Fingerprint Adds Detection for AI Agents That Hide Their Identity, Including Grok Bot

Websites have mostly relied on agents declaring who they are, through user-agent strings or cryptographic signatures, to decide whether to let them in. Fingerprint says a growing number of agents now look like ordinary human browsers. That makes it harder for banks, retailers and booking platforms to tell a customer's own assistant from a scraper or a fraudster.

According to the company, Muse has no verifiable identity, changes its browser fingerprint and hides the usual automation flags. Fingerprint said it began detecting Muse about two weeks after Meta announced the agent, and that it found Muse activity in a major bank's login flows that other security vendors had missed. It did not name the bank.

Instinct logs into sites with users' own credentials, including requesting SMS multi-factor codes, without signing its traffic, Fingerprint said. The release cited a CNN report of Instinct pinging the reservation platform Resy hundreds of times an hour, which led to an account being deactivated.

Grok Bot signs in to websites, manages inboxes and completes multi-step tasks. Fingerprint said it used to sign its requests with Web Bot Auth, a standard that lets sites verify an agent, but stopped around October 9, 2026. In a blog post on November 2, the company said Grok Bot now runs in a real browser with a visible window, so common automation signals do not appear. It can also send traffic through the user's own internet connection, which means IP reputation and data centre checks may not catch it.

"That lack of transparency is already a widespread issue," chief executive Dan Pinto said in the release. He cited a Fingerprint report that found 79% of financial institutions had caught a malicious bot or scraper posing as an AI assistant.

Fingerprint's Bot Detection Smart Signal sorts traffic into humans, known bots, cryptographically verified AI agents, undeclared agents and spoofed bots. It gives inferred agents a high, medium or low confidence rating and adds network details such as IP address and data centre origin. The company says flagging an agent this way reflects only that it has not declared itself, not that it is malicious.

The new detection is available now through Fingerprint's JavaScript agent, Server API, Rules Engine and MCP server. Existing bot detection customers will get Grok Bot detection at no extra charge in a staggered rollout over the next few weeks, and must contact support to turn it on.