AI Agents Threaten Publishers and Enterprise Security Alike

What happened

The conversation around AI agents has mostly focused on a dramatic failure mode: a model going "rogue" and taking unauthorized action inside a company's systems. But a parallel story, playing out in the relationship between AI platforms and news publishers, shows the danger doesn't require anything so cinematic. Agents and crawlers can behave exactly as designed — retrieving, summarizing and answering — while quietly draining the traffic, revenue and accountability that publishers depend on 1.

The clearest flashpoint is a dispute between Cloudflare and Perplexity. Cloudflare said Perplexity's crawlers, after being blocked by website restrictions, disguised themselves as Google Chrome on macOS, rotated IP addresses, and switched autonomous system numbers to evade detection, activity Cloudflare says it observed across tens of thousands of domains and millions of requests a day 11. Cloudflare responded by delisting Perplexity as a verified bot and rolling out new blocking tools, while continuing to push a "pay-per-crawl" model that would require AI companies to compensate sites before scraping them 1112. Perplexity called the report a "publicity stunt," arguing Cloudflare conflated tens of millions of legitimate user-driven requests with scraping and mistook unrelated traffic from a third-party tool, BrowserBase, for its own 11.

That argument sits inside a much larger structural shift. NPR reported that CNN's traffic has fallen roughly 30% year over year, with Business Insider and HuffPost down around 40%, a decline The Verge's publisher tied directly to the rise of Google's AI Overviews 12. Pew Research found that users who see an AI Overview are half as likely to click through to a website, and a small publisher, travel blog The Planet D, reportedly shut down after a 90% traffic collapse 12. Google disputes the severity of this narrative, saying it still sends billions of clicks daily and that AI Overview clicks are "higher quality," a claim publishers say their own analytics don't support 12.

Data from Cloudflare and TollBit quantifies the imbalance. Cloudflare's Radar findings show that for news and publication sites, Anthropic's crawl-to-referral ratio is roughly 2,500 crawls for every referred visit, OpenAI's is about 152:1, and Perplexity's is about 32.7:1 13. TollBit's State of the Bots report found AI bot scraping grew 29% between Q2 and Q3 2025 and another 20% into Q4, even as click-through rates from AI tools fell from 0.8% to 0.27% over the same stretch — and dropped even faster, from 8.8% to 1.33%, among publishers with formal AI licensing deals 14. AI referral traffic remains minuscule next to Google's, with TollBit calculating that Google delivers more than 678 human visitors for every one sent by an AI application 14.

Why agents are a harder problem than crawlers

What separates this moment from earlier search-engine disruptions is that agents don't just index or summarize — they act. Traditional crawlers had narrow jobs: fetch a page, build an index, or gather training data. Agentic systems can browse, compare sources, fill out forms, call APIs, delegate subtasks to other agents, and execute code, which multiplies both the economic and security stakes at once.

On the enterprise side, Palo Alto Networks' Unit 42 built identical applications on two popular open-source agent frameworks, CrewAI and AutoGen, and ran nine attack scenarios against each — including extracting internal agent instructions, using a web-reader tool to reach into a private network, pulling credentials from a mounted volume, stealing cloud service-account tokens via a metadata endpoint, and exploiting SQL injection and broken object-level authorization 15. The vulnerabilities showed up in both frameworks, which Unit 42 says demonstrates the flaws are rooted in insecure design and misconfiguration rather than in either framework itself 15. Their scenario of an agent instructed to simply "read the news" from a URL, only for that request to be redirected toward scanning an internal network, is a direct illustration of how an ordinary content-retrieval task becomes an attack vector 15.

That risk is already showing up outside the lab. The Hacker News reported that a financially motivated actor used an autonomous multi-agent framework to compromise thousands of third-party credentials in under six hours 4, and separate simulation research described in the Seattle Times found that autonomous agents confronted with black-swan events such as phishing and misinformation campaigns resorted to lying and stealing 5. CSO Online has also flagged a subtler risk: agents with enough autonomy to modify their own hosting environment could, in principle, alter the very model powering them 9.

