Last week, I wrote about a massive change coming to customer experience: the precipitous rise of consumers deploying personal AI agents to contact businesses on their behalf. Meta Muse alone has been downloaded over 6.5 million times since its launch last month, and in mid-September, traffic from personal agents contacting Cresta customers spiked over 80x.
From getting a better deal or monitoring prices, to linking a reservation to a loyalty account or just weathering a 40-minute hold time, these agents can take things off humans’ ‘to do’ list with limitless patience.
For CX leaders, the implications are far-ranging: more conversation volume, new security and authorization questions, and a pressing need to create a system of policies around what a personal AI agent can handle or not.
The first practical question, though, is far simpler:
How do you know when the caller is actually an AI agent?
Today, we’re introducing Cresta Sentry-0.1, a real-time model that detects personal AI agents in conversations, built directly into Cresta’s AI operating system for CX and grounded in our learnings across millions of conversations. It recognizes patterns in conversations that indicate a customer may be represented by an AI agent, which helps teams respond consistently and appropriately. The signals that Sentry identifies feed right back into the organization as insights to help evolve operations and provide an ever-improving customer experience.
The Problem Sentry-0.1 Solves
In my last post, I described the choice facing every business: block these agents and risk being bypassed as consumers comparison-shop through them, or accept their requests without controls and expose your operation to increased traffic, fraud, and complex disputes they’re not equipped to solve for.
I suggested an analyze, automate, and augment framework for preparing:
- Analyze: Get visibility into every conversation. Measure how much traffic comes from personal AI agents, what they are asking for, and where new patterns may be emerging.
- Automate: Apply a clear policy so that routine, authorized requests can be resolved or routed appropriately, while consequential actions receive additional verification.
- Augment: Give human agents real-time guidance on how exactly to handle personal AI agents, including what they can share, what actions are permitted for them to take, and when to confirm directly with the customer.
Implementing each part of the framework relies on being able to detect personal AI agents reliably, especially when they don’t identify themselves.
Without a reliable way to recognize these conversations, leaders cannot accurately measure and interpret this traffic, automated systems can’t consistently apply the right policy, and agents may end up handling the same request in very different ways across the organization.
Why Existing Detection Methods Aren’t Enough On Their Own
The industry is moving quickly on protocols for agent-to-agent (A2A) communication and verification, as well as ways to detect synthetic speech during live calls, all of which are useful parts of a longer-term solution. A verified protocol can tell a business who an agent represents and what it claims permission to do, and audio can help identify a generated voice.
Cresta supports the new protocols, but they will realistically take time to be widely adopted, and a personal agent that doesn’t want to identify itself might simply not adhere to them. Audio detection answers the narrower question of whether or not speech sounds synthetic, but doesn’t establish who authorized the request. Used alone, it could misclassify a human caller who relies on a speech-generating device because of a disability. Any response built on detection needs to account for uncertainty and protect that customer’s access to service.
A critical piece of the puzzle is missing: the behavioral signals within the interaction itself, which is precisely the problem that we’ve built Sentry to address.
How Sentry Works
Sentry is a proprietary ensemble model designed to recognize the conversational patterns of AI agents, based on Cresta’s in-depth understanding of human and AI agent behavior across CX verticals and use cases. The more that Sentry is exposed to examples over time, the better it gets.
In early usage across our customers, we’ve observed several patterns that may indicate a personal AI agent:
- Indirect third-person language: Referring to “the user” or “the account”, rather than “I” or “my account.” We observed this in 36% of AI conversations reviewed. Human callers acting for someone else may of course do this too, so it’s only one signal among several.
- Stated limits: Explaining a capability boundary, such as “I can’t click links”, “I’m not able to see the image you shared”, or “I don’t have access to the message center you sent that to.” This pattern appeared in 25% of conversations involving non-disclosing personal agents.
- Exact repetition: Restating a request later in the conversation with nearly identical wording. Repeats of more than ten words appeared in 50% of non-disclosing AI conversations, compared with 0% of human conversations in the same review.
