Unauthorized Automated Agent Use: What to Do

If an automated agent is using your account without permission, your first steps are to revoke its access, change your password, and enable two-factor authentication (2FA) to lock out the agent immediately. Then, review your account’s active sessions and connected apps to identify and remove the unauthorized entry. This guide covers the full response sequence, how to spot such agents, and how to prevent future incidents.

What Counts as an Automated Agent?

An automated agent is any script, bot, or third-party service that acts on your behalf using your credentials or API tokens. Common examples include:

• Social media bots that post or like content automatically
• Shopping bots that place orders or monitor prices
• Email clients that sync via IMAP or OAuth
• Cloud automation tools (e.g., cron jobs, CI/CD pipelines) that access your cloud console
• Browser extensions that read your data or perform actions

Not all agents are malicious—many are legitimate tools you installed. The problem arises when an agent you did not authorize, or one that has been compromised, operates under your identity.

Immediate Response: Lock It Down

Time matters. The longer an unauthorized agent runs, the more damage it can do. Follow these steps in order:

1. Change your password for the affected account. Use a long, unique password (at least 16 characters) that you have not used elsewhere.
2. Enable two-factor authentication (2FA) if it is not already on. Use an authenticator app or hardware key rather than SMS, which is more vulnerable to SIM-swapping.
3. Revoke all active sessions. Most services have a “Sign out of all devices� or “Log out everywhere� option in security settings. This kills any agent that is using your session cookie.
4. Check connected apps and authorized tokens. Go to the security or privacy section of the account and revoke access for anything you do not recognize or no longer use.
5. Review recent activity. Look at login history, API usage logs, and any notifications of unusual actions. Note IP addresses, timestamps, and device types.

After these steps, the agent should lose access immediately. If it persists, it may be using a stored refresh token that you have not revoked—check the “authorized applications� list again after 24 hours.

How to Spot an Unauthorized Agent

Sometimes you do not know an agent is active until something odd happens. Signs to watch for:

• Unexpected posts, messages, or purchases from your account
• Login alerts from unfamiliar locations or devices
• Your account settings change without your input (e.g., new email, phone number, or forwarding address)
• High bandwidth or API usage in your cloud provider’s billing dashboard
• Friends or contacts receive spam from your account

If you see any of these, treat it as a potential breach and follow the immediate response steps above.

Understanding How Agents Authenticate

Agents typically gain access in one of three ways:

• Password and username: The agent logs in as you, often using credentials obtained from a data breach or phishing.
• API tokens or OAuth grants: You (or an attacker) authorized a third-party app to act on your behalf. This is common with “Sign in with Googleâ€� or “Connect your accountâ€� buttons.
• Session cookies: An attacker steals your session cookie (e.g., via malware or an insecure network) and replays it to impersonate you.

Each method requires a different cleanup. Password changes stop method 1. Revoking OAuth grants stops method 2. Logging out everywhere invalidates session cookies, stopping method 3. For thoroughness, do all three.

Common Mistakes After a Breach

People often make these errors when responding:

• Only changing the password: If the agent uses an OAuth token, a password change does not revoke it. You must also revoke the specific app.
• Ignoring email forwarding: An attacker may set up email forwarding to read your password-reset emails. Check your email settings for forwarding rules and delete any you did not create.
• Not checking recovery options: An attacker may add their own recovery email or phone number. Remove any that are not yours.
• Reusing the old password elsewhere: If you used the same password on other sites, change those too. Use a password manager to generate unique ones.

Preventing Future Unauthorized Agents

Once you have secured the account, take these steps to reduce the chance of recurrence:

• Use a password manager to create and store unique passwords for every account.
• Enable 2FA everywhere it is offered, especially on email, banking, and cloud accounts.
• Review connected apps quarterly. Remove anything you do not actively use.
• Monitor your accounts with free services like Google’s Security Checkup or your provider’s activity log.
• Keep software updated to patch vulnerabilities that could allow session theft.

What If the Agent Has Already Caused Damage?

If the agent made purchases, sent messages, or deleted data, address those separately:

• For financial transactions, contact your bank or credit card company immediately to dispute unauthorized charges.
• For social media or email abuse, report the account as compromised to the platform’s support team. They can often restore deleted content.
• For cloud resources, check billing for unexpected usage and contact support to request credits or investigation.
• For data loss, restore from backups if you have them. If not, check if the service has a version history feature.

Frequently Asked Questions

How can I tell if an agent is using my account right now?

Check the account’s security or activity page for active sessions, recent logins, and authorized apps. Look for devices or locations you do not recognize. Some services also send email alerts for new logins—review those.

Will changing my password kick out all bots?

No. Password changes only stop agents that log in with your password. Agents using OAuth tokens or session cookies will remain active until you revoke those specific grants or log out all sessions.

What if I cannot log in because the agent changed my password?

Use the “Forgot password� or “Account recovery� flow. Most services send a reset link to your recovery email or phone. If the agent changed those too, contact the platform’s support with proof of identity (e.g., government ID, purchase history).

Should I delete the account and start over?

Only as a last resort. Deleting the account may lose data and does not guarantee the agent is gone—it may have copied your information. First try to secure the account as described. If the agent keeps returning despite all steps, consider deletion and inform your contacts.

Can an automated agent be a legitimate service I forgot about?

Yes. Many people authorize apps years ago and forget. Review the list of connected apps carefully. If you do not recognize a service, revoke it—you can always reauthorize later if needed.

How do I report the unauthorized agent to the platform?

Most platforms have a “Report compromised account� or “Security incident� form. Use it after you have secured the account. Provide details like the time of the incident, the agent’s IP address (if visible in logs), and what actions it took.

Related

• Four-Marketplace AI Listing Optimizer Architecture
• Claude for Startups Alternatives: Coding AI and Credits
• Fine-Tuning vs Prompting: A Practical Team Guide