Nishith Lakhnotra
Security Researcher and Engineer
Cequence Security
About
Nishith Lakhnotra is a security researcher and engineer at Cequence Security, building detection systems that protect more than 300 million users at major telecom, finance and healthcare companies from account takeover, credential stuffing, scraping and API fraud. Nishith leads machine learning detection work at Cequence, most recently focused on securing AI agents.
Sessions
Tokens Are the New Gift Cards: Residential Proxies, AI Agents and the Underground Market for AI Access
What you will learn:
Imagine someone who could answer any question you asked, and all they wanted in return was a token. Now imagine someone copying your tokens and selling them for two cents on the dollar. That's happening to AI inference right now: in one incident, stolen AI keys ran up nearly $1 million in charges before anyone caught it. The thieves reach you through the same home internet connections as your customers and as the AI shopping agents you want to let in. So how do you tell an agent from a thief? Volume won't tell you: attackers spread themselves thin across millions of home IPs, and legitimate agents generate traffic by the million. What gives automation away is the gap between what it claims to be and how it behaves. In our data, attack traffic claiming to be ordinary consumers drew on the wrong mix of ISPs, and Meta's shopping agent looked like Chrome but didn't update like it. Fingerprinting finds those gaps. Intent decides what to do about them: failed logins, or spending the moment an account exists. The agents worth welcoming will increasingly prove who they are instead of hiding.