Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Detecting AI agent use and abuse

stytch.com

Post reply on HN
Print view View original

21–30 of 106 posts

Re: Detecting AI agent use and abuse

#21

Post by digitaltrees »

JohnMakin wrote: post #7

I've been flagged as a bot on pretty much every major platform. Most ridiculously lately, linkedin - I have to prove my identity using 2 different forms of ID, which they still won't accept, OR find a notary and somehow prove I own the account I no longer have access to. Maybe try refining this tech a little better before you start blasting legitimate users with it - I am extremely skeptical of the catch rate given w…

Maybe if sales navigator was better there wouldn't be so many third party automation platforms that do automation. Or maybe if linkedin figured out how to make money with an ecosystem rather than monopoly they wouldn't need to be so aggressive.

I think companies that are hostile to AI Agents are going to shrink. AI Agents are a new class of user, the platforms that welcome them will grow and thrive, those that are hostile will suffer.

Re: Detecting AI agent use and abuse

#22

Post by wat10000 »

deadbabe wrote: post #11
JohnMakin wrote: post #7

I've been flagged as a bot on pretty much every major platform. Most ridiculously lately, linkedin - I have to prove my identity using 2 different forms of ID, which they still won't accept, OR find a notary and somehow prove I own the account I no longer have access to. Maybe try refining this tech a little better before you start blasting legitimate users with it - I am extremely skeptical of the catch rate given w…

I asked a manager about this, the policy is that we do not need to differentiate between bots and people who sound similar to bots: both are considered low quality content/engagement. Delete them. Seems like wherever they delete bots, they will in the end, delete human beings.

That's what happens when a business is built on getting a tiny amount of value per user from a vast number of users. There's essentially no incentive to treat any individual user well, and no resources to make it happen even if they wanted to. This becomes more and more problematic as our lives revolve more and more around such businesses.

Re: Detecting AI agent use and abuse

#23

Post by deadbabe »

wat10000 wrote: post #22
deadbabe wrote: post #11

Earlier quoted context omitted.

I asked a manager about this, the policy is that we do not need to differentiate between bots and people who sound similar to bots: both are considered low quality content/engagement. Delete them. Seems like wherever they delete bots, they will in the end, delete human beings.

That's what happens when a business is built on getting a tiny amount of value per user from a vast number of users. There's essentially no incentive to treat any individual user well, and no resources to make it happen even if they wanted to. This becomes more and more problematic as our lives revolve more and more around such businesses.

Silly commenters, mass audiences are for influencers, but go ahead and write your little bandwagoned take so you can feel heard.

Re: Detecting AI agent use and abuse

#24

Post by cess11 »

diggan wrote: post #3

> it could present unacceptable risks for application developers or be used as a method for malicious attacks (e.g. credential stuffing or fake account creation). The article seems to want to distinguish between "bad" and "good" bots, yet beyond the introduction, seems to treat them exactly the same. Why are website authors so adamant I need to use whatever client they want to consume their content? If you put up a b…

As an almost fanatic VPN and Tor user I'm already used to being blocked and circumventing it, usually by exiting through a data center IPv4 but I sometimes check whether they let SeleniumBase access with a chromedriver and surprisingly often they do.

The Internet is a rather hostile place, I don't think that'll change anytime soon.

Re: Detecting AI agent use and abuse

#25

Post by radlad »

diggan wrote: post #16
Etheryte wrote: post #8

Earlier quoted context omitted.

The problem is resource consumption. On some of my servers, scrapers, bots etc make up a vast majority of both the bandwidth and CPU usage when left unchecked. If I didn't block them, I would need to pay for a beefier server. All the while this doesn't give me or my regular visitors any benefit, it's just large corporations driving up my hosting costs.

> The problem is resource consumption. On some of my servers, scrapers, bots etc make up a vast majority of both the bandwidth and CPU usage when left unchecked What are they downloading, like heavy videos and stuff? Initiating heavy processes or similar?

It takes 125,000 4MB requests to use up 0.5 TB bandwidth, which is the lowest offered by Vultr. I could see this being an issue for personal sites that include photos.

Re: Detecting AI agent use and abuse

#26

Post by reverendsteveii »

diggan wrote: post #3

> it could present unacceptable risks for application developers or be used as a method for malicious attacks (e.g. credential stuffing or fake account creation). The article seems to want to distinguish between "bad" and "good" bots, yet beyond the introduction, seems to treat them exactly the same. Why are website authors so adamant I need to use whatever client they want to consume their content? If you put up a b…

I came here to say exactly this. Of course bots can do things that are shitty but we need to detect and ban the behavior and resist the urge to also try to detect and ban the type of user that tends to exhibit that behavior. If a bot comes onto my page, hands off the captcha to a human, then does human things at human speed and human scale I shouldn't care that they're a bot and I should allow them to do what they're doing. If a human comes onto my page and starts trying to brute force directory structures, mass-downloading tons of huge files and otherwise causing a problem I shouldn't care that they're a human and I should block them. This whole idea of bot detection and blocking seems to be an inversion of what I think is the best design principle we've discovered in the history of software development: build things that do simple, useful things without regard to who is using them or for what, then let consumers surprise you with what they do with it. Banning non-abusive agents is just locking out potential upsides for your app.

OTOH if you make your living serving ads a bot bypassing your monetization is a problem for you. Either you detect and block them or eventually the value of an ad impression in your app will approach zero. So in some cases I guess merely not being a human is the abusive behavior.

Re: Detecting AI agent use and abuse

#28

Post by ATechGuy »

Looks like detecting real humans apart from agents is going to be an arms race if the detection is based on browser/device fingerprinting or visual/audio captchas; AI will only get better.

What are captcha alternatives that can block resource consumption by bots?

Re: Detecting AI agent use and abuse

#29

Post by JohnMakin »

deadbabe wrote: post #11
JohnMakin wrote: post #7

I've been flagged as a bot on pretty much every major platform. Most ridiculously lately, linkedin - I have to prove my identity using 2 different forms of ID, which they still won't accept, OR find a notary and somehow prove I own the account I no longer have access to. Maybe try refining this tech a little better before you start blasting legitimate users with it - I am extremely skeptical of the catch rate given w…

I asked a manager about this, the policy is that we do not need to differentiate between bots and people who sound similar to bots: both are considered low quality content/engagement. Delete them. Seems like wherever they delete bots, they will in the end, delete human beings.

My problem with this approach is what metrics are you using to determine whatever I am doing is "low quality?" On LinkedIn specifically, I barely ever post "content" publicly - I use it to network with recruiters and read technical articles mostly. It's completely opaque and will catch users doing absolutely nothing wrong or "low content," maybe they are on the spectrum or disabled in a way that makes their user clicks look weird. No managers ever consider these things, it's always like "oh well, fuck em"

Re: Detecting AI agent use and abuse

#30

Post by reverendsteveii »

ceejayoz wrote: post #2

I fully expect captchas to incorporate "type the racial slur / death threat into the box" soon, as the widely available models will balk at it.

the LLMs are trained on data stolen from the internet. There's no racial slur they don't know, there's no death threat they can't deliver. Currently our best LLMs are generating new racial slurs to deploy in our eternal quest to make the internet worse. You may have never heard the term "Chapingle" before but don't use it in front of a Lithuanian person after the year 2028 unless you want punched in the mouth.
Post reply on HN