What Happens When an AI Agent Fills In Your Website Form?

What happens when an AI agent fills in your contact form?

Usually the same thing that happens when a person does, which is the problem. Your form does not know the difference. It records a submission, fires your automation, notifies your sales team, and counts as a conversion, whether a buyer typed it or an agent completed it on their behalf while they were doing something else.

This is no longer hypothetical. Browser-based agents that can read a page and act on it are shipping inside mainstream tools, and at least one vendor now documents in public exactly how its agent is meant to behave on your site.

So the question for anyone running a B2B website is not whether to allow agents. It is what your form should do when it cannot tell who is on the other end.

Are agents actually allowed to submit forms on your site?

It depends on the agent, and the serious ones have rules. Anthropic's Claude in Chrome uses site-level permissions that a user can grant or revoke for specific websites at any time in the settings, and Claude asks the user for approval before publishing, purchasing, or sharing personal data.

That last clause is the one that matters for a contact form. Sharing personal data is exactly what filling in a name, email and company field is, so a well-behaved agent should be pausing and asking its user before it submits. There is also a blocklist. Anthropic says Claude is blocked from using websites from certain high-risk categories such as financial services, adult content, and pirated content.

Anthropic also says that even in an experimental autonomous mode, Claude maintains certain safeguards for highly sensitive actions. Read that carefully and you get the shape of the current answer. Agents can act on your site, they are supposed to check in on the consequential parts, and the checking-in is a design decision made by the vendor rather than a law of nature.

How often do these agents get manipulated?

Often enough that vendors publish the numbers. Anthropic red-teamed Claude in Chrome across 123 test cases representing 29 different attack scenarios. In autonomous mode without mitigations, it reports a 23.6 percent attack success rate. With safety mitigations from improved system prompts and classifiers, that figure drops to 11.2 percent.

On a narrower challenge set of four browser-specific attack types, Anthropic reports that its new mitigations reduced the attack success rate from 35.7 percent to zero. That is a genuinely strong result on that specific set, and it is worth reading as exactly what it says, which is a measured result on a defined challenge set rather than a promise about every attack that exists.

I find these numbers clarifying rather than alarming. A vendor publishing a residual failure rate is telling you that prompt injection through web pages is a live category of attack, not a solved one. If your site takes input from agents, you are part of that surface, and your form is one of the places where a manipulated agent produces a visible consequence.

Can you tell agent traffic apart from a human?

Increasingly yes, and not through user agent strings. Cloudflare documents Web Bot Auth, which it describes as an authentication method that leverages cryptographic signatures in HTTP messages to verify that a request comes from an automated bot. Identity is proven with a key rather than claimed in a header that anyone can copy.

The mechanics are specific. Cloudflare's documentation names Ed25519 as the supported key algorithm, has bots generate a private key and register the public key in JSON Web Key format, and describes requests carrying Signature, Signature-Input and Signature-Agent headers. It rests on two IETF drafts, one covering how bots share public keys through a directory and one defining how those keys authenticate HTTP requests.

This is the part of the story most marketers have not caught up with. The industry is building a way for an agent to say who it is in a manner you can actually check. That changes the question from can I detect this to what do I want to do about it, which is a much better question to be asking.

Should you block agents from your forms?

Almost certainly not. An agent filling a form is usually a real buyer delegating a boring task, and blocking it means blocking them. The exception is unsigned, unidentified automation hitting your form at volume, which is an abuse problem you already had and should handle as one.

The instinct to block comes from thinking of agents as scrapers. That mental model is out of date. An agent operating inside a person's browser, on a site that person granted access to, is closer to an assistant than a crawler. Turning it away is the digital equivalent of refusing to speak to someone's secretary.

Where I would draw a line is on anything irreversible or expensive. A demo request from an agent is fine. An automated purchase, a support ticket that triggers a refund, or a form that provisions an account should have a human confirmation step regardless of who filled it in. That is the same logic I apply when designing pages for visitors who arrive from an AI answer, where the arriving context is thinner than you assume.

What breaks first when agents start filling your forms?

Your qualification logic. Most B2B forms are quietly built around human behaviour, including hesitation, partial completion, and the fields people skip. An agent completes every field it can, consistently, which makes your scoring model read a delegated enquiry as an unusually engaged one.

Field-level heuristics go first. If you score leads by how much of an optional section they filled, or you treat a completed job title field as buying intent, an agent will look like your best lead of the month while being a five second errand. The signal you were reading was never about intent. It was about effort, and effort just got cheap.

Time-on-form checks break next, in the opposite direction. Anti-spam rules that reject submissions completed too quickly will reject legitimate agent-assisted enquiries from real buyers. If you use that kind of rule, check what it is currently throwing away before you tighten anything else.

How should you change your form design for this?

Ask for fewer things and make each one load-bearing. If a field cannot change what you do next, remove it. Short forms with meaningful questions survive this shift because they depend on what the buyer decides rather than on how much typing they were willing to tolerate.

Then move your qualification into places an agent cannot fake on someone's behalf. A question that requires a real decision, such as a budget band, a timeline, or what they have already tried, produces an answer that either came from the person or was checked by them. An agent might type it, but the content still had to come from a human who knows.

Keep your abuse controls, but choose ones that penalise volume rather than speed. A challenge that only appears under suspicious conditions is a reasonable design, and if you are already running something like a captcha on your Webflow forms, the decision to revisit is about thresholds rather than about removing it.

What does this mean for your lead quality and reporting?

It means one of your inputs changed while your dashboard stayed the same. Conversion rate now blends human submissions and agent-assisted ones, and those two groups behave differently after the form. If you are optimising against a blended number, you are optimising against something that no longer describes one behaviour.

The practical step is to stop treating form fill as the outcome. Look one stage further down, at replies, meetings booked, or whatever your first real human interaction is. That metric is much harder to distort, because it requires a person to show up. I would rather watch a smaller true number than a larger ambiguous one.

It is also worth knowing which automated visitors reach your site in the first place, since form traffic is only one slice of it. Working out which AI crawlers and agents visit your site gives you the denominator for all of this, and most teams have never looked.

What should you do next?

Go and read your own form as if you were an agent. Which fields could be completed from a page of public information, and which genuinely require the person? If most of the form falls into the first group, your qualification is decoration and it was probably decoration before agents existed.

Then check two settings. Whether any anti-spam rule rejects fast submissions, and whether your lead scoring rewards completeness. Both were sensible when only humans filled forms, and both now work against you. Changing them is an afternoon of work and it stops you making decisions on a signal that has quietly inverted.

I would not rebuild anything yet. The standards here are still drafts, vendor behaviour is still changing, and the wrong move is to over-engineer for a world that has not settled. Watch your own numbers, keep your forms short and meaningful, and put a human step in front of anything you cannot undo. On who answers for it when an agent does get something wrong on your site, I worked through the ownership question in who is accountable when an agent acts on your site. If you want a second opinion on a form that has started behaving oddly, reach out and send me the numbers.