Account takeover fraud occurs when an account is accessed by an unauthorized person with malicious intentions. Fraudsters ‘break in’ to an account and make purchases, withdraw funds, or monetize the account by selling access. 60% of merchant risk council members experienced this fraud type in 2026. These include major corporations like AirBnB and Blizzard.
And AI agents are going to make this fraud vector far worse. Research and internal testing carried by the cside team found that 81% of internal tests were able to bypass bot detection from major bot detection platforms (Cloudflare, Akamai). This aligns with an independent academic investigation from the University of California that found that traditional bot detection tools only identified 1/7 browser agents successfully.
That stealth along with the reasoning abilities of agents gives attackers a new toolkit to deploy effective attacks cheaply. Fortunately, defenders have stepped into the arms race with specialized tools for account takeover detection increasingly adding AI agent detection capabilities.
Previously proven defenses against account takeover like MFA are starting to crack. While MFA is still an important first line of defense, the rise of AI-driven social engineering and session hijacking playbooks are giving attackers a way to get past MFA. A future-proof account takeover defense strategy depends on multiple layers, which the cside web security team breaks down in the article How to Prevent Account Takeover Detection.
cside’s Future of Web Security 2026 report concluded a number of findings:
- User discussions of bot traffic that got through traditional defenses spiked by 275% throughout 2025.
- A massive rise in popularity of “stealth browsers” (like playwright that had 35 million npm downloads by 2026) use extensions that suppress detection. These bypass techniques are used by both legitimate consumer based AI agent apps (like browser extensions that perform tasks for users) as well as attackers. Unfortunately these two traffic sources appear similar and blend in together.
What are fraudulent AI agents?
Right now, any website with meaningful traffic has three types of AI agents visiting it. Understanding the difference between them is critical because the fraudulent ones are designed to look exactly like the legitimate ones.
LLM crawlers
These are the agents that OpenAI, Google, Anthropic, and other major platforms send out to crawl your website. They’re indexing your content for search and training their models. Even tiny sites get crawled. Some website owners want to block them. Others are actively optimizing for them because more crawler visibility means better placement in AI-powered search results.
The important thing about LLM crawlers: they serve the platform that sent them, not any individual user.
User action agents
These are the agents that act on behalf of a real person. You ask ChatGPT to research flight prices on Expedia. You use a browser extension that auto-fills forms. You run a task through Claude that involves visiting a website. In each case, an AI agent lands on someone’s site to complete a task for you.
The key difference from crawlers: user action agents are fulfilling a task for the end user, not harvesting data for a platform. They can originate from:
- ChatGPT, Claude, or any major AI assistant
- Browser extensions with agentic capabilities
- Developer tools and coding environments
- Any agentic framework that puts a bot on the web
Fraudulent AI agents
Category three is where things get dangerous. These are agents purpose-built by attackers to do something malicious on your site. Credit card testing. Content scraping for resale. Ticket scalping. Credential stuffing. The fraud vectors are the same ones traditional bots target, but now the bots are far more capable.
What makes them so effective:
- They solve CAPTCHAs more accurately than humans
- They route through residential proxies that rotate IPs and appear to come from normal household connections
- They run in real browsers, not the headless automation tools that legacy detection was built to catch
Here’s why that’s especially dangerous: a fraudulent AI agent filling out a login form on 10,000 sites looks, in many technical respects, nearly identical to a consumer AI agent filling out one form on your site for a legitimate user. Same browser environment. Same interaction patterns. The signals that traditional bot detection relies on blur together.
How AI-driven fraud amplifies account takeover
Account takeover has a well-defined attack chain: credential acquisition, credential testing, and monetization. AI is supercharging every stage, but the first two are where things are changing fastest.
AI-powered credential acquisition
Before an attacker can break into an account, they need a username and password. AI is making that step dramatically easier through a few vectors.
AI-driven social engineering is the most visceral. An attacker can pull a few YouTube interviews of your CEO, train a voice model in minutes, and send a voice note on iMessage that sounds exactly like them: “Hey, I’m in a meeting and need the password for the staging environment, can you send it over?” That’s not a hypothetical. The tooling to do this exists today and keeps getting cheaper.
