For thirty years the web had one quiet assumption: a person is on the other end. Login pages, CAPTCHAs, checkout flows, analytics dashboards, per-seat pricing and rate limits were all designed for a human with a screen and a mouse.
That assumption is now failing in public. Assistants shop and sign in on behalf of people. Summarizer bots flood small sites. Coding agents call APIs all day. Attackers run agents on stolen keys. And big companies are deciding, one dispute at a time, whether to ban agents or build for them. This post lays out what is changing, what breaks, what is already being built, and what to do about it whether you run a website, build agents or just use them.
TL;DR: the questions people ask
| Question | Short answer |
|---|---|
| Who are the new users? | Assistants acting for people, crawlers and summarizers, coding and ops agents, business agents, and attacker agents |
| What breaks first? | Identity and login, CAPTCHAs, bot defenses, funnels and analytics, per-seat pricing, payments and fraud checks |
| Should I block them? | Block abuse and unidentified agents; consider welcoming agents that identify themselves and act with consent |
| What is being built? | Agent identity, credential vaults, wallets with caps, tool interfaces such as WebMCP, usage-based pricing |
| What is the security risk? | Agents act with real credentials and can be fooled, stolen or abused, including at machine speed |
| What should I do this week? | Inventory agents touching your systems, give each its own identity, scope permissions, cap spending, log everything |
Who the new users actually are
"AI agent" covers several different visitors. Treating them as one group is how you end up with the wrong defense.
1. Assistants acting for a person. Products such as Meta's Muse, OpenAI's ChatGPT Work, Anthropic's Claude Duet and xAI's Grok Bot browse, fill forms and buy on a user's behalf. They are the new customer, and they arrive with a human's authority.
2. Crawlers and summarizers. These fetch pages to train models, answer questions or feed newsletters. One developer reported that after a Hacker News launch, most requests to their site were bots, with nearly half from a single AI newsletter service. It is one site's account, not a measurement of the whole web, but it shows how quickly automated readers can outnumber humans on a small site. See our write-up of the bot flood and the defense checklist and our reporting on AI and bot traffic overtaking humans and Cloudflare's breakdown of search, agent and training traffic.
3. Coding and operations agents. These use your API, your cloud, your repository. They are the heaviest daily users of developer tools and the most trusted, since they hold real credentials.
4. Business agents. Agents that run procurement, support, research or back-office tasks, and that need accounts, payment methods and permissions of their own.
5. Attacker agents. Automated tools that probe for weaknesses and test stolen credentials at machine speed. These are the same capabilities as the above, aimed against you.
What they share is that they act without a person watching each step, they scale without fatigue, and they can be wrong in ways a person would not.
The first fights are about permission
The earliest public conflicts are not about technology. They are about who gets to be a customer.
Amazon said it cut off Meta's Muse agent from shopping on Amazon.com on customers' behalf, citing undisclosed access, no self-identification and credential capture, after first trying to get Meta to exclude Amazon voluntarily. An Amazon spokesperson said third-party apps that buy for customers "should operate openly and respect service provider decisions." Meanwhile Shopify took the opposite path the same week, with a disclosed integration that lets Muse check out across Shopify-powered stores. We covered both: Amazon blocks Muse and Shopify's agentic Shop Pay checkout.
A hands-on test by The Verge found the rules inconsistent beyond Amazon. Muse was stopped by one retailer's bot check one day and got through the next, and another retailer's cart-reservation rule could be abused, since repeatedly adding items held them from other shoppers for 20 minutes. JPMorgan Chase's CEO Jamie Dimon said the bank will not let outside agents access accounts, calling it "too risky." That is a company deciding its answer in public.
Paul Graham's argument is that any business that bans agents creates an opening for a competitor that allows them. We examined it in our post on Amazon banning agents as a startup opportunity and found the claim plausible but overstated, since verified actions so far target specific agents, not agents in general. Our opinion piece on why permission, not capability, is now the agent bottleneck goes further.
The pattern: the technology to act on the web already exists. The unresolved question is whether the website will let the agent in, under what identity, and who is responsible if something goes wrong.
What breaks when the user is not human
1. Login, CAPTCHAs and bot defenses
Defenses built to answer "are you a human?" return the wrong answer for a legitimate agent acting for a real person. CAPTCHAs, behavioral bot checks and device fingerprints all treat an agent as an intruder, which is why agent access is inconsistent from site to site. The real question has changed from "human or bot?" to "who is this agent, who sent it and what is it allowed to do?"
