Summary
- Cequence observed more than 250,000 AI agent visits across five industries in a week, with approximately one in seven involving an account action or transaction.
- Undisclosed agent traffic at one telecom provider grew from about 100 to as many as 32,000 daily requests following a consumer agent launch.
- A separate controlled prototype found fewer attempts outside assigned duties when each agent action was independently checked.
AI agents are already signing into customer accounts, making purchases, and managing services without consistently identifying themselves as automated clients, according to production traffic observations that raise questions about how businesses authorise delegated activity.
Cequence Security has published research developed with input from KPMG in Singapore examining the controls needed when agents move from answering questions to performing consequential actions through applications and APIs.
The 11 November report combines two separate kinds of evidence: observations of agent activity across live customer-facing systems and a controlled experiment using a Cequence research prototype. The production figures describe traffic visible to the company, whereas the experiment measures how a proposed authorisation method performed under test conditions.
Production traffic shows agents taking action
Cequence says its CQ Prime research team observed more than 250,000 AI agent visits across five industries during one week in October 2026. Approximately one in seven visits involved booking, purchasing, signing in, or managing an account for a customer.
These were observations from production application traffic visible to Cequence. They were not drawn from a representative sample of all internet activity, and the findings should not be extrapolated to the wider population of AI agents.
At one telecommunications provider, traffic from agents that did not identify themselves as automated clients reportedly increased from approximately 100 requests per day to as many as 32,000 within three weeks of a major consumer agent launch.
Those agents signed in using customer accounts and passed multifactor authentication. This does not establish that their activity was necessarily malicious: a customer may legitimately permit an automated assistant to access an account. The operational problem is establishing whether the subsequent actions remain consistent with the customer’s instructions.
Claimed identity does not prove legitimacy
At an online marketplace, Cequence also observed traffic claiming to originate from Google-Agent. More visits carried that claimed identity than the genuine agent visits the researchers recorded during the same week.
The suspicious requests went directly to the sign-in page and failed authentication, behaviour Cequence interpreted as credential testing using a trusted agent’s name. Google was not involved.
A name supplied in an application request is not sufficient to authenticate the origin of a client. Nor does verifying a customer’s account establish that an automated system should be allowed to perform every operation exposed through the account.
Businesses must therefore distinguish client identification, account authentication, delegated consent, and authorisation of a specific transaction.
A separate experiment tests runtime controls
Separately, Cequence conducted a controlled experiment using a research prototype. With conventional login credentials and fixed permissions, agents attempted actions outside their assigned responsibilities in 44% of experimental runs.
When agents were given explicitly defined tasks and their actions were checked against those boundaries, the figure declined to 1%. Within the same experimental conditions, task completion increased from 76% to 95%, while token consumption fell by approximately 35%.
These are prototype outcomes, not improvements measured across the telecommunications or marketplace environments described elsewhere in the report. The experiment provides evidence of how one proposed control model performed under test conditions, rather than a universal estimate of the effectiveness of runtime governance.
The research organisation recommends giving each agent a defined job and applying independent checks throughout a task. Those checks could approve, block, or escalate individual operations according to context, rather than treating an initial authentication event as blanket permission for an entire sequence.
Account access is not unlimited authority
AI agents can carry out tasks by combining several operations, each of which may be technically permitted through an application interface. A customer might authorise a comparison of insurance policies but not a change to coverage, or permit an agent to prepare a payment without approving its execution.
These boundaries can be difficult to express through conventional standing account permissions alone. They involve both the purpose of the task and the cumulative effects of steps taken to complete it.
Shreyans Mehta, CTO and co-founder of Cequence Security, said: “An approval at step one shouldn’t carry into step five.”
Gerry Chng, Partner and Head of Cyber at KPMG in Singapore, said that traditional identity verification and fixed permissions may be insufficient where agents execute sequences of actions. Organisations need to consider each agent’s role, the context of operations, and the risks created across an entire workflow.
These principles affect customer-facing applications as well as internally deployed automation. Independent authorisation, records of agent activity, and clear consent boundaries become more consequential as APIs expose payments, account changes, and sensitive records to automated clients.
The full Agentic AI Runtime Security, Governance, and Control report addresses both the observed traffic and the prototype study. The findings establish that automated customer operations are already occurring, while the proposed control model remains supported by experimental results rather than demonstrated outcomes across all production deployments.