Vibe-coded apps leaking credentials is a newer and underappreciated vector. There’s an explosion of apps being built with AI code generation tools, and many of them ship with security vulnerabilities that would get caught in a traditional development process. Users sign up for these apps using the same passwords they use everywhere else. When those apps get breached (and they do), attackers harvest the credentials and go try them on higher-value targets: travel accounts, financial services, crypto wallets.
AI-driven credential stuffing
Once attackers have a batch of stolen credentials, they need to test which ones actually work. This is credential stuffing, and AI agents are transforming how it’s done.
Traditional credential stuffing is brute force. Try password1, password2, password3, get rate-limited, move on. AI-driven credential stuffers can actually reason. An attacker might buy a leaked password from the dark web but not have the matching email for an employee’s internal system. An AI agent can search LinkedIn, scan the company’s website, reverse-engineer the email format from the domain, and start testing combinations. That’s not a thousand monkeys on a thousand typewriters. That’s targeted, intelligent reconnaissance.
These AI-driven stuffers are also far harder to detect:
- They solve CAPTCHAs reliably
- They vary their timing patterns so they don’t trip rate limiters
- They operate through residential proxies that make each attempt appear to come from a different real location
- They use real browsers, so traditional headless-browser detection misses them
Account takeover already affects the vast majority of online merchants. The Merchant Risk Council’s 2026 report found that MRC member merchants report account takeover as one of the top attack types they face, alongside card testing and refund abuse. AI is only going to accelerate this.
How to fight back against the AI fraud uprising
An arms race is underway. Attackers have stealth browsers that reconstruct the entire browser environment from scratch to suppress any signal that would identify them as automated. On the defense side, a new class of tools is building specialized AI agent detection that can categorize agents on your website and distinguish the malicious ones from the consumer agents you actually want there.
These defensive tools fall into two categories.
Enterprise anti-fraud platforms offer advanced behavioral analysis and they work. But they come with significant cost and commitment. You’re typically buying into a large platform with dozens of features you may not need, at price points in the tens of thousands of dollars per year, locked into annual contracts. For large enterprises with dedicated fraud teams, that makes sense.
Focused detection tools like cside and Fingerprint take a different approach. They give you the raw signals and behavioral data, and you feed those into your existing fraud workflows. There’s more setup involved (you’ll likely need a developer to integrate the data), but you’re paying for a focused solution in the range of a hundred to a thousand dollars a month. You can test it quickly, only pay for what you use, and you don’t have to buy an entire anti-fraud suite just to get AI agent detection.
How specialized tools detect fraudulent AI agents
Here’s an uncomfortable truth about most “AI agent detection” on the market today: the majority of it is just reading the user-agent string. When Google or ChatGPT put a crawler on your site, they announce themselves. Most major platforms give their name at the door. You can identify them for nearly free with a basic lookup, and many security vendors are packaging exactly this as “AI agent detection.”
Ahrefs’ data confirms that the vast majority of AI traffic on any given site comes from these top self-identifying platforms. But that’s not the traffic you need to worry about. The traffic that matters is the fraudulent agents that don’t announce themselves and the consumer agents you want to optimize the experience for.
Specialized detection tools handle this by looking at two layers of signals.
Browser artifacts reveal who an agent is. Is it running a headless browser that’s trying to suppress its own identity? Are multiple browser sessions originating from the same device? Is the browser environment internally consistent, or are there mismatches that suggest it was reconstructed to look real?
Behavioral fingerprints reveal what an agent is doing and whether it’s suspicious. The UC Davis FP-Agent study found that while browser fingerprints provide limited ability to distinguish AI agents (because many of them share the same underlying browser), behavioral fingerprints are highly distinctive. Differences in typing speed, scrolling patterns, and mouse movement reliably separate AI agents from humans and from each other. In their test, this behavioral approach detected all seven AI agents. Cloudflare’s traditional bot detection caught one.
The methodology that specialized tools are converging on isn’t just asking “is this a bot?” It’s asking three questions:
- Is this an AI agent? Based on browser artifacts and behavioral signals.
- Who is this agent? Is it Perplexity’s crawler? Claude? An unknown stealth browser?
- What is their intent? One form submission a day is fine. Thousands of login attempts from rotating IPs is not.
Those signals then get surfaced in two ways: a dashboard that gives you a pulse check on what’s happening across your site, and raw data you can pipe into your own fraud rules and workflows to decide what action to take.
