot operator sign each request with a key published at a known location on its own domain, so the identity is checked by mathematics rather than by trust; it rests on two IETF drafts and is how Cloudflare now verifies bots and agents that opt in. Cequence's own advice is the same in one sentence: verify agents through signed requests, published address ranges or direct integrations instead of accepting the identity a bot claims.
Whose numbers these are, and where they stop
Three cautions before anyone changes a setting. Cequence sells bot management, so a report that concludes bot scores are not enough and behaviour must be watched is also a report that describes its product. The figures are real field data but from its own customers, not a random sample of the web. The marketplace, the carrier, the consumer brand and the impersonated agent are all unnamed, the 414,000 figure appears on the report's gated summary page and in Help Net Security's article rather than in the open blog post, and nothing in the report says which agents are the ones signing in at the carrier. We are quoting the numbers because they are the first of their kind at this scale, not because they are the last word.
The two conclusions that both get this wrong
Block anything calling itself an AI agent until this settles
This is the August mistake with a fresh excuse. The real agents are a small share of traffic and a growing share of transactions: one in seven of them signs in, buys or manages an account, and at the carrier the operator let more than 270,000 of those transactions through because they were customers' agents doing customers' errands. Block the names and you lose the one in seven along with the counterfeits, and the counterfeits lose nothing, because the ones that matter never needed the name. The scanner that reached half of Cequence's customers in a day was blocked almost everywhere and kept going.
We allowlisted the official IP ranges, so we are covered
That is the right first step and it is one step. The address lists cover the platforms that publish them and the agents those platforms run themselves. They do not cover the carrier's fleet, which presented as an ordinary desktop browser from ordinary cloud machines and would have passed any name-or-address check you could write, and they do not cover 82 percent of the 3.51 million login attempts that scored too low for conventional detection. The range check settles who the big platforms' agents are. It says nothing about what a session is doing once it is in, and the sign-in page is where the damage is.
The encouraging part
None of this needs a new product. The counterfeit in the report is loud in exactly the way a store's own logs can hear: one name, one page, a hundred percent failure rate, and bursts no human produces. The genuine agents are now welcome at sign-in and checkout by the platforms' own design, and the platforms that send the most of them publish the addresses they come from. The whole correction is to stop deciding at the door and start deciding at the action. Save the friction for the three things that cost money when they go wrong, a payment, a change of where money goes, a change of who controls the account, and let a verified agent read, compare and even sign in without being asked to prove it is human, because it is not, and it does not have to be.
What to do this week
- Find out how your edge decides. Ask whoever runs your bot protection, Cloudflare, Shopify's built-in rules, a WordPress security plugin, one question: when a visitor says it is ChatGPT, do we check anything else? If the answer is no, you have an allowlist by name.
- Replace the name with the list where one exists. OpenAI publishes address files for OAI-SearchBot, ChatGPT-User, GPTBot and its ads bot. Treat a request wearing one of those names from an address outside the file as unverified traffic, which is what it is. Where your edge supports verified bots or signed requests, turn that on and prefer it to any name match.
- Pull a week of sign-in logs. Count visits that claimed an agent name and never went anywhere but the login page. A visitor that only ever tries to sign in and fails every time is abuse whatever it calls itself, and this is the one pattern in the report that an ordinary store can see without new tooling.
- Look for the burst. Fifty to 190 requests in eight seconds from one address, aimed at configuration and credential paths rather than products, is the scanner. Confirm those paths return nothing: no environment files, no backups, no staging or admin site reachable from the public internet. We wrote in October about the keys that get found this way.
- Move the friction. Put step-up checks and rate limits on payments, changes to payout or refund destinations, and changes to account control, and take them off reading, comparing and plain sign-in. A verified agent that cannot read your catalogue does not recommend you; one that cannot change your payout address cannot hurt you.
- Check the agent dashboard you already have. If Microsoft Clarity is on your store, its Agent Activity view counts agent sessions and what they do. Read it next to your sign-in log, and treat a mismatch between claimed agent visits and verified ones as the size of your counterfeit problem.
- Write down the one-in-seven. An agent acting for a customer will now sign in to that customer's account on your store. Decide, and record, what it is allowed to do there before the first one does it: view orders, start a return, change an address, change a card. The carrier in the report decided this under monitoring and in a hurry. You can decide it on a Tuesday.
Why this is worth getting help with
The reason to have someone look at this rather than adjusting a setting yourself is that the two failure modes in this report pull in opposite directions, and a store fixing one tends to walk into the other. Tighten the door and the genuine agents that now sign in and buy for your customers stop at the threshold, which is the August problem back again with a worse number attached. Loosen it on the strength of a name and the sign-in page takes four hundred thousand stolen-password attempts in a week wearing that name. The right position is a specific one for each store: which platforms you verify by published address, which by signature, what a session may do before it is asked for anything, and which three actions carry the friction. That is what our audit does. We read how your edge, your sign-in and your checkout treat agent traffic today, pull the week of logs described above and show you the counterfeit and the genuine side by side, check the credential paths the scanner is looking for, and hand you the short list of changes in the order that protects the sign-in page first and the one-in-seven second. Retaining us for it is worth it for a plain reason: the counterfeit traffic is already larger than the real, the real traffic is already transacting, and the difference between the two is visible in logs you already have, if someone reads them before the next week's worth arrives.
Sources
- Help Net Security: Bots pose as AI agents, AI agents pose as humans, and defenses believe both (Anamarija Pogorelec, 12 November 2026; the 414,210 marketplace visits and the 1.5 times comparison, the carrier's 19,000 to 32,000 requests a day, the 98 percent browser change in 48 hours, the 270,000 monitored transactions, the 3.51 million blocked logins and the 82 percent figure, the 281,627 visits and the one-in-seven, and Cequence's advice)
- Cequence Security: Agentic AI Governance: KPMG and Cequence Partner on Agentic AI Security (Ameya Talwalkar, 11 November 2026; the quarter-million visits across five industries, the 100 to 32,000 requests a day at the carrier, the marketplace credential stuffing, the 46 percent and 39 percent split, the 15 to 21 October window)
- KPMG and Cequence: Delegating Outcomes, Not Authority: Agentic AI Runtime Security, Governance, and Control (report summary page, read 12 November 2026; the 414K figure, the one-in-seven, and the 65 percent of 202 leaders surveyed; the full report is behind a form)
- Cequence Security: Attackers Are Using AI Agent Impersonation to Hunt for Credentials (Will Glazier, 28 October 2026; the 32 identities, the 48 percent of organisations in one day, the 90 file paths, the 50 to 190 request bursts, the 300 and 400 cloud addresses, the 80 percent of labelled AI bot traffic, the copied Anthropic contact address, the fewer than one in 4,000 figure, and the advice on signed requests and published address ranges)
- OpenAI: Overview of OpenAI Crawlers (the four bots, the published address files for each, and the ChatGPT-User wording quoted above)
- Cloudflare: Web Bot Auth (developer documentation updated 8 October 2026; signed requests, the published key directory and the two IETF drafts)
- JTS Tech: You can do the structured data perfectly and still be invisible (3 August 2026; the advice this post corrects)
- JTS Tech: The agents are in your analytics now (7 November 2026; Microsoft Clarity's Agent Activity dashboard)
- JTS Tech: Blocked is not stopped (25 September 2026)
- JTS Tech: The key you forgot you published (18 October 2026; what the scanner is looking for)
