When the Agent Signs In As You

Bot defense asks one question — human or machine? A class of tools now shipping in the open makes the question unanswerable.

Ivan Podtsebnev · naykip · a builder's log

There is a quiet category shift happening on the web, and the clearest way to see it is to install a tool you can download today. Kimi WebBridge is a small, public, open-source project: a local service plus a browser extension that lets an AI agent drive your everyday, logged-in browser through the DevTools protocol. It is agent-agnostic. Your data and your sessions stay on your machine. It is not a scraper farm or a headless bot swarm — it is your Chrome, with your accounts, operated by a model you asked to help.

That last sentence is the whole story. For twenty years the web's defensive posture has rested on a single question: is the thing on the other end a person or a program? A tool like this doesn't answer the question — it dissolves it.

What bot defense actually measures

The best in the business — Cloudflare, Wallarm, and their peers — are extraordinarily good at telling humans from machines, and I don't say that lightly. They watch how events arrive: mouse trajectories and their micro-jitter, keystroke cadence, scroll dynamics, the thousand tells of a live session. Modern systems inject continuous behavioral analysis into the page and score it in real time. Synthetic input — events minted by a script rather than produced by a hand — carries a mark: the browser knows they weren't trusted, the geometry is too clean, the timing too even. This is real engineering, and it works. It catches crude automation all day long.

But notice what it measures. It measures the channel, not the intent. It answers “were these events produced by a human hand?” — and it treats yes as safe and no as suspect.

Two questions that only look like one

Legitimacy and automation are independent axes, and we have quietly been treating them as the same one. A completely honest, authorized, policy-compliant action — you asking your own agent to update your own profile, on your own account — reaches the page as synthetic input and scores as a bot. Meanwhile a human hand-operating a mouse for a scam sails straight through. The detector is orthogonal to the thing we actually care about.

Bot defense answers “does this look automated?” The question that matters is “did a person authorize this?” No fingerprint can see consent.

Now fold in a tool like WebBridge. The agent isn't minting foreign events into a hostile session — it is acting inside your own authenticated one, increasingly through paths indistinguishable from yours because, at the identity layer, they are yours. The detector's founding premise — that automation reveals itself in the channel — quietly stops holding. There is no impostor to catch. The session belongs to the person who delegated it.

Unmeasurable by design

This is the part that should keep a security architect up at night more than any single exploit: you cannot count what you cannot distinguish. When agent activity runs inside real, consenting user sessions, “how much of our traffic is agents?” has no measurable answer. Not because anyone is hiding it — because the category that would measure it has dissolved. The dashboards will read normal while the nature of the traffic underneath them changes completely.

The pressure moves to the identity layer

This shift is not only benign, and it is worth being honest about that. The same capability that lets you delegate your own accounts to a helpful agent lets bad actors operate identities at the social-graph layer rather than the packet layer — think of the platforms built entirely on “this is a real person”: professional networks, marketplaces, reviews. Abuse there was never really about traffic volume; it was about trust in identity. When acting-as-a-person becomes a commodity capability, the pressure lands squarely on the identity layer — which is exactly where today's defenses are thinnest. I am describing the shape of the threat and where it moves, not a method; the point is the direction of the risk, not how to realize it.

The rules we don't have yet

If detection is the wrong axis, what is the right one? Authorization and provenance. The web needs a way for an action to carry a provable answer to “who authorized this, and to do what?” — an agent identity distinct from the human's, delegated explicitly, scoped, revocable, and auditable. Not “does this look like a bot,” but “can this agent prove a human granted it this power, for this purpose, now?”

That is a different discipline than fingerprinting. It looks far more like the authorization work we already do for machines in the backend — scoped tokens, capability grants, signed provenance — pulled up to the front of the browser, where the agent actually acts. None of it exists as a standard the way bot detection does. We have a decade of investment in answering a question that is going obsolete, and almost nothing invested in the one replacing it.

The takeaway

Step back far enough and the shift has a plainer name. For thirty years the web assumed a person behind every session. That assumption is quietly expiring: the internet of people is becoming an internet of agents acting for people — and we are still policing it for the wrong thing.

Bot defense isn't wrong and isn't going away — crude automation and outright attacks are real, and behavioral analysis will keep catching them. But the frontier has moved. The interesting actors on the web are no longer bots pretending to be people; they are agents openly acting for people, with tools you can download today. The king isn't wearing new clothes — we're realizing there were never any to begin with. The work now is to design for a web where agents are first-class: identified, authorized, accountable. That is a rules problem, and the rules are still unwritten.

kovanex.dev — one person. the whole stack.