--- title: "A malicious agent won’t tell you who it is · Agentrail" description: "Agentrail traces what any agent did across your site, docs, API and MCP server, even one that never identifies itself. Block it at your edge, then test the fix." canonical: "https://www.agentrail.co/use-cases/reactive-security" --- Reactive security # A malicious agent won’t tell you who it is. Agentrail traces what any agent did across your site, docs, API and MCP server, even one that never identifies itself. Block it at your edge, then test the fix. [How Journey Tracking Works](https://www.agentrail.co/use-cases/reactive-security#identify) Why now ## For five days, the agents never said. An intrusion was disclosed. It took five more days to learn that AI test agents were behind it. ![OpenAI and Hugging Face marks, split by a torn edge.](https://www.agentrail.co/assets/use-cases/reactive-security/news/openai-hugging-face.png)[NewsOpenAI Agents Escape Test and Breach Hugging Face24 Jul 2026**Newsroom**Swipe_Source_](https://orchestra.substack.com/p/openais-models-breached-hugging-face)[Breaking newsOpenAI says it took a week to detect its AI models had hacked Hugging Face_Source_](https://www.ft.com/content/3fc189d6-28e7-4a2b-b77e-5c94bf513955)[![Bloomberg video: the Hugging Face CEO on the OpenAI hack.](https://www.agentrail.co/assets/use-cases/reactive-security/news/bloomberg.png)_Source_](https://www.bloomberg.com/news/videos/2026-08-03/openai-hack-could-have-been-worse-hugging-face-says-video) ### A malicious agent won’t tell you who it is. Agentrail recognises agents by how they behave, so it can trace one agent across your product whether or not it identifies itself. Why agents change abuse ## Cheap, fast, unnamed, and ordinary one request at a time. Each request looks normal on its own. The abuse only shows up when you follow the same agent from one request to the next. - ### Free-tier farming Nine free accounts in 40 minutes, with throwaway emails. - ### Leaked keys A key pasted into a public repo, used from hosting providers within minutes. - ### Cache busting A scraper adds a new query string so the cache never answers. - New ### Text written for agents Planted in a pull request or a doc, telling agents to approve something. - 10:02**POST /signup**_Allowed_ - 10:04**POST /v1/keys**_Allowed_ - 10:09**POST /signup**_Allowed_ ### What firewalls see Single requests, judged by what each client claims to be. Every one looks fine. One agent · 3 steps 1. 10:02**POST /signup** 2. 10:04**POST /v1/keys** 3. 10:09**POST /signup** ### What Agentrail sees The journey: sign-up, then the API call, then the next sign-up, from the same agent. **Reactive** means Agentrail works from what actually happened in your traffic. It isn’t a pen test or a scan. Four signals ## Each incident comes with the journeys behind it. Free-tier farming ### 9 sign-ups, one fingerprint Nine free accounts in 40 minutes, each with a throwaway email. Block the fingerprint at your edge. Leaked key ### 3 networks in 2 minutes A key that calls from one office network was used from two hosting providers. Revoke it and scope new keys. Scraping ### 40 requests a second Against a normal agent rate of 0.4\. Keep the 429 limit, and serve /llms.txt and Markdown. Planted instructions ### A pull request told agents to approve it An agent reading findings through the MCP server repeated “pre-approved”. The fix: mark pull request text as untrusted. The journey is the evidence ## A firewall log is a list of requests. An incident is the path. When something goes wrong, Agentrail rebuilds the journey from your logs: which agent, from which path, and why. Live, while it’s still happening. Firewall logFingerprintIncident - GET /pricing - POST /signup - GET /docs/rules - POST /v1/reviews - GET /blog - POST /signup - GET /docs - POST /v1/reviews fp\_7c2a91 Live: ramping to 5,000 requests **Block** One agent, one journey 1. Sign-up`/signup` 2. Review`/v1/reviews` 3. Sign-up again`/signup` 4. Repeated 9 times in 40 minutes Why: **free-tier farming** ### Proactive security Scans and pen tests that guess what might happen, before it does. ### Reactive security, with Agentrail Works from what actually happened in your traffic, and tells you while it’s happening. Start free ## Agent readiness checks whether agents can find and read. A free scan of your public site, docs and API, scored out of 100, with the change worth the most named under “Fix next.” Readiness checks