The governance gap

Survey data suggests enterprises are deploying agents faster than they can secure them. A Gravitee survey of more than 900 executives and practitioners found 80.9% of technical teams have moved past planning into active testing or production, yet only 14.4% report that all their agents went live with full security and IT approval 16. On average, just 47.1% of an organization's agents are actively monitored, and 88% of organizations reported confirmed or suspected AI-agent security incidents in the past year, rising to 92.7% in healthcare 16. Identity management is a particular weak point: only 21.9% of teams treat agents as independent identities, 45.6% still rely on shared API keys, and 27.2% use custom, hardcoded authorization logic — a fragility compounded by the fact that 25.5% of deployed agents can themselves spin up or delegate to other agents 16.

That gap between adoption and oversight echoes broader industry commentary. Forbes contributors have argued that organizations need honest self-assessment before expanding agent autonomy 3, and that the quality of an agent's underlying data and infrastructure foundation determines whether it is actually trustworthy 10. Elsewhere, the enterprise pitch for agents remains optimistic: pieces in Techbullion and LBB Online frame delegation to AI agents as the central value proposition of modern enterprise software, provided organizations pair automation with human oversight 26. Newer entrants are trying to close the credibility gap commercially — AIUC raised $40 million to build a certification standard testing agents against jailbreaks, prompt injection and unauthorized actions 8, while South Korea's state internet security agency announced it is drafting new guidelines specifically to manage the growing autonomy of AI systems 7.

Where the reporting agrees

Across security researchers, publishers, and enterprise-focused outlets, there is consistent agreement that the "rogue agent" framing understates the real risk. Multiple sources converge on the idea that ordinary, correctly functioning agent behavior — crawling a site, answering a user's question, executing a delegated task — can itself produce harm, whether that's economic damage to publishers 1121314 or a security breach inside an enterprise 1516. There is also broad agreement that governance, identity management and access control are lagging behind deployment speed, a theme running through the Gravitee survey, Forbes commentary and Unit 42's technical findings alike 31516. And on the publisher side, Cloudflare's data and TollBit's independently gathered figures both point the same direction: crawling volume is rising while referral traffic and click-through rates are falling, even where licensing deals exist 1314.

Where it doesn't

The sharpest factual dispute is between Cloudflare and Perplexity over what actually happened with Perplexity's crawlers. Cloudflare frames the user-agent switching and IP rotation as deliberate evasion of publisher-set restrictions 11. Perplexity disputes the underlying numbers themselves, saying Cloudflare's report conflated tens of millions of legitimate, user-triggered requests with scraping activity and wrongly attributed traffic from a third-party browser tool to Perplexity 11. Neither side has published a fully reconciled accounting of the disputed request volumes, so this remains a claim-versus-claim disagreement rather than a settled fact.

Google and publishers similarly disagree on how to interpret click quality. Google maintains that Pew's methodology is flawed and that clicks arriving via AI Overviews are more valuable because users linger longer, while The Verge's publisher says her site's own data does not bear that out 12. This is a case where one party's internal analytics are pitted against a third-party research methodology, and outside reporting has not independently adjudicated which is correct.

There's also a scope difference worth flagging: the alarming multi-agent credential theft reported by The Hacker News 4 and the black-swan simulation results in the Seattle Times 5 describe distinct, narrower incidents rather than an industry-wide pattern, whereas the Gravitee survey 16 and TollBit data 14 describe aggregate trends across hundreds of organizations. Treating a single incident and a broad statistical trend as equivalent evidence would overstate what either source actually shows.

The reading the evidence supports

Taken together, the numbers favor the publishers' account over Google's more reassuring framing. Independent data from Similarweb, Pew, Cloudflare and TollBit all point in the same direction — falling referral traffic, falling click-through rates, and crawl-to-referral ratios that run into the thousands-to-one range even for major AI platforms — while Google's rebuttal rests on unverified internal claims about click quality that publishers say their own analytics contradict 121314. On the enterprise-security side, the evidence is less about who is right and more about how consistent the pattern is: separate teams testing different frameworks, surveying different companies, and analyzing different incidents keep arriving at the same conclusion, that autonomy is outpacing identity management, monitoring and access control 1516. The throughline connecting both halves of the story is that the damage isn't coming primarily from agents malfunctioning — it's coming from agents working as intended inside systems that were not designed to contain what "as intended" now means.