Darwinium starts judging AI agents by their path to payment and the tools they call

Take a customer who tells an agent to pay a bill. The agent logs in and pays it, and somewhere between those two steps it changes the email address on the account. A rule that checks one step at a time sees nothing wrong. Darwinium's case is that a step which looks ordinary on its own can look suspicious once the whole path is in view ^[14]. An authorized agent "can start out doing exactly what a customer asked, then take an unexpected turn," said Michael Rodriguez, Darwinium's chief operating officer ^[8]. He said the same holds for authenticated human customers, who can still be coached into sending money to a scammer ^[13].

A lot of bot rules assume that a well-behaved agent will announce itself, so anything that stays quiet can be blocked. On Darwinium's network, most agents stay quiet ^[16]. The company's Agent Intent Detection, launched in March, already exists to spot agents that do not announce themselves ^[9]. One customer goes further. Apollo.io's senior manager for fraud prevention and application security, Jon Ferrari, said "user-agent declarations and even statements of intent are becoming moot" ^[10]. His team has to check whether behavior matches stated intent over time, he said, including in aggregate, where many requests add up to an outcome no single request disclosed ^[11].

Under the label "intent intelligence" ^[1], the product does two things. It scores the order and timing of steps, and it holds the risky one ^[4][5]. The score's baseline is the customer's typical behavior, so a customer with little history gives it less to compare against. The business's own traffic and the type of journey also go into the score ^[4].

Darwinium, a venture-backed startup that announced an $18 million round in October 2023 ^[15], supplies every figure behind the launch. The one-in-four and nine-times ratios describe its own network ^[2][3], and it ran the survey itself ^[7]. The report does not say how many rejected agent purchases were fraud, or how many payments held for a second check turned out to be legitimate. The company says businesses need to recognize legitimate agent activity without giving risky actions a free pass ^[12]. Those two numbers would show whether its tools do that.

For the person rolling this out, I'd sort agent traffic on two axes: whether the agent declared itself, and whether the step moves money or changes the account. A declared agent on a low-risk step can pass. When it reaches a payment or an account change, it gets the hold for extra checks that MCP Protection is built to apply ^[5]. An undeclared agent on a low-risk step is where path scoring belongs, because blocking it turns away activity that has not yet done anything risky. The fourth box, undeclared and high-risk, is the one blanket blocking already covers. I'd pilot the tool there first and compare it with the current rule on one count: rejected orders that came from real customers. The tradeoff is friction, since every hold on a payment also slows the declared agents a merchant wants to keep. A team that cannot say how many of last month's rejected agent purchases came from real customers has nothing to judge any vendor against.