AI Agent Detection: How It Works & Why Identity Alone Falls Short

Eighty percent of AI agents don’t properly identify themselves when they visit your site. They show up without a nameplate, blend into your traffic, and proceed—whether they’re indexing your content, scraping your catalog, or quietly probing your checkout flow.

As agentic traffic scales, businesses are flying blind. Legacy bot detection was built around identity signals—user-agent strings, IP ranges, robots.txt—that are trivially spoofed. Detection that treats identity as the only gate misses most AI agents. Intent is the layer that catches malicious behavior even when credentials look valid.

This guide breaks down how AI agent detection actually works, from the identity verification hierarchy to intent-based behavioral analysis, and how trust is continuously reassessed at every step.

What is AI agent detection?

AI agent detection is the process of identifying automated traffic from AI agents and classifying it by identity, behavior, and intent, then enforcing a trust-based action.

That’s a broader mandate than traditional bot detection. The industry has evolved: first from “human or bot?” to “good bot or bad bot?” and now to something more nuanced still. With AI agents, the right questions are: which kind of agent is this, and what is it trying to do?

The distinction matters because the category isn’t monolithic. AI traffic includes LLM crawlers, chatbots, shopping assistants, and even agentic browsers that can navigate the web autonomously.

This article focuses on detection—the intelligence layer—rather than blocking, which is the enforcement response that follows.

Why AI agent detection is urgent now

Agentic traffic has reached enterprise scale. DataDome’s network processed 17.7 billion AI agent requests in Q2 2026, a 45% increase from Q1. Additionally, AI bot traffic to retail and ecommerce sites grew 5.4 times in 2025.

And yet, only 2.8% of websites are fully protected against even basic bot attacks, according to DataDome’s 2025 Global Bot Security Report—let alone sophisticated AI agent attacks.

Businesses are already receiving high volumes of AI agent traffic, but few have the visibility needed to distinguish malicious AI traffic from helpful AI traffic. That’s what makes AI agent detection so urgent. 

“Buy for me” AI agents can hoard inventory without completing a purchase, artificially deflating available stock. Unwanted AI traffic can also distort the analytics and conversion rates your marketing team relies on, while also driving up infrastructure costs in the process. Meanwhile, fraudsters are enlisting AI agents to commit attacks at machine speed and scale. 

To protect your business from malicious AI traffic, proper AI agent detection is the first step.

Why identity-based AI agent detection falls short 

Most AI agents don’t properly identify themselves, and the websites they visit mostly don’t check. That combination is what makes identity-only defenses fail silently.

According to DataDome’s Galileo Threat Research team, 80% of AI agents don’t properly identify themselves when visiting websites. Rather than relying on verified signals like published IP range lists, reverse DNS lookups, or authentication protocols like Web Bot Auth, most rely on user-agent strings—which anyone can copy in a single line of code.

Some agents publish IP lists but leave them incomplete or unmaintained, creating gaps that attackers exploit. Others run client-side and inherit the user’s IP address, making verification structurally difficult.

The result is a broken trust model on both sides. Fraudsters can clone poorly declared AI agents and inherit whatever trust or access privileges sites grant them. And website owners can’t make informed decisions about traffic they can’t accurately identify.

That spoofing is already happening at scale. As of February 2026, Meta-ExternalAgent was the most impersonated agent on DataDome’s network, with 16.4 million spoofed requests. PerplexityBot had the highest impersonation rate, with nearly 2.4% of requests claiming to be PerplexityBot found to be fraudulent. 

Well-known agent names carry implicit trust. Security systems that apply lighter scrutiny to “ChatGPT traffic” effectively hand out a hall pass, and attackers have noticed.

Why user-agent strings aren’t enough

A user-agent string declares identity without proving it. It’s the weakest available signal, sitting at the bottom of any reliable verification hierarchy. 

High-confidence classification requires cryptographic token verification (Web Bot Auth, KYA, TAP), trusted IP ranges, or reverse DNS lookups—methods that provide cryptographic proof of identity rather than a self-reported claim.

When DataDome tested nearly 700,000 reachable websites using a spoofed ChatGPT-style user-agent, 79.7% allowed it through without blocking or challenging it. Most sites treat user-agent strings as if they’re verified credentials, but they’re not.

The limits of IP-based verification

IP-based verification assumes agents operate from stable, documented IP ranges. Many don’t. 

In one documented case, Grok routed requests across 12 unique IP addresses—including residential ISPs and hosting providers—in response to a single user prompt. Even agents that publish IP lists often leave them incomplete or outdated. IP is a useful input, not a reliable anchor.

