Imagine a reality where AI agents book your dinner, buy your plane tickets, and manage your life online. That future just arrived, and it's about to change everything about internet security.
We are on the brink of a profound transformation in how people interact with the web—driven by the rise of Computer Using Agents (CUAs) powered by large language models (LLMs).
Anthropic released its beta version of Computer Use, giving LLMs the ability to browse the web, make decisions, and execute tasks autonomously. But this is just the beginning. By the end of 2025, tens or even hundreds of millions of people may have tried computer-using AI assistants for daily, mundane tasks. Agents are used for booking a table at a restaurant, reserving a seat on a plane, or managing online orders. This shift is about to disrupt bot detection and website security.
The implications are enormous, and companies relying on CAPTCHA systems for bot prevention must begin to rethink their approach.
I founded Sardine to protect our financial systems by building the best device intelligence in the world. It's now clear that the scope of this technology needs to expand, to protect the entire internet against malicious bot activity.
The end of CAPTCHA as an automated fraud detection mechanism
CAPTCHAs, those little puzzles or image-clicking tests meant to distinguish between humans and bots, have long been a staple of web security. But the days of CAPTCHA as an effective shield are numbered.
As LLMs gain vision and interaction capabilities, they can now easily solve CAPTCHAs, undermining their fundamental purpose. Although Anthropic’s release has safety features preventing their models from solving CAPTCHAs, there will soon be tools that allow users to seamlessly solve click and puzzle CAPTCHAs, rendering them ineffective. If you want to go deeper, here's a fun paper exploring the topic.
Computer using agents: a new reality for AI agent security
We are accelerating toward a world where everyone will have an AI assistant that can accomplish tasks on the internet, and it will arrive sooner than many think. In the coming year, CUAs will become everyday tools, making our lives more convenient, but also creating a new breed of challenges, especially for the digital security ecosystem.
Malicious actors will also inevitably leverage CUAs to automate previously labor-intensive malicious activities. CAPTCHAs and traditional bot detection mechanisms simply will not stand a chance. They are built for a different era, an era in which bots were basic scripts rather than fully-fledged AI agents capable of reading, interpreting, and interacting like a human.
Sardine: rising to the challenge with AI fraud prevention
This presents a massive opportunity for Sardine. We have historically focused on combating fraud, using best-in-class solutions that leverage device intelligence (DI) and behavioral biometrics (BB). These tools are designed to understand, not just detect. Instead of a mere yes-or-no test like a CAPTCHA, our solutions analyze device and behavior signals to discern authentic users from bots.
With CUAs soon to become a daily norm, the total addressable market for DI/BB solutions could explode beyond the current fraud prevention focus. We're looking at a 100x increase, because suddenly, the risk is not just about chargebacks or bank fraud but the integrity of every single interaction on the web.
Every booking, every purchase, every form submission will need to be protected against misuse by advanced AI agents. Sardine is perfectly positioned to rise to this challenge with our machine learning fraud detection tools.
Preparing for Gen AI bot detection trends with proactive security
Chief Information Security Officers (CISOs) and Chief Technology Officers (CTOs) need to start preparing today.
The rise of CUAs is our current reality, not just another far off sci-fi threat.
It will redefine how websites and applications are secured. CAPTCHAs and traditional bot detection are being outpaced, but there is a solution.
Sardine’s device intelligence and behavioral biometrics solutions are ready to protect your website from the threats of tomorrow, today. These are low-lift, high-impact tools that can effectively distinguish between legitimate users and malicious agents. It’s time to move beyond outdated security measures and embrace a future-ready solution that doesn’t just detect, but understands.
The rise of CUAs is set to change the face of the internet, bringing with it both convenience and risk.
The question is, will your organization be ready?
Sardine is here to make sure you are.
Gen AI bot detection trends FAQs
What are Computer Using Agents, and why do they matter for bot detection?
Computer Using Agents are AI systems that can operate a browser on behalf of a user: clicking, typing, navigating pages, and completing forms. That capability is what makes traditional bot detection inadequate. These aren't basic scripts anymore. They're AI agents that read, interpret, and interact with websites the way a human would, which means controls built for the previous generation of bots simply won't catch them.
Why is CAPTCHA becoming less effective against modern bots?
CAPTCHAs were designed to stop simple scripts. As LLMs gain vision and interaction capabilities, they can solve image challenges and puzzle tests that once reliably blocked automated traffic. The tool hasn't changed, but the threat has. Security teams need detection methods that analyze behavior, device signals, and session patterns rather than relying on a single challenge a well-designed AI agent can pass.
How do behavioral biometrics help detect AI-driven bots?
Behavioral biometrics measure how users type, move a mouse, scroll, pause, and navigate through a session. Real humans produce natural variation. Automated agents tend to move faster, more consistently, and with less of the irregularity that characterizes human interaction. Those differences are detectable even when the agent is sophisticated enough to pass a CAPTCHA.
How does device intelligence support Gen AI bot detection?
Device intelligence identifies the device, browser, network, and automation environment behind a session. It surfaces signals like headless browser activity, emulator use, VPN or proxy masking, and inconsistencies between the reported and true device. Those signals help separate legitimate users, including users with legitimate AI assistants, from adversarial automated activity.
How should fraud teams handle sessions driven by legitimate AI agents?
Not every AI-assisted session is a threat. A legitimate delegated agent acting on behalf of a real user is a different risk profile than an adversarial bot trying to abuse an account or manufacture a fake identity. The right approach is risk-based scoring that factors in consent, device signals, behavioral patterns, and fraud history, rather than blocking all automated activity by default.