Detecting AI agents is largely a myth, security researcher argues

A security researcher argues that sophisticated AI agents using real browsers on residential connections are technically indistinguishable from human users by design. Since such agents carry genuine browser fingerprints, clean IP addresses, and real email inboxes, standard detection signals like navigator.webdriver flags can be trivially bypassed. The researcher contends that most vendors either detect only unsophisticated bots, read self-declared headers, or sell false certainty while profiting from an ongoing arms race. Rather than focusing on per-request detection, the author suggests that behavioral patterns — such as one device spanning many addresses or dozens of signups from a single subnet — are more reliable signals. The piece concludes that identity verification and traffic-shape analysis are more effective approaches than attempting direct agent detection.