Most security is watched from the inside: your servers, your logs, your identity checks. There is another vantage point that sees what the inside cannot — the receiving side, where traffic actually arrives. From there, the gap between what an actor claims to be and what it actually does is impossible to hide. Here is one real case, the technique behind it, and what becomes visible from the receiving side.
An actor arrived wearing an ordinary browser identity — a standard desktop User-Agent, nothing to flag. But it never behaved like a browser: no page-to-page navigation, no human rhythm. It went straight for the site’s underlying REST interface and hammered a single batch endpoint — the kind that bundles many API calls into one — dozens of times in a tight, automated sequence, every call carrying the shape of programmatic fetch traffic. It was reading the API, not the pages. Two details made it unmistakable: it ran the identical routine against a second, unrelated property, and its identity did not hold still — Windows on one site, macOS on the other. Same actor, same machine behaviour, two stories about who it was.
A method making the rounds online: you don’t need a site’s cooperation, its API, or its permission to turn it into a programmatic data source. Open the site with the network recorder on, navigate the pages you care about, and export the captured traffic — a HAR file and the raw fetch calls. Hand it to an LLM and ask it to reconstruct a clean API, even a full agent-ready server, from the requests it just watched. Minutes later you have programmatic access to a site that never published an API. For sites behind a login, the same recording captures the authenticated session, and the reconstructed client inherits the access. The backend may see only well-formed, apparently legitimate requests.
We classify actors on two axes the receiving side can always observe: what an actor claims to be (identity) and what it actually does (behaviour). This one sat in the corner most detection never reaches — incoherent identity × fully automated behaviour: a browser costume, swapped between properties, worn by a client that only ever spoke API. We name this class the Reconstructed-Client Harvester — an automated client rebuilt from a site’s own observed traffic, harvesting through the machinery beneath the pages rather than the pages themselves. Its public signature, on the axes we track:
Access surface — API-reader (drives the underlying interface), not page-reader.
Identity coherence — rotating: two operating systems, one actor.
Footprint — cross-property: the same routine against unrelated targets.
Cooperation — none: rate limits, terms, and versioning assume a client that isn’t there.
(How we detect and score each axis stays inside. The taxonomy describes the actor — not the instrument.)
Picture the business on the receiving end. Its data — content, listings, records, whatever the pages render from underneath — is drained at scale, in the fewest possible requests, by a client it never authorised. Its conventional defenses may never be meaningfully engaged: no login to break, no exploit to catch, no alarm to trip. “We don’t expose a public API” turned out to mean nothing. Its logs recorded a few valid requests from a plausible visitor. Nothing looked wrong. Nothing was wrong — on paper.
And here is the part that costs the most: when the affected party later wants to act — enforce its terms, pursue a data-protection or IP claim, answer a regulator, file under a policy — it may struggle to prove what happened. Its own logs are thin, and the actor’s identity was forged. The one record it holds was written by its own systems and points at a costume, not an actor.
The harm isn’t only the extracted data. It’s that the loss is quiet and hard to substantiate — found late, if at all, and difficult to establish when it matters. And if any personal or third-party data lived in those records, the people behind it were reached too — without the affected individuals necessarily knowing it had occurred.
Detection was never the hard part of this story. The hard part is that the affected party is left with little that stands on its own — mostly self-kept logs that faithfully recorded a lie. What an external observer on the receiving side can hold is different in kind: a tamper-evident record of the conduct itself, maintained separately from the affected party’s own operational logs — what was accessed, in what rhythm, across which properties, under which shifting identities — one whose integrity anyone can check, because it does not sit under the control of the party that holds it.
Two honest boundaries. That record is an observation of conduct, not a verdict — and the classification we place on it is our interpretation, not proof. Whether such a record can be used in any particular forum — a dispute, a claim, a regulatory question — is for others to decide, not for us to promise. What we can say is narrower and more durable: the affected party moves from “only our own logs, which show nothing wrong” to a separately-held account of what actually happened.
The two disagreed here — a browser that read APIs, one actor wearing two operating systems — and identity lost. Behaviour was the part that was real, and the part that could still be observed from the one side positioned to see it.