2. Credentials
The first thing an agent hits is a login page. The old options were bad: paste a password into a chat, hand over a long-lived session, or stop and sign in by hand every time. Two new designs separate the agent from the secret.
- 1Password for Agents lets an agent request a login, has you approve on your own device, and fills the form so the password never enters the agent's context. See our post on 1Password for Agents.
- Gumloop's Agent Browsers keep a credential vault the agent cannot read, while AgentMail's AgentID gives an agent its own verified identity through OpenID Connect, so it can show up as an agent, not impersonate a person.
These sketch two futures, in the framing of our write-up: the agent pretends to be a person with a vault of logins, or the agent arrives as an agent with an identity. The second is more honest and easier to govern, but needs sites to adopt it. This is the idea behind agent identity.
3. Delegation and authorization
An agent receiving delegated access through a handoff, illustrating AI agents as users acting on a person's behalf
When an agent acts for you, it should hold a slice of your authority, not all of it. A shopping agent needs to browse and pay under a limit, not read your email or change your bank details. Delegation needs to be explicit, narrow, time-limited and revocable. Most current setups are not. Banks report agents inside customer accounts that they cannot tell apart from the customer's own, according to a claim in a recent viral thread that we could not verify, which would be exactly this problem.
4. Payments
Agents that buy need money they can spend safely. Cloudflare Wallets gives agents spending caps and an identity on stablecoin rails so they can buy services without a human approving each purchase, and Stripe Link for agents reportedly averages about 1,300 dollars per agent per month in usage, per early reports we flagged as such. See Cloudflare Wallets, our agentic commerce roundup and the LangChain Restock guide where a human approves every order. Fraud systems tuned to human behavior will flag all of this, and they will need to learn the difference between an authorized agent and a thief.
5. Analytics, funnels and design
A conversion funnel narrowing in stages, showing how agent traffic distorts website funnel analytics
Funnels, A/B tests and attention metrics assume a human reads, hesitates and clicks. An agent compares options in milliseconds, ignores banners and never feels urgency. Dark patterns, countdown timers and upsell pop-ups that work on people do nothing on an agent, and may cause it to abandon your site. Your analytics will also be polluted: if half your traffic is automated, your conversion rate is meaningless unless you separate the two.
6. Pricing
Per-seat pricing assumes a person for each seat. When agents do the work, seats shrink and usage grows. That is why software stocks sold off in 2026 on fears about agents reducing seat counts, though sources disagree on the size of the losses and some analysts argue the reaction exceeded the change in fundamentals. Vendors are looking at usage-based and per-interaction pricing, as in our post on headless SaaS and charging per interaction.
7. Interfaces
Curly brackets holding stacked blocks, representing a machine-readable interface for AI agents instead of a visual page
Agents do better with structured interfaces than with pixels. That is the point of the Model Context Protocol, of tool interfaces such as WebMCP, which lets a page expose actions that agents can call in the browser, and of plain-text standards such as llms.txt. We cover the ideas in OpenAI's WebMCP Challenge, Sodium's WebMCP tools and the llms.txt guide. A site that offers a clean interface to agents gets better, cheaper, more predictable traffic than one that makes them scrape its pixels.
8. Security
Agents are users with credentials, so they are targets and weapons.
- Agents as insiders. Microsoft's security chief argues that deployed agents are insiders that cannot be trusted by default and need containment outside the model, with identity, permissions and monitoring. See our summary of securing the agentic insider, and the concept of an agentic insider.
- Stolen keys in loops. Attackers who steal AI API keys can feed them into automated attack tools that find more keys, so each stolen key pays for the next round, a pattern sometimes called LLMjacking. Our internet under attack post and the Railway and OpenRouter key-theft explainer cover documented cases.
- Prompt injection. A page can carry instructions aimed at the visiting agent. A human ignores a hidden line of text. An agent might obey it.
- Machine-speed abuse. An agent can hold, reserve, scrape or test thousands of items before a person would finish one.
