When an AI Agent Shows Up, Who’s Really Behind It?

AI agents are becoming active participants in the internet economy: browsing websites, managing accounts, and completing purchases on behalf of users. As their capabilities grow, platforms face a new question: when an AI agent shows up, how do you know a legitimate human is behind it?

For years, platforms have relied on CAPTCHAs, rate limits, phone verification, and Know Your Customer (KYC) checks to separate legitimate users from automated abuse, tools built for an internet where automation was mostly something to stop.

That assumption is breaking down. Users increasingly want software to act on their behalf, and the numbers are large enough to matter. McKinsey estimates AI agents could mediate $3 trillion to $5 trillion of global commerce by 2030. Bain projects a narrower U.S. figure of $300 to $500 billion, roughly 15% to 25% of e-commerce. The spread reflects differing definitions of “agentic,” not a settled number, but either way it signals real pressure on platforms.

A Harder Problem Than “Human or Bot”

The old binary, human good, bot bad, doesn’t map cleanly here. A legitimate AI agent can generate automated requests and complete transactions without a human clicking every button, which looks a lot like abuse from a platform’s perspective.