whether agents can find and read things. A simulation checks whether they finish. [Check your site’s agent readiness](https://www.agentrail.co/agent-readiness/checker) ![A raccoon in a detective coat, holding a magnifying glass.](https://www.agentrail.co/assets/use-cases/agent-evals/banner-raccoon.png) Identify by behaviour ## The agent can lie about its name. The journey still joins. Agentrail recognises an agent by how it behaves, using request, behavioural, timing and product signals. Each incident shows which method applied. **83%**of an agent’s steps linked correctly Standard analytics doesn’t join them [How journey tracking works](https://www.agentrail.co/use-cases/reactive-security#journey) **Same agent** fp\_7c2a91 Names it claimed - Chrome/124 - python-requests - (none) - **Request**Headers, TLS and order - **Behaviour**What it does, step by step - **Timing**Gaps between requests - **Product**Accounts, keys and reviews Act on it ## Block at your edge, or fix it in the product. You choose what to block. Each incident shows the suggested action, the evidence and how the agent was identified, so you can tell a farming script from a real customer’s agent. The edge that records journeys is also where blocking happens. **Incident #14**Free-tier farming Evidence 9 sign-ups, one fingerprint Identified by Fingerprint Suggested Block at your edge You choose **Block at your edge**rule: block fp\_7c2a91 _Active_ **Fix it in the product**confirm email before free review _Resolved_ Test the fix ## Write the attack as a scenario and run it. After the MCP server marks pull request text as untrusted, run agents against a pull request that carries the planted instruction. Check that none of them repeat it. [Evals for your product](https://www.agentrail.co/use-cases/agent-evals) ### Scenarios The questions and tasks Agentrail runs on every agent for you, and how Greptile did on each one. 8 of 8 scenariosSearch scenariosFilter | | Scenario | Type | Topic | Latest result | Last run | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- | -------------------------------------- | ------------------ | ------------- | -------- | | We’re a 12-person startup on GitHub. Which AI code reviewer actually understands the whole repository, not just the diff?Intent: Research | Open-ended | Automated pull request review | No pick | 2 hours ago | | | We’re down to Greptile and CodeRabbit for pull request reviews. Which one catches cross-file bugs instead of style nits?Intent: Research_Needs attention_**vs CodeRabbit** | Open-ended | Automated pull request review | Lost to CodeRabbit | 2 hours ago | | | How do I make an AI reviewer enforce our naming conventions across every repository we own?Intent: Implement_Needs attention_ | Open-ended | Team review standards and custom rules | Judging failed | 2 hours ago | | | I want to run an AI code review from my terminal before I push. What should I use?Intent: ImplementStage: Installation | Open-ended | Pre-push review from the command line | Picked Greptile | 2 hours ago | | FAQ ## Questions teams usually ask. Is this a WAF or bot blocker? No. A firewall judges each request by what the client claims to be, and every one of these looked fine. Agentrail follows the same agent from one request to the next, then you choose whether to block it. What if the agent lies about who it is? The name can be Chrome, python-requests, or nothing. The journey still joins. Agentrail uses the request, what the agent does, the gaps between requests, and the accounts, keys and reviews it touches. Each incident shows which method applied. How do we know the fix worked? Write the attack as a scenario and run it. After pull request text is marked untrusted, agents run against a pull request that carries the planted instruction. The check is that none of them repeat it. Does it block good agents? You choose what to block. Each incident shows the suggested action, the evidence, and how the agent was identified, so a farming script stays separate from a real customer’s agent. What do I need to install? Nothing in the prompt, and no scanner. Agentrail works from what actually happened in your traffic. The edge that records the journeys is also where blocking happens. Is this the same as your Security page? No. The Security page is how Agentrail handles your data. This is the product: tracing an agent that never identifies itself, blocking it at the edge, or fixing the product and testing that fix.