Agents that run inside the user's own browser get past bot walls, and sites start asking agents to identify themselves
Tools that spot and set rules for agents acting inside a real user's logged-in browser. Banks and retailers pay.
Competitive · ChatGPT acts inside users' Chrome tabs
Written for: Investor or analyst
Next step
Thesis: bot management splits off a new layer that detects agents within the session and sets rules per task, because blocking at the edge cannot see agents running in the user's own browser. Confirming signal: a major bank or retailer publishes agent task rules, or a bot-management vendor launches in-session agent detection. Already building: Cloudflare and Akamai on signed agents, with banks such as Citi and JPMorgan setting access terms.
Why now
The watchlist card said self-directed fleets break bot management built for scripts. What changed: the biggest consumer AI product moved its agent into the customer's own browser just as websites are closing their doors to agents and Citi has joined the banks restricting agent access to accounts. Blocking at the network edge no longer works on this traffic. Sites need to detect agents within the session and set task-level rules, such as letting an agent read but not move money.
What became possible
OpenAI's updated Chrome extension lets ChatGPT read open tabs and use Computer Use to fill forms and compare products, on every ChatGPT plan. The agent runs inside the user's real, logged-in browser, so checks on IP address and device fingerprint see a human. Open computer-use stacks (OpenGCUA, MAI-Gym) mean more agents built the same way.
Two ways in
- In-Session Agent Detector
A client-side script that flags extension-driven or programmatic interaction within a logged-in session, and applies rules per action, such as allowing browsing and blocking transfers or checkout.
- Customer
- Fraud teams at mid-size banks and large retailers
- Model
- Per-session or per-domain SaaS fee
- Agent Task Policy
A published, machine-readable policy that says which tasks agents may do on a site, plus a signed handshake so agents that follow it get a smoother path.
- Customer
- Banks and merchants that would rather manage agent traffic than block it
- Model
- Platform subscription, with free verification for agent makers
Competition
The opening for idea 2 is continuous monitoring of user-generated and third-party content (reviews, marketplace seller listings, ad slots). The pitch would be brand-liability protection for retailers adopting agentic checkout, perhaps paired with an agent-readiness score. The risk is that it becomes a feature: Cloudflare could fold it into its readiness tooling, and bot vendors or agent platforms could add it too.
Full competition notes (12 competitors)
Idea 1, behavioural agent fingerprinting plus a verified-agent allowlist, is already crowded. DataDome, HUMAN, Arkose, Radware, F5 and Fingerprint all now sell agent detection that goes beyond request signatures, and they pitch it to travel and ticketing sites in particular. Cloudflare and Akamai are making signed-agent allowlists free at the CDN layer through Web Bot Auth, so the allowlist adds little on its own. A newcomer could only realistically win on something the incumbents haven't proven yet. One option is cross-session, task-level detection of agents that rotate identity and infrastructure, sold as a narrow add-on for a vertical like airline fare or map-tile scraping and sitting on top of an existing CDN. Even then, it would be competing with incumbents who own the network-wide data. Idea 2, scanning your own site for injected instructions, is close to empty commercially. What I found was open-source tools that are either crawl-based (AASA) or agent-side (Buzur, LLM Guard), plus research benchmarks and articles describing the risk to retailers from hidden text in reviews and HTML comments. No named vendor sells retailers an ongoing audit of their own pages, user-generated content, headers and llms.txt. Cloudflare's agent-readiness check apparently doesn't test content for injection. The opening for idea 2 is continuous monitoring of user-generated and third-party content (reviews, marketplace seller listings, ad slots). The pitch would be brand-liability protection for retailers adopting agentic checkout, perhaps paired with an agent-readiness score. The risk is that it becomes a feature: Cloudflare could fold it into its readiness tooling, and bot vendors or agent platforms could add it too.
- DataDome Agent Trust
Its intent models score each agent request for scraping, scalping and payment fraud, and it markets this directly to travel sites. Dohop is its named example. DataDome claims about 80% of agents don't declare themselves, which is close to the same pitch as idea 1.
- HUMAN Security AgenticTrust
Detects, classifies, verifies and governs AI agents. It shows intent, session behaviour and the routes agents target, drawing on HUMAN's network-wide threat intelligence.
- Arkose Labs Agent Trust Manager
Splits traffic into self-declaring good agents, undeclared good agents and adversaries. It verifies Web Bot Auth signatures where agents provide them.
- Radware Bot Manager (AI agent visibility)
Uses layered behavioural detection to catch unsigned agents, and reports agent volume and which routes they hit.
- F5 Bot Defense for Agentic AI
Offers allowlists, integrity checks and rate controls tied to an agent's identity and purpose. It is sold through enterprise account teams.
- Fingerprint Authorized AI Agent Detection
Identifies trusted agents from cryptographically signed requests. It covers signed agents only, so on its own it isn't behavioural.
- Cloudflare Signed Agents / Web Bot Auth
A CDN-level directory of signed agents with per-site permissions. Akamai also verifies Web Bot Auth signatures, so the verified-agent allowlist is effectively becoming standard infrastructure.
- Stytch isAgent
A lightweight front-end component that lets developers flag agent traffic.
- cside
A newer vendor publishing buyer guides for AI agent detection. It cites Forrester's renamed category, Bot and Agent Trust Management, as evidence the market is forming.
- AASA (AI Agent Attack Surface Analyzer)
Open-source tool that crawls websites and PDFs and finds agent config files. It flags indirect prompt injection and exfiltration paths using static rules plus an LLM acting as judge. This is the closest match to idea 2.
- Buzur
Open-source indirect prompt injection scanner that runs on the agent side. It screens web content before the model sees it, so it protects agents rather than auditing sites.
- AgentShare Chrome extension
A hobby project that checks robots.txt and llms.txt and runs a local prompt injection scan on pages. Its availability was unclear.
Checked 2026-10-16
Risks
- Cloudflare and Akamai will ship this as a feature to their existing customers
- Detection becomes an arms race that agent makers can win
- Open-banking or consumer-access rules could force banks to let agents in
Strong team fit; open space is the weak point (5).
tech 6 · pull 7 · space 5 · fit 8 · build 6
Exposed
Companies that could benefit or be threatened. News and context, not investment advice.
Momentum of its main topic
Sources
- Websites are closing their doors to AI agentsThe Verge AI
- ChatGPT becomes a full Chrome browser assistant that reads and acts on your open tabsThe Decoder
- Citi becomes latest US bank to restrict AI agents from accessing accountsFT Markets
- OpenGCUA: Toward a Fully Open Stack for Generalist Computer UseHF Daily Papers
- MAI-Gym: An Open All-in-One Platform for GUI Agent Evaluation and RL Training across Mobile and Computer EnvironmentsHF Daily Papers
Status history
- 2026-10-16 Added to the watchlist
- 2026-10-18 Promoted from the watchlist: Today's evidence made it buildable
- 2026-10-18 Flagged as buildable