Sep 4, 2026 · 35 min
Security teams rethink bots as autonomous agents take over online tasks
What the Flock?
As software agents begin handling routine internet activity, organizations must distinguish legitimate automation from fraud without treating every bot as hostile.
- 1Autonomous agents require identity, authorization, and intent checks beyond traditional bot detection.
- 2Economic deterrence can reduce cybercrime by making scams, account compromise, and promotional fraud less profitable.
- 3Durable agent security frameworks should support legitimate automation while adapting to changing technical standards.
Don't miss
Gosschalk explains why future internet defenses must authorize legitimate agents while economically deterring fraudulent ones.
The brief
Kevin Gosschalk of Arkose Labs argues that the old category of “the bot” no longer fits an internet where autonomous agents can act on users’ behalf.
The central security problem is not automation alone but whether an agent can prove its identity, obtain authorization, and demonstrate legitimate intent.
Gosschalk’s economic-deterrence approach shifts attention from catching every attack to making scams, account compromise, and promotional fraud less profitable.
His book After Bots frames agentic technology as governable through technology frameworks and authorization policies that preserve useful automation.
The conversation’s forward-looking claim is that agents will soon book travel, conduct searches, and reshape internet traffic beyond the technology early adopters.
Books & mentions
Some links are affiliate links — PodLume may earn a commission if you buy.