What is already being built
| Need | What exists | Status |
|---|---|---|
| Agent identity | AgentMail AgentID (OIDC), per-agent keys | Early, needs site adoption |
| Credential safety | 1Password for Agents, Gumloop vaults | Launched, details still emerging |
| Spending control | Cloudflare Wallets, Stripe Link with approvals | Early |
| Agent-ready interfaces | MCP, WebMCP, llms.txt, headless APIs | Growing |
| Traffic management | robots.txt, rate limits, bot management | Mature, but built for crawlers |
| Containment | Guardian-agent supervision, local policy layers | Emerging |
| Pricing | Usage-based and per-interaction models | Experimental |
Notice the gaps. There is no widely adopted standard for an agent to say "I am agent X, acting for user Y, with permission Z," and robots.txt was designed for crawlers, not for agents that act. Meta's new commercial terms, which authorize crawling of sites tied to business accounts, raised the question of how robots.txt applies, as we discuss in our claimed-versus-verified breakdown.
What people are asking
Will agents replace human visitors? No. They will add a large, fast-growing category beside humans, and the mix will vary by site. Do not assume your traffic is mostly human.
Is blocking agents a mistake? Not always. Blocking abusive or unidentified agents is sensible. Blocking all agents may cost you customers who shop through them, but allowing agents that capture credentials can cost you much more. The question is control, not a yes or no.
Can I tell an agent from a person? Increasingly, not by behavior. Identity is the durable answer: agents that declare who they are, via signed requests or an agent identity, can be allowed, limited or refused.
Who is liable when an agent makes a mistake? Unsettled. Terms of service, payment rules and consumer protections were written for humans. Expect disputes and, eventually, rules. Until then, build in limits and records.
Is this just hype? The direction is real, though particular numbers are vendor claims or early reports. Treat any single statistic about "percent of traffic from agents" cautiously unless it comes from a measured source with a stated method.
A checklist for each audience
If you run a website or product
- Measure automated traffic separately from human traffic, so your analytics stay meaningful.
- Decide your agent policy in writing: allowed, allowed with identification, or blocked.
- Require identification and rate-limit by agent or key, not just by IP address.
- Offer a clean interface: an API, MCP server or WebMCP tools for the actions you want agents to take.
- Review fraud and bot rules so they can distinguish authorized agents from abuse.
- Protect carts, inventory and sign-ups from machine-speed holds and scraping.
- Plan pricing for a world with fewer seats and more usage.
If you build agents
- Identify yourself. Use a clear user agent or an agent identity, and honor site policies.
- Never hold raw user passwords. Use vault-based sign-in with approval.
- Ask for the minimum permission, time-limited, and keep a record of what you did.
- Set spending caps and require approval above a threshold.
- Treat web content as untrusted input that might contain instructions.
- Keep your own keys safe, one per app, capped and rotatable.
- Add a local policy layer. AgentBeam, built by the agent security team behind explainx.ai, is one open-source option that blocks, redacts or logs risky agent actions locally; see our setup guide.
If you just use AI assistants
- Read what an agent will be allowed to do before you connect it to accounts.
- Approve sign-ins yourself, and prefer password-manager flows that keep the password out of the agent.
- Set spending limits wherever an agent can pay.
- Check your accounts after you delegate something important.
- Revoke access to agents you no longer use.
Our take
We think the shift is bigger than the current disputes. The question stops being "bot or human" and becomes "who is acting, for whom, with what authority, and who answers for it." Companies that answer it clearly, with identity, scoped delegation, caps and logs, will be able to say yes to agents safely. Companies that cannot will say no, lose some customers, or say yes and absorb the losses.
A few predictions, labeled as opinion:
- Identity becomes the main gate. Signed, accountable agent identity will matter more than CAPTCHAs.
- Agent-ready interfaces become a competitive feature, the way mobile-friendly sites did.
- Usage and outcome pricing grows, and per-seat pricing weakens for tasks agents can do.
- Security teams treat agents as a first-class population, with inventories, permissions and monitoring.
- Some rules will be written after harm, as with every new class of user.
What we do not know
- How much traffic on typical sites is already agent-driven, since figures vary by source and method.
- Which identity standard will win, or whether none will.
- How courts and regulators will treat agent actions and agent contracts.
- Whether big retailers and banks will converge on opening up or locking down.
- How reliably agents can be defended against prompt injection at scale.
Related reading
- Amazon blocks Meta Muse's shopping agent
- Paul Graham on Amazon banning agents
- 1Password for Agents: sign in without sharing passwords
- Gumloop Agent Browsers and AgentMail AgentID
- Cloudflare Wallets for AI agent payments
- Headless SaaS: agents that charge per interaction
- Securing the agentic insider
- The internet is under attack
Details come from explainx.ai's reporting and the vendor and press sources linked above as of October 23, 2026. Figures marked as reports or claims are not independently verified and may change.