Image courtesy of Let's Data Science
In an interview with Let's Data Science, Arkose Labs founder and CEO Kevin Gosschalk explains the difference between knowing which product sent an AI agent and deciding whether that agent has permission to act. A verified Web Bot Auth signature, he says, is a strong signal of where an agent comes from, but it does not authorize anything on its own. Gosschalk also clarifies what the 97.7% figure in Arkose Labs' State of Agentic AI Trust Report, Q3 2026 counts: legitimate agent sessions at protected actions between July 1 and September 30, not all website traffic, and an unsigned session is not automatically an attack. He also outlines how teams can test an access policy without immediately blocking legitimate work.
