AI Agents Reshaping Ad Targeting: Non-Human Traffic Gains Legitimacy

Full analysis

Your draft

Mark Zagorski, the CEO of DoubleVerify, wrote an op-ed arguing that autonomous AI shopping agents are a new "audience": high-intent, non-human buyers that advertising has to learn to reach and measure. The hook is a Cloudflare stat: bot and agent traffic passed human web traffic last month. For anyone building or buying AI ad infrastructure, the real question is whether the open web ad stack gets reformed to serve agents, or routed around entirely.

Reversibility: Type 2 for now. Nobody has to bet the roadmap this quarter. But the standards choices being teed up (agent identity, authentication, measurement definitions) are Type 1 once they harden. Pick the wrong verification primitive and you're stuck with it.

What's actually being decided: Not "should we measure agents." It's "does spend flow through publishers and the ad stack at all when a machine does the buying, or does it concentrate at the agent platform layer." That's a monetization-topology question dressed as a measurement question.

Forcing function: Vague. The Cloudflare number is the only hard trigger, and it's a single-vendor read that mashes crawlers, scrapers, and genuine buyers into one scary figure.

The Skeptic. This is a verification vendor announcing that the world needs more verification. DoubleVerify's revenue grows every time a new measurement category gets declared mandatory, and Zagorski just declared one. Read the incentive before the argument. The Cloudflare figure conflates LLM training fetches and indexing crawlers with consumers who have a wallet. The whole thesis rests on agents actually shopping the ad-supported open web. They won't. They'll hit structured product feeds and APIs, where there are no ads to verify. For the PM: a company that sells ad-checking says ads now need a new kind of checking. Maybe. But notice who profits from you believing it.

The Safety Lens. Zagorski treats trust as a ranking signal and waves at fraud in a footnote. That footnote is the whole game. The moment brand credibility, reviews, and sentiment become inputs a purchase agent ranks on, you've created a machine-speed incentive to poison reviews, fake authentication tokens, and manufacture trustworthy-looking brand profiles. A bad actor no longer fakes a human click. They fake a brand an agent trusts. Existing IVT and brand-safety tooling was built for human attention; it has no adversarial model for agent-to-agent deception, and no regulation touches it. For the PM: if a robot decides what to buy by reading reviews, the cheapest attack is to write the reviews the robot reads.

The Researcher. "Bot traffic exceeds human traffic" is a headline, not a finding. Traffic bundles four different things: crawlers, scrapers, training fetches, and genuine buyers. Only the last one matters for this thesis. The unanswered question is what fraction of agent traffic carries downstream purchase authority. Nobody has that number. And attribution is genuinely unsolved here: did the agent "see" an ad, or did it pull a structured feed that never touched the ad stack? That's not a viewability problem with a new coat of paint. It's a different causal question, and current attribution models can't answer it. For the PM: one dramatic number is crowding out the harder question of how many of those bots are actually shopping.

The Compute Pragmatist. Follow the inference bill. Every agent product query is a paid call on hosted inference: Operator, Perplexity, Gemini. When each query costs money, operators aggressively cache, compress, and pre-filter. That means agents pull structured schemas and MCP-style tool endpoints, not rendered ad-supported HTML, because rendering your page and parsing your display ads is the expensive, wasteful path. More agent spend does not mean more impressions. It means fewer, with the value concentrating at the platform doing the inference. For the PM: the robot doesn't load your webpage and see your banner. It grabs a clean data feed and skips the ads entirely.

The Enterprise Buyer. Put yourself in the seat of a CMO being sold an "agent audience" measurement product. What am I actually signing? There's no agent-identity standard, self-declaration is unaudited, and User-Agent strings spoof trivially. I can't buy indemnification against a category nobody can define yet. What I would pay for, today, is the opposite service: don't let my fraud filters torch legitimate high-velocity agents and tank my monetization. The near-term enterprise product is "stop misclassifying them," not "reach agents." For the PM: buyers won't sign a contract to reach an audience the vendor can't yet prove exists.

The tensions.

Zagorski versus the Compute Pragmatist is the whole fight. Zagorski assumes agents will browse: arrive at pages, evaluate, and be measurable like a fast human. Inference economics say they'll query: hit feeds and APIs and route around the page entirely. If the Pragmatist is right, DoubleVerify isn't building measurement for a new audience; there's no ad-supported surface left to measure.

The Skeptic and the Safety Lens agree the market is early but split on what to watch. The Skeptic says agent shopping is too small to matter yet. The Safety Lens says small doesn't mean safe. The attack surface (poisoned trust signals) is live the instant any agent ranks on credibility, regardless of volume.

And the Builder's warning from the earlier window sits underneath all of it: before any "reach agents" product ships, the fraud team's existing classifiers will start flagging real agents as bots. The first real-world event here isn't a shiny new audience. It's a false-positive fire drill at premium publishers.

What it hinges on: One fact settles most of this. Do consumer purchase agents transact by rendering ad-supported web pages, or by querying structured feeds and APIs? Everything Zagorski proposes assumes the former. The compute economics point hard at the latter. That's testable now. Instrument your own inventory and watch how Operator, Perplexity, and Gemini agents actually fetch. If they're pulling schema.org and product feeds and skipping your ad calls, the "new audience" is real but unreachable through the ad stack, and the money moves to the platform layer.

What to de-risk before committing: Don't build to an agent-identity standard that doesn't exist. Do instrument agent fetch behavior on your own properties and tune fraud classifiers so legitimate agents don't get nuked as IVT. That's the concrete, defensible move with payoff regardless of how the standards war shakes out.

Prediction: No industry-wide agent-identity or authentication standard that DoubleVerify or peers can build a verification product against will be adopted by the major agent platforms (OpenAI, Google, Perplexity) before AdExchanger's next annual programmatic outlook in January 2027. Agents will keep transacting via structured feeds and APIs, not verified ad-supported page views.

Confidence: Medium. Inference economics push agents to feeds, not rendered ad pages.

Why: Every agent query costs money, so operators cache and pull structured data rather than render ad-supported HTML. That means there's no shared incentive to build the cross-platform identity handshake Zagorski calls for, and no ad surface on the query path to verify. Standards like this need the platforms to cooperate against their own cost and competitive interests, and OpenAI, Google, and Perplexity have shown no move toward a common agent-auth scheme. The opposite outcome, a fast and adopted standard, would require rival platforms to align on identity plumbing in under six months, which nobody is currently building. The near-term reality is fraud-classifier false positives on real agents, not a working measurement category.

Revisit by 2027-01-31: We're right if no major agent platform has shipped an adopted, cross-vendor agent authentication standard usable by verification vendors, and agent commerce still runs mostly through feeds/APIs. We're wrong if two or more of OpenAI, Google, and Perplexity adopt a common agent-identity standard that DV or a peer ships a measurement product against.