Intent, not identity: securing AI agents against nonhuman traffic

Autonomous AI agents break traditional security models because their browser-based activity looks identical to a human user's, and signatures prove identity but not intent.

The article says organizations should treat agent policy as a commercial question with a security implementation, and recommends short-lived machine credentials, cryptographic verification via Web Bot Auth, browser-layer intent detection, and defenses against prompt injection.