Kavra LabWhat an AI agent is
A traditional bot follows a script written in advance. An AI agent is given a goal in plain language, such as "find a flight under $400 and book it", and decides its own steps. It reads the page, often from screenshots or the page structure, chooses where to click, types into fields and checks the result, then repeats until the task is done.
Agents come in two broad kinds. Hosted agents run in the provider's cloud, in a headless browser or a remote desktop, and the best-run providers identify and sign their traffic. Self-hosted agents are built from open-source frameworks and run on anyone's laptop or server, often with no declaration at all. From your site's point of view, the second kind is indistinguishable from any other automation until you look closer.
AI agent vs AI crawler vs classic bot
| AI agent | AI crawler | Classic bot | |
|---|---|---|---|
| Goal | Complete a task for one user | Collect content for a model or search index | Run a fixed script at scale |
| How it browses | Full browser, reads and clicks like a person | Fetches pages directly, rarely clicks | Anything from raw requests to a stealth browser |
| Volume | Low, one session per task | High, many pages | Often very high |
| Declares itself | Verified agents do; self-hosted ones often do not | Major operators do | Bad bots do not |
| Typical policy | Allow verified agents where they help customers | Allow, limit or block per operator | Judge on evidence |
Why AI agents matter for fraud and trust teams
Agents are becoming a real sales channel. A customer who asks an assistant to reorder groceries or book a hotel expects the agent to reach checkout, and a site that blocks every automated visitor turns that customer away. At the same time, the same technology gives fraudsters a cheap way to run tasks that used to need custom scripts: creating accounts, claiming promotions or testing logins in natural-looking steps.
So the old rule, "automation equals block", no longer works. The questions become: is this agent who it says it is, is it acting for a real customer, and is this a page where agents are welcome?
- Verified agent on a product or checkout page: usually allow.
- Verified agent on signup or bonus claim: your call, often verify.
- Unverified browser claiming to be a known agent: treat as an impostor.
- Undeclared automation acting like an agent: judge on device, network and behavior evidence.
How to verify and manage AI agents
Kavra recognizes verified AI agents, such as OpenAI's ChatGPT agents, by their cryptographic request signatures and their operators' published IP ranges. A browser that declares itself an agent but comes from outside those ranges is flagged as unverified. Everything else is judged like any other visitor, across network, device, browser integrity and behavior, and you choose to allow, check or block each category per page. Read more in AI agent detection, and see how agents fit alongside good bots and bad bots.