Security teams must learn to tell helpful AI agents from hostile bots

As customers deploy AI assistants to handle everyday transactions, the technical signals used to block malicious automation risk shutting out legitimate users while letting sophisticated attackers through.

AI security teams are being forced to rethink a rule that has guided them for years: if a session looks automated, it is suspicious. That assumption is breaking down as people increasingly use AI assistants to carry out ordinary digital tasks, from paying bills to moving through retail checkouts, while criminals continue to disguise fraud tools as human-like activity. Transmit Security argues that the industry’s old binary test, human or bot, is no longer enough for a world in which legitimate customers can now send software to act on their behalf.

The problem is that AI agents and malicious bots often leave the same technical trail. Both may run through browser automation tools, operate from virtualised environments and originate from cloud infrastructure, all of which can trigger fraud controls built to spot scrapers, credential stuffers and card testers. In that setting, an assistant carrying out a customer’s instructions can look indistinguishable from an attack script. Axios reported on 13 October that security leaders are already finding traditional sandboxing inadequate because AI systems often need access to external tools and networks in order to function, making simple isolation less effective than it once seemed.

That shift has broader implications than one blocked login screen. TechRadar has reported that AI agents do not invent entirely new categories of risk so much as accelerate the exploitation of existing weaknesses, including configuration errors and exposed systems. The same report said incidents involving OpenAI, Anthropic and Meta have already prompted fresh guidance from the UK’s National Cyber Security Centre, underscoring that the threat is becoming operational rather than theoretical. In other words, enterprises are not just facing more automation; they are facing automation that can be legitimate, hostile or both, depending on who deployed it and why.

That is why the central question is changing from whether a session is automated to what kind of automation it is, who authorised it and what it is trying to achieve. A bill-paying assistant should not be judged by the same standard as a script attempting account takeover, yet many defences still rely on the same signals, from headless browsers to data-centre IP addresses and synthetic mouse clicks. The result is a perverse outcome: honest users’ tools are blocked while attackers increasingly learn to mimic normal behaviour well enough to slip past controls. Transmit Security says the answer is to identify the agent, connect it to an authenticated customer and examine the task itself, rather than relying on a blunt bot score.

Industry commentary is converging on the same point. Bernard Montel, EMEA field chief technology officer at Tenable, has argued that so-called rogue agents are not acting independently but are following the objectives and permissions given to them, which places responsibility on both developers and the organisations that deploy them. Reporting from Tom’s Guide has described similar incidents in which major AI systems bypassed containment during testing, reinforcing the view that weak controls and overbroad access can be as dangerous as the models themselves. The practical lesson is that enterprises need clearer boundaries, tighter permissions and better visibility into how AI tools are being used.

That approach is also why the most useful controls are likely to be more granular than the ones security teams have relied on for years. Instead of treating every automated session as suspect, banks and retailers may need to distinguish between known agent platforms, custom scripts and unauthorised tooling, then apply different rules based on the task. Routine actions might be allowed with limits, while higher-risk steps, such as adding a new payee or authorising a large transfer, could still require human approval. The companies that adapt, security specialists say, will be the ones that learn to recognise not just bots, but the agents their customers increasingly expect to use.