A login cannot tell you whether a person or an agent is acting. It proves a credential was valid at one moment. Everything after that is inferred from a token, which an agent can hold as easily as a person.
Key takeaways
- A valid login says nothing about whether a human or an agent is acting.
- Agents are real and already operating inside authenticated sessions. In a documented 2025 campaign, AI did an estimated 80 to 90 percent of the work.
- No single tell catches every agent. Weigh many signals together, all session long.
Agents are already inside the session
This is not a forecast. In a campaign Anthropic disclosed in November 2025, a state-sponsored group manipulated an AI coding tool into attempting infiltration of roughly thirty organizations. Anthropic estimated the AI did 80 to 90 percent of the work, with humans needed at only a handful of decision points, and a small number of attempts succeeded.
The group got past the model’s safeguards by splitting the work into small, innocent-looking tasks and telling the AI it was doing authorized defensive testing. The same pattern shows up in a recent World Economic Forum report, as summarized by Quartz, which describes agentic AI executing intrusions with minimal direction.
Two nuances matter. The AI made mistakes, including claiming to have found credentials that did not work, and humans still supervised. Neither changes the direction.
Many agents never sign in at all
Not every agent is hostile. Many are tools a company chose. But identity systems only govern what authenticates through them. The Hacker News reported that in the environments studied for the 2026 State of Agent Security Report, nearly 1,000 of roughly 1,280 third-party products embedding AI sat outside single sign-on. Whether those agents are friendly or not, a login never described them.
Put the two together and the question gets practical. Is the thing driving this session a real human or an agent? And if it is a human, is it the right one?
Why one test is never enough
Anyone offering a single trick that catches every agent is selling a trick. Agents get better at imitating people, and a test built on one habit gets learned and bypassed. That is also true of puzzles people have to solve: agents learn to solve them.
A sturdier approach has three features:
- Many signals, weighed together. How a person types and moves, how they use their applications, their device and connection, and the context of the session, combined with advanced pattern matching and anomaly detection.
- Continuous, not one-time. The check repeats through the session, so an agent has to keep passing it, not clear it once.
- Passive. Nothing for the real person to solve, so nothing for an attacker to study or defeat by solving a puzzle.
Mimoto Continuous Verification works this way and answers both questions all session long. Mimoto Continuous CAPTCHA answers the first where agents get in, on website sign-up forms, with a clear call: person or agent. Continuous Verification never captures what a person types.
What to do now
- List where agents act under human credentials, including tools employees installed themselves.
- Decide what a wrong answer should trigger, from re-verification to ending the session, and where the notification should go.
Questions answered
How do you tell a human from an AI agent in a live session?
Not from the login. A sturdier approach weighs many signals together and keeps checking through the whole session instead of relying on one test or one moment.
Can an AI agent pass a CAPTCHA?
Many can pass the checks built to stop simple bots. Mimoto Continuous CAPTCHA is built for agents pretending to be people: it checks how each sign-up entry is put together, not what it says, and makes a clear call, person or agent.
Are all AI agents a threat?
No. Many are tools an organization chose. The risk is agents it did not choose, agents it cannot see, and agents run by attackers.
Does Mimoto capture what people type?
No. Mimoto measures how a person interacts, never what they type.
Sources
- Anthropic, Disrupting the first reported AI-orchestrated cyber espionage campaign, November 13, 2025.
- The Hacker News, The Third-Party Agent Problem: Why Security Built for AI You Chose Misses the Agents You Didn’t, October 10, 2026.
- Quartz, How AI is being used to both attack and defend against hackers in 2026, according to a new WEF report, updated October 8, 2026.
