Agent impersonation

When a malicious bot pretends to be a trusted artificial intelligence (AI) agent, such as a well-known shopping or banking assistant, so that a website lets it in and treats it as legitimate.

A fraud bot might label its traffic with the name of a popular AI assistant to get past a retailer's bot defenses and reach checkout. Some security teams call these bots rogue agents.

Spoofing the signals a service uses to recognize an approved agent, so an impostor inherits the access the genuine agent gets. Many sites let known agents submit forms and complete purchases, actions they block for generic automation.

Impostors usually fake one or more of these signals:

• The User-Agent string, the text label a client sends with each web request, which any client can copy.
• The provider, by claiming to come from a known AI company or to be registered with a payment network.
• The delegation, by claiming a real customer authorized the agent.

Agent impersonation sits next to terms that are easy to mix up:

• Agent authentication is the check that defeats it, using cryptographic signatures an impostor cannot produce.
• Know Your Agent (KYA) verifies an agent, its mandate, and the person behind it, and impersonation succeeds where that verification relies on signals anyone can copy.
• Bot attack covers automated abuse in general, and agent impersonation is bots disguised as trusted agents.
• Agent hijacking takes over a genuine agent, while impersonation fakes one.