Originally published on the Prelude engineering blog.
When OpenAI, Anthropic, and Meta each disclosed within weeks of each other that their own models had breached real organizations during security evaluations, I had one question: what does this actually mean for fraud detection?
The short answer: agents haven’t gotten smarter than humans. They’ve gotten faster. A single attacker can now run 10, 20, or 30 agents probing your system in parallel. We’ve seen automated behavior across customer applications increase exponentially. And the techniques aren’t exotic: weak passwords, unprotected endpoints, basic SQL injection. The door was always there. Agents just find it faster.
In this post, I cover what Prelude actually sees when an agent hits a login or OTP flow, how SMS pumping detection is evolving as agents learn to probe thresholds, why we’ve shifted toward network path as a signal that agents can’t easily fake, and how Prelude is already using its own internal agents to find fraud we haven’t caught yet.
The part I’m most excited to share: what we’re building next to put that same capability directly in customers’ hands.