# How to Detect AI Agents on Your Website | Full Guide

This guide covers AI agent detection through identity, network, browser, and behavioral signals. See free methods like server log analysis and specialized tools.

Juan Combariza

# Attacks "Microsoft Clairty" Isn't Microsoft Clarity: Deobfuscating a Typosquatted Ad Fraud Script  
Cside observed a new malicious client-side injection originating from a malicious browser extension impersonating Microsoft Clarity and overwriting referral tokens to redirect referral revenue to a malicious actor.  
 Simon Wijckmans

# How to detect VPN traffic on a website  
U.S. and U.K. age-verification laws require companies to prevent minors from accessing restricted content, including circumvention controls against VPNs.

Simon Wijckmans

# When an AI API returns another user's response: shared caches and cross-tenant leaks  
A Claude API incident appears to have returned other users' responses. Why shared caches cause cross-tenant leaks, and how to build around the risk.

Simon Wijckmans

# MFA Didn't Fail, the Trust Model Did: Device Code Phishing and OAuth Token Theft (Kali365)  
Kali365 abuses the OAuth 2.0 device authorization grant to steal Microsoft 365 tokens after MFA. A technical breakdown of the flow, FOCI, and detection.

Simon Wijckmans

# AI is compressing the exploit cycle: Google's AI-developed zero-day and what it means for browsers  
Google flagged a zero-day it believes was AI-developed. The real AI security shift isn't smarter phishing, it's how fast exploits reach the browser.

Simon Wijckmans

# The Browser Session Is Now a Security Control Plane. Attackers Knew That Years Ago.  
Google's DBSC proposal validates a clear security shift: browser sessions need device-aware validation after login, not only MFA.

Simon Wijckmans

# Comparing Solutions for Account Takeover Prevention | 2026  
Anti-fraud suites, fingerprinting tools, and MFA compared by what they cover in the ATO attack chain. Find the right stack for your risk profile.

Juan Combariza

# How to Stop AI Agents From Creating Fake Accounts (Guide)  
AI agents create fake accounts using real browsers, residential IPs, and generated identities. Here's the detection signal stack to stop them.

Juan Combariza

# How to Block AI-Agent Based Content Scraping Bots (Guide)  
AI content scraping bots use real browsers, residential IPs, and LLM-powered extraction to harvest your pricing and content. Here's how to stop them.

Juan Combariza

# The Snowball Effect: How Mini Shai-Hulud Turns npm into a Worm Distribution Network  
Mini Shai-Hulud turned npm packages into a credential-theft loop. Here is how the AntV wave spread and what teams should monitor next.

Simon Wijckmans

# Why CAPTCHAs Are No Longer Reliable Bot Defense  
CAPTCHAs are no longer a reliable primary bot defense. Learn why visible challenges fail and how resource-wasting defenses raise attacker cost.

Simon Wijckmans

# Funnull Sanctioned: What the Polyfill[.io Attack Exposed About Infrastructure Laundering  
OFAC's Funnull sanctions show why the Polyfill attack was part of a larger infrastructure laundering and browser supply-chain risk.

Simon Wijckmans