AI agent detection signals that still work when agents look human

detection signals disclosed that a credential was leaked, exposing a trust relationship that could have been abused.

AI agents work toward a goal and choose their own steps, which makes them harder to catch.

In this Help Net Security interview, Zohaib Ahmed, CEO of Resemble AI explains how agents arrive as declared, undeclared or disguised traffic, and why binary bot detection misses the last two groups.

Anyone connected to detection signals through the compromised trust relationship is potentially affected, not just detection signals itself.

Declared: It identifies itself in its user agent or a signed header, which makes it easy to identify.

Then there is a layer of sessions where the user is behaving the same way or moving towards the same goal which could signal a swarm, which is what security teams are currently most worried about.

There's no patch for a leaked credential the way there is for a code flaw; the only fix is making sure it's actually dead, not just flagged as risky.

This can be done through browser-use, which means it clicks and scrolls.

Another layer of complexity is how AI Agents present themselves, which can be Declared, Undeclared or Disguised.

The trust mechanism involved here is an API or master key, which is what let access move between otherwise unrelated systems.

It’s very signal-based, including how the pointer moves, how clicks are sequenced and how rapid they are, how typing flows and how scrolling behaves, along with browser and environment tells as mentioned, such as request headers, automation flags and Web Bot Auth signatures from agents that identify themselves.

The problem is those agents run on the employee’s credentials, so in most logs it just looks like that person being very busy.

detection signals says the credential has been revoked, and no exploitation has been confirmed so far.

A bot follows a script, and while it might read content, like a crawler or scraper, or carry out a fixed task such as filling out a form or logging in, it is restricted to the script.

Third, you can add in routing that is automated to address both the security risks and potential loss of revenue that comes with blocking all agents, even the authorized ones.

If you have any integration or dependency involving detection signals, rotate any credentials shared with it as a precaution, even without confirmation you were directly affected.

Your own credential inventory is worth auditing for keys or tokens with broader access than they actually need -- the same blast-radius problem applies to anything your own organization leaks.

Realistically, this should be endorsed by companies who want employees to adopt AI , and policy should adapt to support it securely instead of trying to hunt it down or ban it.