AI-agent impersonation credential stuffing: online marketplace & Tier 1 telecom — bots spoof AI agents/user agents for bulk login attacks (no CVE)
Severity: medium · Patch status: no-fix-needed · Since 2026-11-12
Cequence Security reports attackers impersonating AI agents and browsers to bypass bot defenses. Over one October week, an online marketplace received 414,210 visits claiming the name of a widely used consumer AI agent; all targeted the sign-in page and failed — a credential stuffing operation using stolen username/password pairs, at ~1.5x the volume of genuine agent traffic. Separately, a Tier 1 telecom saw automated traffic (100 to 19,000-32,000 requests/day) posing as a desktop browser, completing logins, MFA, bill reviews and cart actions via managed cloud browsers; 270,000+ transactions were scored automated-but-benign. At a global consumer brand, behavioral analysis blocked 3.51M unauthorized logins in 31 days, 82% scoring below conventional bot-detection thresholds. Cequence recommends session-behavior-based detection and step-up verification on sensitive actions. No vendor patch applies; mitigation is detection and policy.
What to do
- Monitor session behavior, not claimed identity: flag traffic that only hits sign-in endpoints and repeatedly fails
- Apply step-up verification, rate limits and extra friction to payments, payee changes and account-control changes
- Don't rely solely on bot scores; deploy behavioral analysis for login flows
- Watch for sudden browser-user-agent version adoption spikes indicating fleet automation
- Monitor for credential stuffing against AI-agent-named traffic and validate genuine agent traffic patterns
Sources
All live incidents on Threat Watch
