Loading story…
The rise of agentic AI and autonomous bots is transforming how web services handle automation, requiring a shift from traditional bot management approaches to more sophisticated identity and authentication strategies. New standards such as Web Bot Authentication, Know Your Agent (KYA), and Visa’s Trusted Agent Protocol (TAP) are being developed to provide cryptographic verification for bot and agent interactions, enhancing trust and transparency between websites and non-human clients. Rather than simply blocking all bots, organizations are exploring monetization models and partnerships that allow for controlled, value-based access by legitimate AI agents, while advanced detection methods continue to identify and mitigate malicious or unverified automation.
A key component of this evolution is the use of JSON Web Tokens (JWTs) and OAuth/OIDC protocols to assign strong, unique identities to AI agents and bots. By issuing distinct cryptographic credentials to each non-human entity, organizations can enforce least privilege, enable granular audit trails, and quickly revoke access if a credential is compromised. This approach addresses critical risks highlighted by security frameworks such as OWASP’s Non-Human Identity Top 10, including the dangers of over-privileged bots and static credentials. Together, these developments lay the groundwork for secure, accountable, and scalable agentic commerce and automation in the digital ecosystem.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
Help Net Security summarized findings from the Thales 2026 Bad Bot Report, which said automated traffic became the majority of internet activity in 2025 at 53%, with bad bots accounting for 40%. The report also highlighted a 12.5-fold rise in AI-driven bot activity, growing abuse of APIs, and the emergence of AI agents as a third category of automation complicating bot detection and policy enforcement.
Cloudflare and GoDaddy announced a collaboration to bring AI crawler controls to GoDaddy's hosting platform and support emerging AI agent identity standards. The initiative includes Cloudflare's AI Crawl Control and support for identity-verification approaches such as GoDaddy's Agent Name Service and Cloudflare's Web Bot Auth framework.
Akamai published a blog post focused on bot management for the emerging agentic era. The reference provides no further synopsis, but it represents a distinct public guidance publication on managing AI-driven automated traffic.
A Security Boulevard article described how AI agents and other non-human identities can use OAuth/OIDC flows and JWTs for authentication, emphasizing short-lived scoped tokens, strong key management, proof-of-possession, and lifecycle automation. It framed JWT-based machine identity as a security best-practice approach rather than announcing a specific incident or product launch.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
4 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcesdxcentral.com
Open sourceakamai.com
Open sourcesecurityboulevard.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AI technologies are fundamentally altering the landscape of enterprise access control and web trust by enabling the aggregation and correlation of disparate data points, a phenomenon known as the "mosaic effect." Large language models and advanced inference systems can now piece together seemingly innocuous information to reveal sensitive details, challenging traditional access control models like RBAC and ABAC, which were not designed for this dynamic, context-driven risk. This shift means that data once considered low-risk can become sensitive when combined, necessitating a reevaluation of how organizations classify and protect information in the AI era. Simultaneously, the proliferation of AI-powered bots is reshaping web traffic, with industries such as commerce, publishing, and high-tech experiencing significant targeting by these automated agents. The rise of AI bots has exposed gaps in existing trust mechanisms, prompting the development of new standards like Web Bot Authentication, which leverages cryptographic signatures to verify bot identities in real time. These changes underscore the urgent need for enterprises to adapt both their access control strategies and their approaches to bot management to address the evolving risks posed by AI-driven automation and inference capabilities.
Jun 29, 2026
As commerce increasingly shifts from human-initiated transactions to autonomous, AI-driven interactions, the payments industry is developing new frameworks to ensure security, trust, and compliance. Industry leaders, including Mastercard and Checkout.com, are focusing on agentic payments that leverage tokenization, biometric authentication, and advanced data-sharing standards to address the unique challenges of machine-led transactions. These innovations aim to establish robust identity verification for AI agents, known as 'Know Your Agent' (KYA), to distinguish between trusted digital agents and malicious bots. Emerging protocols such as agent-to-agent (A2A) communication and new merchant API interfaces are being introduced to support secure interactions among developers, issuers, and acquirers. Mastercard’s Agent Pay model exemplifies the integration of tokenization, biometric authentication, and intent capture to provide transparency and user control. Enhanced intent-level data is expected to reduce fraud, chargebacks, and disputes, supporting compliance and trust in the evolving machine economy.
Jul 12, 2026
The rapid adoption of AI agents, bots, and other non-human identities (NHIs) is fundamentally reshaping the cybersecurity landscape, introducing new attack surfaces and operational challenges for enterprises. As organizations increasingly rely on automation and AI-driven processes, NHIs are being granted broad access to critical systems, often without the same oversight or security controls applied to human users. This shift has led to heightened risks such as over-permissioned accounts, static credentials, and insufficient monitoring, making NHIs attractive targets for cybercriminals seeking to exploit gaps in identity and access management (IAM). Security leaders are urged to implement zero-trust principles, least-privilege access, automated credential rotation, and robust secrets management to mitigate these risks and prevent privileged account compromise. The complexity of managing AI agents is further compounded by the need for effective governance and the challenge of balancing control with operational simplicity in security operations centers (SOCs). Experts emphasize that adversaries are increasingly "logging in, not breaking in," leveraging weaknesses in identity controls—especially those related to AI agents—to gain unauthorized access. The cybersecurity workforce must adapt, as AI-driven automation is expected to take over high-volume, repetitive tasks, requiring new skills in AI security and orchestration. Organizations are advised to treat every human, workload, and agent as a managed identity, enforce phishing-resistant multi-factor authentication, and continuously monitor for anomalous permission changes or session hijacking to stay ahead of evolving threats.
Jun 29, 2026