How to Identify Agentic Traffic: Kevin Gosschalk on Detecting AI Agents Online

So how do you identify an agent? How do you give them an ID? And then decide, you're good, or nope, you're not. It's complicated. No surprise, as you'd expect. So there are agents who are self-identifying their agents.

So when they connect to your website, in their URL or in their user agent equivalent, they'll add some information in there and you can look that up in a database and say, okay, this is owned by OpenAI, or this is owned by Anthropic. So that's like an easy part of the problem. In certain scenarios they just self-identify.

That is almost 0% of what's actually occurring right now, though.

The vast majority of agentic traffic is turning up, pretending to be a normal Chrome browser. It's pretending to be a Mac OS, because that's got more privacy-preserving features, so it's harder to fingerprint. It's pretending and masquerading to be a real user, 'cause it doesn't want to be redirected to an MCP server. It doesn't want to be told you can't buy this. It just wants to make the action happen.

So then that comes back to your original question, which is, okay, so if that's true, how do we identify. Because we still want a policy of like, if it's an agent, we want to decide what to do with that.

There's two categories of what agentic traffic will look like to an e-commerce website. One is the headless browsers running in the cloud. So let's say you ask ChatGPT in agent mode to go to this website and buy this item. It will spin up a headless browser in the cloud and navigate as a headless browser, using something like Selenium and Puppeteer and all these browser engine technologies.

The other kind of agentic traffic is the agent running on the device locally, where it's actually controlling your laptop, and to a website that's just gonna look like your laptop.

So you can't look at the way the browser looks 'cause it's gonna look like your browser, 'cause it's controlling your Chrome instance, right? So in that case, what you need to look at is two other things. One is the behavior of how it's controlling your Chrome and what it's doing.

The other thing is, what's it doing? What's the intent? If it's going through and doing stuff in a normal user way, you probably categorize that as a good agent. If it's going in and signing up for an account and then bailing once it gets this promo credit, you probably put that more in the, okay, this is a behavior we don't want.

So this concept of intent is also important. We, for instance, with the Arkose product, have intents around payment fraud, fake account creation, account compromise. And there's a number of signals that we look at to determine someone's trying to compromise an account.