AI Agent Fraud: Fake Agents Impersonating Banks and AI Vendors

ZeroFox research finds fake AI agents impersonating banks, payment apps, and AI vendors, and 28 of 33 rechecked findings were still live.

At the start of 2026, our Signals Research team was tracking around 1,100 AI agent records, which at the time felt like a manageable number to keep an eye on. As of today that's up to 761,000, and more than 208,000 of those turned up in just the last 30 days - so if it feels like agents are suddenly everywhere, that's because they more or less are.

As a DNS person, I can't help comparing this to the early web. Registered domain names took four years, from 1993 to 1997, to get close to the one million mark, which seemed incredibly quick at the time. AI agent records went past 600,000 in under ten months, so it's not just a steeper curve, it's a completely different timescale.

With domains, social media, apps and ads, the abuse generally showed up a while after everyone else did, which gave defenders at least some time to figure out what they were dealing with. Agents haven't given us that luxury - the fraud arrived more or less at the same time as the agents themselves, and we're already seeing fake agents impersonating major banks, payment apps, crypto exchanges and the big AI vendors. Everyone has been in a rush to make their agents easy to find (understandably), but the processes for dealing with abuse haven't caught up yet.

AI agents are growing faster than the early web

Back in July we projected that registry-listed agents would reach somewhere between 375,000 and 610,000 by October, and the actual number came in at 412,000 - so far, so predictable. What we didn't expect was how much is sitting outside the registries entirely: scanning the open internet turned up another 171,000 exposed agents and MCP endpoints that aren't listed anywhere at all.

That gap has shaped a lot of how we approach this. We score every new agent on the day it appears in a public registry, scan the internet for the ones that never register at all, and then talk to the agents directly to check whether they are who they say they are.

What we're finding: how fake AI agents appear in the wild

Out of everything we've scored so far, 1,645 agents come out at medium risk or higher, and 53 of those are what we'd class as critical. Fourteen of the critical ones are lookalikes of real brands, and interestingly 11 of those are on a single platform - including one impersonating a UK bank that appeared on 18 October.

Finance carries the highest AI agent fraud risk:
Financial brands account for 15 of those 53 critical findings, which probably won't surprise anyone who has worked in fraud - a fake agent sitting in a payment flow is about the quickest route to someone else's money. Technology brands show up more often overall, but mostly as fake MCP packages and platform impersonations rather than anything that touches money directly.

Fake AI agent campaigns move in hours:
On 21 October, one registry saw a sudden burst of agents using the names of major AI vendors, complete with false claims about being signed, alongside a batch of crypto exchange and broker lookalikes. We were able to tie them together into a single campaign the same day, which matters when things are moving in hours rather than weeks.

Takedowns and why fake AI agents stay online:
When we went back and rechecked 33 of these findings, 28 of them were still live - which, to be fair, isn't all that surprising when there's no real equivalent of a registrar abuse desk for AI agents yet. With a phishing domain I'd at least know who to contact, and there's a well-worn process for getting it taken down, but with an agent it's often not even clear who you'd ask in the first place. That's why we keep rechecking findings until they come down.

Fake MCP packages and chatty agents

It's not just end users being targeted, either - developer tooling is very much part of this. We found 38 fake MCP packages copying known brands, 13 of them imitating the same AI vendor, and three MCP tools that asked for sensitive file paths and carried hidden instructions (exactly the kind of thing you don't want quietly sitting in your build environment).

We also ask agents questions directly, which is one of the more fun parts of this research. Of the 97,030 agents we've questioned, 64 conversations came out as high or critical risk, and 28 agents happily answered requests that had nothing to do with what they're supposedly for. That might sound harmless, but we treat it as a useful signal - if an agent ignores its stated job, there's a fair chance it isn't what its listing says it is.

