AI agent detection signals that still work when agents look human
Undeclared and disguised AI agents evade binary bot detection using human-like signals and coordinated sessions.
Zohaib Ahmed explains that AI agents can be declared, undeclared or disguised. Traditional bot detection misses undeclared and disguised agents. Detection relies on signals like click timing, scrolling, typing flows, and session patterns where multiple agents chase the same goal. To detect employee-installed agents, start with OAuth consent logs from identity providers and SaaS audit logs for personal API keys.
Unconfirmed: The effectiveness of these signals against advanced disguised agents is not quantified.
- Declared agents identify via user agent or headers
- Undeclared agents use automation fingerprints
- Disguised agents spoof browser fingerprints
- OAuth logs reveal unauthorized grants
- Session timing patterns indicate swarms
Impact: AI agents run on employee credentials and can perform tasks on SaaS tools
| Product | Affected |
|---|---|
| Resemble AI AI agents | — |
- 1.Review OAuth consent logs
- 2.Check SaaS audit logs for personal API keys
- 3.Monitor egress traffic to AI model APIs
- Vendors
- Resemble AI
- Products
- AI agents
- Organizations
- Help Net Security
- AI models
- Gemini 2.5 ProGemini 2.5 Flash
From the original article
4 min read at helpnetsecurity.com
Bots follow a script. AI agents work toward a goal and choose their own steps, which makes them harder to catch. In this Help Net Security interview, Zohaib Ahmed, CEO of Resemble AI explains how agents arrive as declared, undeclared or disguised traffic, and why binary bot detection misses the last two groups.
By Mirko Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.