Why robots.txt isn’t a security mechanism

88.9% of websites in DataDome’s 2025 Global Bot Security Report dataset explicitly disallowed GPTBot in their robots.txt files. But robots.txt is guidance, not enforcement. 

Agents that choose to ignore it encounter no technical barrier, which is why the widespread adoption of the directive hasn’t translated into protection.

How does intent-based detection work?

Intent-based detection is continuous behavioral analysis across the full session. It’s not a static traffic scan, and not a bolt-on module.

DataDome’s detection engine analyzes 5 trillion signals daily across 85,000+ customer-centric models, flagging anomalies in under 2 milliseconds with a less-than-0.01% false positive rate. Intent detection runs on that same core engine, which means it inherits full behavioral context, not just the identity layer.

Identity verification—even when it works—only answers who is at the door. Intent answers why they want in. Both questions matter, because the same verified agent can behave in completely different ways within a single session.

What intent-based detection actually catches

An agent that passes every identity check can still pivot to malicious behavior mid-session, and an identity-only system won’t see it coming.

Let’s say a verified shopping agent starts by browsing product pages at a normal rate, adds an item to cart, checks pricing—all consistent with legitimate shopping assistance. Then, without warning, the same agent starts hammering checkout endpoints in rapid succession, testing payment method variations. Then it begins probing API endpoints outside its original scope.

At no point do the agent’s credentials change. Identity-only systems see a verified agent throughout and keep the door open. An intent-based system detects the behavioral shift at step three—the velocity change, the endpoint mismatch, the divergence from the established session baseline—and blocks the session while leaving other sessions from the same agent provider completely unaffected.

Identity is static. Intent is dynamic, and it has to be evaluated continuously, not once at session start.

The Trust Score: Making intent actionable

Continuous intent signals need to be operationalized. DataDome’s Trust Score (rated 0–100) is how that happens. For every AI agent, the score combines identification strength, behavioral intent (assessed both on your properties and across DataDome’s broader network), and the reputation of the agent’s operating organization.

Scores are calibrated per customer. An agent generating high-value traffic for a retailer might be low-value or risky for a media publisher. The models learn that distinction—the score reflects your context, not just a global average.

The score informs policy. It doesn’t replace real-time analysis. Even a high-trust agent is still evaluated on every request. Trust sets the default; behavior determines the action. And the longer it runs on your traffic, the more accurately it reflects what good and bad intent actually look like for your business.

When legitimate intent conflicts with business strategy

Not all problematic agent behavior is fraud in the traditional sense. Some of the harder cases involve authenticated agents with perfectly valid credentials doing something technically allowed but strategically harmful.

Let’s say a retailer grants a price comparison platform’s AI agent access to browse product listings. The agent is verified, its credentials are clean, and browsing public pages isn’t against any rule. 

But over time, it maps the retailer’s full pricing structure—including promotional pricing, regional variations, and clearance inventory—at a volume and frequency that goes well beyond helping consumers compare. The operator gets a live competitive intelligence feed, all while the retailer gets nothing back.

Identity verification sees an authorized agent doing what it’s permitted to do. Intent analysis sees a pattern that serves the comparison platform’s interests, not the retailer’s.

How to implement AI agent detection

AI agents are already hitting your websites, APIs, and MCP servers. At 17.7 billion requests per quarter across DataDome’s network, this isn’t emerging traffic; it’s current traffic. The gap is in visibility.

Most organizations discover far more agentic activity than expected once they start monitoring for it. Some of it is legitimate: verified crawlers, authorized shopping assistants, uptime monitors. Some of it isn’t. 

Without the ability to tell them apart, both types of AI traffic get the same treatment, which means either blocking traffic that should be let through, or letting through traffic that shouldn’t.

Agent trust management is how you move past that trade-off. Rather than applying a single policy to all agentic traffic, it continuously assesses identity, intent, and behavior on every request, then enforces the right action based on your rules. 

Verified shopping assistants get through. Undeclared scrapers don’t. Agents that start legitimately but shift behavior mid-session get caught before they cause damage. The result is protection that doesn’t force you to choose between security and enabling the agentic traffic that’s genuinely good for your business.

How to protect your business with AI agent detection

DataDome is a bot and agent trust management platform that’s built to give businesses complete visibility and control over all traffic, whether it comes from humans, bots, or AI agents. 

DataDome deploys at the edge with 80+ integrations, protecting websites, mobile apps, APIs, and MCP servers.

Named a Leader in The Forrester Wave™ for Bot and Agent Trust Management, Q2 2026, with the highest current offering score out of all evaluated vendors, DataDome is built for the future of agentic traffic. 

Is your website protected from malicious automated traffic? See for yourself with our free Vulnerability Scan, or book a demo to learn more about DataDome.