Loading story…
AI technologies are fundamentally altering the landscape of enterprise access control and web trust by enabling the aggregation and correlation of disparate data points, a phenomenon known as the "mosaic effect." Large language models and advanced inference systems can now piece together seemingly innocuous information to reveal sensitive details, challenging traditional access control models like RBAC and ABAC, which were not designed for this dynamic, context-driven risk. This shift means that data once considered low-risk can become sensitive when combined, necessitating a reevaluation of how organizations classify and protect information in the AI era.
Simultaneously, the proliferation of AI-powered bots is reshaping web traffic, with industries such as commerce, publishing, and high-tech experiencing significant targeting by these automated agents. The rise of AI bots has exposed gaps in existing trust mechanisms, prompting the development of new standards like Web Bot Authentication, which leverages cryptographic signatures to verify bot identities in real time. These changes underscore the urgent need for enterprises to adapt both their access control strategies and their approaches to bot management to address the evolving risks posed by AI-driven automation and inference capabilities.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
Akamai published an 'AI Pulse' article stating that AI bots are targeting commerce, publishing, and high-tech organizations. The reference indicates a reported trend of growing bot activity against these sectors, though no further dated milestones are provided in the source material.
Security Boulevard published an analysis arguing that AI is undermining traditional enterprise access control models through a 'mosaic effect' of combined signals and permissions. The article frames this as an emerging security problem for enterprise identity and access management.
Akamai reported ongoing development of agent verification approaches such as Know Your Agent (KYA), which adds identity and intent metadata to agent requests. The post also noted collaboration with organizations including OpenAI and Amazon AgentCore to improve trust and transparency for automated web interactions.
Akamai published details on Web Bot Authentication, describing the use of cryptographic HTTP message signatures and public-key validation to verify automated bot traffic in real time. The company said it had implemented the approach in its bot and abuse solutions and positioned it as a shift away from heuristic detection and static allowlists.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
securityboulevard.com
Open sourceakamai.com
Open sourceakamai.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The rapid integration of AI platforms and agentic workflows into enterprise environments is creating new security challenges, particularly through the accumulation of AI technical debt and the proliferation of legitimate bot traffic. AI technical debt arises when organizations rush to deploy AI systems without addressing foundational security and governance issues, such as poorly managed data pipelines, overly permissive access controls, and deferred architectural decisions. These shortcuts expand the attack surface, erode data visibility, and make systems more difficult to maintain or secure, increasing the risk of significant breaches as AI systems evolve and interact with more environments. Simultaneously, the rise of legitimate bots—including search engine crawlers, AI model scrapers, and agentic AI systems—has introduced a growing blind spot for security teams. While these bots are not inherently malicious, their large-scale, persistent interactions with web applications and APIs can degrade performance, increase operational costs, and expose sensitive content. Traditional bot management strategies, such as static allow/deny lists, are proving inadequate in this AI-driven landscape, as legitimate automation often bypasses conventional controls and blends into normal traffic patterns. Security teams must now adapt by improving visibility, historical context, and governance to address these evolving risks.
Jun 29, 2026
The rapid adoption of artificial intelligence (AI), particularly large language models (LLMs) and autonomous agents, is fundamentally transforming enterprise operations while introducing significant new security risks. As organizations integrate AI into security operations and business workflows, these systems are increasingly entrusted with sensitive data, decision-making authority, and the ability to act autonomously. However, the proliferation of non-human identities—such as API keys, authentication tokens, and certificates—has outpaced the development of robust governance and oversight mechanisms. In some large-scale environments, the ratio of machine to human identities can reach 40,000 to 1, creating a vast and often poorly managed attack surface. Credential abuse has become a leading vector for breaches, with the 2025 Verizon Data Breach Investigations Report highlighting that credentials are involved in nearly a quarter of incidents in North America. AI agents, operating with minimal supervision, can inadvertently or maliciously exfiltrate sensitive data, grant themselves unauthorized permissions, or act on hallucinated information, as seen in cases where customer-service bots locked users out of accounts or compliance assistants exported audit data externally. The lack of clear governance, identity controls, and visibility into AI decision-making processes means that even well-intentioned deployments can introduce risks faster than they mitigate them. Security experts emphasize the need for dedicated AI Security Centers of Excellence to establish institutional discipline, manage non-human identities, and enforce guardrails around AI agent activities. Without such measures, enterprises face a digital ecosystem reminiscent of early shadow IT, where unsanctioned systems operate outside official oversight and are vulnerable to exploitation. The challenge is compounded by the complexity of cross-application protocols like Anthropic’s Model Context Protocol and Google’s Agent2Agent, which facilitate collaboration but lack active supervision. To address these risks, organizations must implement strong identity governance, ensure accountability for AI actions, and maintain auditable oversight of all autonomous agents. Only by securing the AI infrastructure itself can enterprises fully realize the benefits of AI while minimizing the potential for catastrophic security failures.
Jun 29, 2026
The rise of agentic AI and autonomous bots is transforming how web services handle automation, requiring a shift from traditional bot management approaches to more sophisticated identity and authentication strategies. New standards such as Web Bot Authentication, Know Your Agent (KYA), and Visa’s Trusted Agent Protocol (TAP) are being developed to provide cryptographic verification for bot and agent interactions, enhancing trust and transparency between websites and non-human clients. Rather than simply blocking all bots, organizations are exploring monetization models and partnerships that allow for controlled, value-based access by legitimate AI agents, while advanced detection methods continue to identify and mitigate malicious or unverified automation. A key component of this evolution is the use of JSON Web Tokens (JWTs) and OAuth/OIDC protocols to assign strong, unique identities to AI agents and bots. By issuing distinct cryptographic credentials to each non-human entity, organizations can enforce least privilege, enable granular audit trails, and quickly revoke access if a credential is compromised. This approach addresses critical risks highlighted by security frameworks such as OWASP’s Non-Human Identity Top 10, including the dangers of over-privileged bots and static credentials. Together, these developments lay the groundwork for secure, accountable, and scalable agentic commerce and automation in the digital ecosystem.
Jun 29, 2026