Personal AI agents already search fares and hold seats on behalf of customers, and they make seat spinning attacks harder to detect accurately. Legitimate personal agents generate traffic that is automated by design, so blocking automation isn’t a viable policy for an airline that wants those customers. Attackers, meanwhile, have access to AI frameworks that make their own automation adaptive, so the bots running spin campaigns behave less like scripts and more like legitimate agents. An airline that treats every automated session as hostile turns away customers, while one that lets every agent through also lets in the bots that pretend to be agents.
Agentic AI is becoming a booking channel
Personal agents such as Meta's Muse and OpenAI's Dots sign in with a customer's credentials and act on behalf of that customer, handling a wide range of everyday tasks. Adoption has moved quickly; within two weeks of Muse's launch, Cequence observed Muse traffic at more than half of the customers it studied. Muse does not identify itself as an agent, but presents as an ordinary Chrome browser, which makes it difficult for traditional bot detection to recognize it as an agent the airline may want to allow.
For an airline, agentic AI traffic is customer traffic. An agent that searches itineraries, holds the best option while it confirms with its user, and then pays is doing what a careful traveler does, though at machine speed. An agent compares more options in a minute than a person does in an hour, so timing signals that once marked a visitor as a bot no longer necessarily prove bad intent, and defenses tuned to human speed will flag these customers as threats.
AI-powered bots learn to look like agents
Attackers use open-source frameworks such as Scrapling, which its own documentation describes as being designed to bypass anti-bot systems. These frameworks give operators browser fingerprint spoofing that mimics real TLS fingerprints, headers, and device signals. They add autonomous CAPTCHA solving that outpaces real users. They also support self-healing automation that adapts when a page changes and rotates proxies and sessions without operator involvement.
AI-powered bots built this way defeat the device and browser checks that legacy defenses depend on, and they change behavior each time a rule blocks them. Defenses that rely on JavaScript tags and mobile SDKs can't see an AI agent that calls an API directly, so legitimate agents and malicious automation look the same to them.
Telling good intent from bad
Successful seat spinning defense now must judge what automated traffic intends, since automation alone no longer signals abuse. A legitimate agent holds a seat because its user is likely to buy it, and its holds convert to payments at rates that resemble human travelers. A spinner holds seats it doesn’t intend to buy, repeats the cycle across many sessions, and concentrates its activity on the routes where holds move prices. Those differences appear in behavior across the booking journey, not in the user agent string or device signals, which malicious bots routinely fake. The most reliable signals are outcomes over time, such as how often an entity's holds become purchases and where its activity is concentrated.
Identity verification is useful but not enough on its own, since knowing which agent platform a session comes from tells the airline who is acting, not whether the actions are acceptable. A verified agent can still be misconfigured or compromised, and an agent platform's traffic behaves like one managed fleet rather than thousands of independent browsers, so defenses need a separate baseline for AI booking agents.
How bot management handles AI booking agents
Cequence Bot Management evaluates every session, human or agent, with the same behavioral intent engine it uses against seat spinning, modeling how real travelers search, hold, and pay. Cequence’s Agent Trust adds a dedicated view of agentic traffic. It discovers agents in the airline's traffic, including agents that present themselves as ordinary browsers, and verifies agent identity against the issuers the airline chooses across the major agent protocols. Behavioral detection continues after verification, so if a verified agent starts holding seats it doesn’t pay for, Cequence treats it as a seat spinner.
Cequence enforces at the transaction level: it can block, rate-limit, or log the specific risky action while the agent keeps working for its customer. For sensitive actions, it can challenge with Biometric Check so the account holder confirms their humanity, securely, on their own device. Detection runs on the network, so it covers the booking APIs agents call directly, the same APIs the Cequence Platform protects with API security. That combination lets an airline accept AI booking agents as customers while blocking the bots that imitate them.
The seat spinning series
This post is part of a series on seat spinning:
- Airline Seat Spinning: An Illustration of Sophisticated Fraud
- Airline Inventory Fraud: The Economics of Seat Spinning
- Seat Spinning Bots: Anatomy of a Spin Campaign
- Seat Spinning Mitigation: Detection to Enforcement at Two Airlines
- AI Booking Agents: The Next Phase of Seat Spinning
