A story went around this month that is easy to file under "education problem." The New York Times reported that AI agents are no longer just writing essays for students. They log in, click through the course, answer the quizzes, and submit. End to end. Faculty at Brown and Alcorn State set traps to prove it, and the agents walked right through them. Most of the big chatbots did not refuse the prompt.
If you build software, do not read this as a story about lazy students. Read it as a status update on your own product.
The thing that actually broke
For years, a huge number of product decisions rested on one quiet assumption: a real person is on the other end, doing this by hand. Account signup. The "watch this video to continue" gate. Multi-step onboarding. Proctored assessments. Survey incentives. Referral programs. Any flow where the friction was the control.
Agentic browsing removes the friction as a control. If an agent can log into a learning platform and complete a graded course, it can complete your onboarding checklist, farm your referral bonuses, exhaust your free tier across a thousand accounts, and fill your "request a demo" form with plausible garbage. The capability that finished the quiz is the same capability pointed at your funnel.
This is not hypothetical or far off. It shipped to consumers. The barrier to running it is a paid subscription and a sentence of instruction.
Detection is the wrong first move
The reflex is to reach for detection. Add a bot check. Buy a "human or AI" classifier. Bolt on harder CAPTCHAs.
That is a losing race, and it taxes your real users. The same agents completing coursework are getting better at solving CAPTCHAs than people are. Every bit of friction you add to stop the agent lands hardest on the humans you actually want.
The better question is not "how do I detect the agent." It is "what am I protecting, and does it need proof of a specific human, or just proof the action was authorized?" Most flows do not need to know a human did it. They need to know the action was legitimate. Those are different problems with different, cheaper answers.
What to build instead
Sort your workflows by what an automated completion actually costs you.
- Low stakes (marketing signups, content gates): let the agents through. Stop paying an engineering tax to defend something that does not matter. Measure real intent downstream instead.
- Economic stakes (free tiers, referral payouts, credits, coupons): move the control off "manual effort" and onto verified identity, payment signals, and rate limits tied to something scarce and real.
- High stakes (assessments, KYC, anything where a specific human must be accountable): you now need real proof of human presence at the moment it matters. Liveness checks, verified credentials, in-person or synchronous components. The "upload it whenever" async model is finished for anything that certifies a person.
The teams who get burned are the ones who keep treating a single "are you a robot" checkbox as the whole defense. The teams who do well redesign the flow around the value at risk.
The uncomfortable part
Some products were never really selling the thing they thought they were. An online course that an agent can pass without the student learning anything was selling a completion certificate, not an education. Agentic browsing is going to force a lot of these quiet substitutions into the open. If your product''s value collapses the moment a human stops doing the work by hand, that is worth knowing now, while you can still redesign it.
The assumption that a person is on the other end held for a long time. It stopped holding this year. The fix is architectural, and it is specific to what each flow is actually protecting.
We are here to help founders and teams design and build digital products that are built to scale with you, not slow you down. If you are looking to build something, get in contact with us today!