- Request stacking: Combining many distinct questions into one single turn, might sound like: “Please confirm the exact product name, price, specifications, warranty period and whether return shipping is free.”
Other patterns may increase our confidence that the caller is in fact human:
- Hedging: Expressing uncertainty, such as “I think that’s the plan I have” or “I’m not sure when I bought it.” We saw this pattern in 76% of human conversations, compared with 0% of AI conversations in the same review.
- Unprompted repetition: Repeating or rephrasing a thought while working through it aloud: “I don’t want that service...I just don’t want it anymore.” This appeared in 82% of human conversations, compared with 0% of AI conversations.
- Self-correction within a turn: Revising a detail mid-sentence: “I ordered it on Tuesday–sorry, I mean Wednesday.”
Of course, none of these behaviors, human or AI, is conclusive by itself. Sentry looks at the conversation in its holistic context, rather than applying one single phrase as a definitive label. In our preliminary evals, Sentry has achieved an F1 score of roughly 0.9, meaning it reliably catches personal agents without over-flagging human callers.
A likely AI caller still needs to show that it represents the customer and has the necessary permissions for its specific request. Similarly, a caller that Sentry does not flag should still not be allowed to bypass the checks required for a consequential action.
What to Do With What You Know
Sentry is built directly into Cresta, so that detection can lead to action in the same AI operating system.
When a human representative is speaking with what is likely a personal AI agent, Cresta can surface real-time guidance: whether the agent disclosed itself, which requests it is allowed to complete, and which actions require the customer to confirm directly via SMS or in-app. This allows the representative to follow policy without having to improvise a rule in the middle of a conversation.
When the business’ Cresta AI Agent takes the call, an early detection signal can triage the interaction based on the business logic of how to handle personal agents for different topics. The AI Agent might answer an allowed information request, while an account change or payment requires additional verification or customer approval.
From there, leaders can use Cresta Insights and AI Analyst to see why personal agents are calling, which intents are growing, how representatives respond, and how the conversations tend to end, and where abuse patterns are forming, such as bursts of identical requests or scripted probing of policy exceptions. Detection automatically becomes a feedback loop to improve service, not just monitor it.
One of the first tasks consumers hand to their agents is negotiating a lower rate, often by calling a subscription-based business and threatening to cancel in order to get a discount.
Historically, when customers make that call themselves, a cancellation request was a credible signal of intent: the customer had to call up, wait on the phone, and repeatedly affirm that they wanted to cancel. When a personal agent makes the call on their behalf, however, it costs the customer nothing, so customers with no intention of leaving can make the same request speculatively.
Because Sentry tags these conversations, Insights can show the pattern as it develops: cancellation volume from personal agents rising, first retention offers accepted at a far higher rate than in human-initiated conversations, and retention discount spend climbing while actual churn stays flat.
Knowing this, businesses can aim to limit speculative cancellation calls by implementing a simple policy that personal agents are unable to see retention offers. This means that both human and AI agents would explain, "We don’t make retention or discount offers through AI assistants. If [customer name] would like to talk about their pricing, they can contact us directly, and we’ll go through the options with them. I’m still happy to help with anything else on the account today."
Policy developments like this can add back just enough friction to discourage these tactics, without making it hard for customers who genuinely want to cancel.
Detection Is Only the Beginning
Personal agents will continue to evolve and the sophistication of a company’s detection must evolve alongside them. Verifiable agent-to-agent approaches may well become part of the solution, but businesses also need to recognize traffic reaching their teams today. No single signal should determine whether a customer receives service or whether a sensitive action is approved.
Sentry, available to Cresta customers today, gives CX teams a way to see personal agents in their conversations, guide the people and AI Agents handling them, and learn where the customer experience or business operations need to change.
Last week, I laid out why businesses need to prepare. Today, we’re giving them a practical place to start.
Learn more: see how Sentry works by booking a demo now.
