Your bot detection works perfectly. That's the problem.

Every bot signal we have is a proxy for one question: is a human here?

• Device fingerprint says a real browser.
• IP reputation says a home connection, not a rented server.
• Email verification says someone opened the mailbox and clicked.
• Behavioural analysis says the mouse moved like a person's.

A capable AI agent has all of those things. It drives a real browser, because that is how it browses. It runs on a residential connection, because that is where the person who deployed it lives. It controls a mailbox, because it was given one. It moves a cursor because it is genuinely operating a UI.

It is not evading your checks. It is satisfying them.

A harder problem than an arms race

That is a harder problem than an arms race, because there is no signal to add. The checks are working exactly as designed and returning exactly the right answer to the question they were built to ask. The question stopped being useful.

The wrong question

What I have landed on is that "is this automated" has quietly become the wrong question, and the one that still has an answer is "on whose authority is this acting, and can they be held to it?"

That reframes detection into something closer to authentication - and unlike detection, authentication has a real answer.

Open questions for signup and checkout flows

I am curious whether people building signup and checkout flows are seeing this yet, or whether it is still theoretical in most stacks. Has a legitimate customer's assistant hit your product and been refused? Would you even know?