{
  "slug": "rogue-agent-impersonation",
  "title": "Anyone can claim to be your agent. Nothing currently stops them.",
  "summary": "Agent traffic identifies itself with strings anyone can copy. Web Bot Auth proves which software sent a request. Neither proves a human authorized it.",
  "lede": "Agent traffic arrives at your server carrying a name. The name is a string in a header, and strings are free. Web Bot Auth fixes half of this properly, and the half it does not fix is the half where the money is.",
  "date": "2026-09-10",
  "reading_time": "17 min read",
  "category": "Agents",
  "tags": [
    "agent spoofing",
    "Web Bot Auth",
    "RFC 9421",
    "Know Your Agent",
    "agent identity",
    "delegation",
    "agentic commerce"
  ],
  "image": "https://cdn.twc.sh/images/igcache/Rogue%20Agent%20Impersonation/1200_630/blog.jpg",
  "url": "/blog/rogue-agent-impersonation.html",
  "wordcount": 4300,
  "related": [
    "web-bot-auth-vs-human",
    "authority-graph",
    "delegation-chain-depth"
  ],
  "schema": "Article"
}