How to Detect AI Agents on Your Website | Full Guide

This guide covers AI agent detection through identity, network, browser, and behavioral signals. See free methods like server log analysis and specialized tools.

Juan Combariza

Attacks "Microsoft Clairty" Isn't Microsoft Clarity: Deobfuscating a Typosquatted Ad Fraud Script

Cside observed a new malicious client-side injection originating from a malicious browser extension impersonating Microsoft Clarity and overwriting referral tokens to redirect referral revenue to a malicious actor.
Simon Wijckmans

How to detect VPN traffic on a website

U.S. and U.K. age-verification laws require companies to prevent minors from accessing restricted content, including circumvention controls against VPNs.

Simon Wijckmans

When an AI API returns another user's response: shared caches and cross-tenant leaks

A Claude API incident appears to have returned other users' responses. Why shared caches cause cross-tenant leaks, and how to build around the risk.

Simon Wijckmans

MFA Didn't Fail, the Trust Model Did: Device Code Phishing and OAuth Token Theft (Kali365)

Kali365 abuses the OAuth 2.0 device authorization grant to steal Microsoft 365 tokens after MFA. A technical breakdown of the flow, FOCI, and detection.

Simon Wijckmans

AI is compressing the exploit cycle: Google's AI-developed zero-day and what it means for browsers

Google flagged a zero-day it believes was AI-developed. The real AI security shift isn't smarter phishing, it's how fast exploits reach the browser.

Simon Wijckmans

The Browser Session Is Now a Security Control Plane. Attackers Knew That Years Ago.

Google's DBSC proposal validates a clear security shift: browser sessions need device-aware validation after login, not only MFA.

Simon Wijckmans

Comparing Solutions for Account Takeover Prevention | 2026

Anti-fraud suites, fingerprinting tools, and MFA compared by what they cover in the ATO attack chain. Find the right stack for your risk profile.

Juan Combariza

How to Stop AI Agents From Creating Fake Accounts (Guide)

AI agents create fake accounts using real browsers, residential IPs, and generated identities. Here's the detection signal stack to stop them.

Juan Combariza

How to Block AI-Agent Based Content Scraping Bots (Guide)

AI content scraping bots use real browsers, residential IPs, and LLM-powered extraction to harvest your pricing and content. Here's how to stop them.

Juan Combariza

The Snowball Effect: How Mini Shai-Hulud Turns npm into a Worm Distribution Network

Mini Shai-Hulud turned npm packages into a credential-theft loop. Here is how the AntV wave spread and what teams should monitor next.

Simon Wijckmans

Why CAPTCHAs Are No Longer Reliable Bot Defense

CAPTCHAs are no longer a reliable primary bot defense. Learn why visible challenges fail and how resource-wasting defenses raise attacker cost.

Simon Wijckmans

Funnull Sanctioned: What the Polyfill[.io Attack Exposed About Infrastructure Laundering

OFAC's Funnull sanctions show why the Polyfill attack was part of a larger infrastructure laundering and browser supply-chain risk.

Simon Wijckmans