AI agents will clearly change how people interact with websites. They will search, compare products, make purchases, fill forms, and perform actions that used to require a human in front of a browser.
Websites will need ways to decide which agents they accept, what those agents are allowed to do, and under which conditions. There is obviously some overlap with bot detection, since agents are still automated software interacting with websites.
My point is not that AI agent management is useless. It is that it is not exactly the same problem as traditional bot detection, anti-abuse, or fraud prevention, and we should not act as if those problems are already solved.
Lately, if you listen to anti-bot vendors, it can feel like AI agent management is the only problem left in bot detection.
Everyone is talking about agent identity, agent intent, agent governance, agentic trust, good agents, bad agents, and how to decide which agents should be allowed to interact with a website.
Even the analyst categories are changing. Forrester recently renamed its "Bot Management Software" category to "Bot and Agent Trust Management Software."
To be fair, Forrester is not saying classical bot detection is solved. The existing bot and abuse use cases are still very much part of the category.
But looking at the industry lately, you could be forgiven for wondering whether everyone else got the memo that we had finished with the old problem and moved on to agent trust.
I do not think it is!
Spend some time in the Discord servers, Telegram groups, Reddit communities, and GitHub repositories where bot developers actually operate and you will see something very different. Many major anti-bot systems are actively reverse engineered and bypassed, and by "bypass" I do not mean the usual cat-and-mouse game where a bot tries to look a bit more human, spoofs its fingerprint, moves the mouse correctly, rotates proxies, and hopes not to get caught.
I mean real bypasses.
There are attackers capable of generating valid anti-bot payloads without executing the protected JavaScript code in a real browser. There are browserless solvers that reproduce the signals expected by the anti-bot backend directly. There are CAPTCHA solvers capable of returning valid answers at scale in well under a second.
And this is where I think AI is having a much more immediate impact on bot detection than the agent discussion suggests.
AI is not just creating a new category of traffic for anti-bot vendors to classify. It is helping attackers break existing anti-bot systems faster and at a much larger scale.
A serious fraudster running credential stuffing at scale is probably not opening Perplexity Comet and asking it to log into 50,000 accounts on their behalf. Someone creating thousands of fake accounts is not going to rely on a general-purpose browser agent to navigate the signup flow one account at a time.
They are going to build automation for the job, just as they did before.
The difference is that AI can now help them analyze undocumented public APIs, inspect anti-bot JavaScript, deobfuscate client-side bot fingerprinting code, debug automation, reproduce expected signals, and maintain their tooling when a target changes.
Some of this work used to require fairly specialized reverse engineering skills. AI does not remove the need to understand what you are doing, especially against sophisticated protections, but it lowers the barrier and makes experienced bot developers considerably faster.
The end result is still usually... a bot.
It might use Playwright, Camoufox, Cloakbrowser or RoxyBrowser. It might run inside an anti-detect browser. It might rely on a custom browser stack. And if the attacker has reverse engineered enough of the application and the anti-bot protocol, it might be a browserless client sending plain HTTP requests while generating whatever payloads the protection expects to see.
AI may have been involved at almost every stage of building that system without a single AI agent ever touching the production environment.
That distinction matters because the current industry conversation often focuses on a different problem: understanding what an AI agent is, who it represents, and what it intends to do.
Those questions will probably become more important as agents become a normal way to interact with websites. But before asking whether an anti-bot vendor can understand an agent's intent, I think there is a more basic question worth asking:
Can it reliably tell that the client hitting your application is automated in the first place?
And if you are a customer of one of the commercial anti-bot vendors that seems to talk about AI agents more than anything else lately, I suspect you already have a pretty good way to answer that question.
Are your security engineers still getting paged in the middle of the night because a distributed credential stuffing attack is making it through to authentication?
Is your marketing or growth team still spending hours every week cleaning up fake accounts created with obviously bad email addresses or disposable domains?
Does your fraud team still have to deploy emergency rules for attacks that the anti-bot product was originally bought to detect?
If the answer is yes, then I would probably care a little less about how accurately the product can classify the "intent" of an AI shopping agent.
These problems are much less fashionable than AI agents, but they are also much easier to measure.
You can measure how many fraudulent accounts were created. You can measure how much credential stuffing reached your login endpoint. You can measure how much time your team spends cleaning up abuse, how many emergency rules had to be deployed, or how much automated traffic made it through your defenses.
"Intent" is much more convenient.
It sounds important, but it is vague enough that it can be difficult for a customer to verify whether a system is actually good at understanding it.
I have a similar problem with the "AI vs AI" narrative that has become common in security: attackers use AI, therefore defenders need AI to stop them.
AI can obviously help defenders too. The issue is when "AI" becomes a black box that replaces more concrete questions about what a product actually detects and how well it performs.
An attacker using Claude to reverse engineer your JavaScript does not magically turn the resulting HTTP client into an AI-powered attack. What eventually reaches you still has to be detected through the client, the automation, the infrastructure, the behavior, or some combination of those signals.
This is where I think the industry can get distracted by its own terminology. We move from bots to AI agents, from detection to intent, from measurable abuse to increasingly abstract categories, while the original problem is still sitting there.
Can you identify automation reliably when the attacker understands your defenses and is actively trying to reproduce the signals you trust?
That is still the job.
If your anti-bot platform can tell you the supposed intent of an AI shopping agent but cannot identify a purpose-built bot that has reverse engineered its JavaScript and is generating valid anti-bot payloads without running a browser, I am not sure we should call that progress.