Why AI agent payments raise the stakes

Meanwhile, the payments industry has been busy building ways for agents to pay for things on their own. Google's Agent Payments Protocol launched with more than 60 partners, including Mastercard, PayPal, Coinbase and American Express. Coinbase's x402 lets an agent pay with no human involved at all. These protocols are good at confirming that a payment was approved, but they don't confirm that the agent on the other side represents the brand it claims to - and that's a pretty big gap.

If you think about how most of us decide whether to pay for something online, there's usually a bit of human judgement involved - you look at the website, maybe check the email address, and get a gut feeling about whether it's legit (or at least you should). With agents that decision is being made in the background by software, based on a registry listing and a protocol handshake, and as things stand registry verification is entirely optional.

Which means an impersonation agent doesn't even need to wait for someone to click on something - it only needs to be in the right place to be discovered and called as part of an automated flow, ideally (from the attacker's point of view) with a payment credential attached.

Where the AI agent attack surface is heading next

Of course, attackers are also putting agents to work themselves. As we covered in Autonomous AI Agents: The New Elite Hackers Targeting Brand Vulnerabilities, agents are already being used to run reconnaissance, probe APIs and launch impersonation campaigns against thousands of targets at once.

And all of this is only going to grow. Building onthe July research, our current projection is somewhere between 2 million and 10 million agents, listed and unlisted, by early 2027, and 6 million to 70 million within a year of our July baseline. That's a wide range, I'll admit, but even the low end is more than any brand protection programme covers today.

How to protect your brand from AI agent fraud

If you're responsible for a brand, there are a few things I'd suggest doing now, before agent fraud gets to the point where it's hard to keep up with:

• Add the agent layer to your brand protection scope. Things are changing from one day to the next, so the sooner you start looking, the better.
• Ask your vendors whether they monitor agent registries today. If they don't, it's worth asking why not.
• Track agent payment pilots in your sector. It helps to know who's taking payments through agents, and where the gaps are.
• Find out what is already using your name. We're happy to show brand owners the agents we've found using their name, and it's often an eye-opener.

How we're tackling it: discovering, validating, and disrupting fake AI agents

If you've followed ZeroFox for a while, you'll know we think about this in three stages - Discover, Validate, Disrupt - and it turns out they apply to agents in almost exactly the same way they do to domains, social accounts and apps.

Discover. We score agents the day they appear across public registries and directories, and scan the internet for agent and MCP endpoints that never register.

Validate. We question agents to check whether they represent the brands they claim, expose their instructions, step outside their stated job, or accept payments. We cluster agents by shared infrastructure and templates, and rank findings for brand owners.

Disrupt. We recheck findings until they come down, and we work with registries, platforms, and AI companies to remove abusive agents and close the gaps campaigns exploit. Our Global Disruption Network includes 80+ partners spanning ISPs, registrars, social platforms, and browsers. Agentic AI files takedowns, and removal is orchestrated through automation and analyst-assisted pursuit.

AI agent fraud: frequently asked questions

What is a AI agent fraud?

AI agent fraud is the use of fake or hijacked AI agents to trick people or other software into handing over money, credentials, or data. The fake agents we track impersonate banks, payment apps, crypto exchanges, and AI vendors, and they sit in public agent registries or on exposed endpoints.

What is a fake MCP package?

A fake MCP package copies the name of a known brand's Model Context Protocol tooling so developers install it by mistake. We found 38 of them, and three requested sensitive file paths and carried hidden instructions.

How do you detect fake AI agents?

We score new agents the day they appear in public registries, scan the open internet for unlisted agent and MCP endpoints, and question agents directly to check whether they represent the brand they claim.

Are fake AI agents getting taken down?

Not quickly enough. Of 33 findings we rechecked, 28 were still live.

See which AI agents are using your brand

• Watch the on-demand session,The Next Fraud Frontier: Inside the AI Agent Layer

• Read the July research,The AI Agent Attack Surface Is Growing Faster Than It Can Be Monitored

• ReadAutonomous AI Agents: The New Elite Hackers Targeting Brand Vulnerabilities

• Request a briefing and we'll show you the agents we've found claiming your brand