F5 and Skyfire team up on verified AI agent traffic

F5 and Skyfire have agreed a technology partnership focused on AI agent traffic, centred on integrating Skyfire's Know Your Agent protocol into F5's application security platform.

The integration is designed to help merchants and content providers distinguish verified AI agents from malicious automated traffic. It addresses a growing challenge for online businesses as software agents begin to browse, research and make purchases on users' behalf, while existing bot controls often treat that traffic as suspicious by default.

Under the arrangement, Skyfire's open Know Your Agent, or KYA, protocol will work with F5 Distributed Cloud Bot Defence, part of the F5 Application Delivery and Security Platform. The aim is to let businesses identify AI agents carrying Skyfire identity tokens and apply access rules accordingly, rather than blocking all automated requests.

That is significant for merchants that already rely on bot management tools to guard against scraping, credential stuffing and fraud. Those defences are built to stop hostile automation, but they can also block legitimate agent-led transactions if systems cannot tell the difference.

Traffic shift

The partnership reflects a broader shift in internet traffic. Companies across retail, content and online services are preparing for a rise in AI agents acting for consumers, putting pressure on cybersecurity and identity systems largely designed for human users.

Customers using F5's bot defence service will be able to validate agents through their existing setup. Businesses that also want to take payments from AI agents through Skyfire's platform will be able to do so with current eCommerce systems, without replacing their existing technology stack.

Skyfire's KYA protocol uses JSON Web Tokens, a standard format already widely used in web identity and access systems. F5's bot defence service will read those tokens at the edge and enforce policies in real time, using infrastructure compatible with OAuth2, HTTP and JWKS.

For merchants, the practical effect is a more granular way to handle machine traffic. Instead of treating all automated activity as a threat, they can inspect whether an agent has a recognised identity token and, where appropriate, allow it to proceed through web access or checkout flows.

The tokens can also provide visibility into the agent itself and the human or enterprise principal behind the request. That could help merchants link transactions to an accountable party, which is likely to matter for fraud control, billing and customer service.

Payments layer

Another part of the integration concerns payments. Skyfire said verified agents will be able to complete standard eCommerce checkout flows using tokenised payment credentials, allowing merchants to accept purchases initiated by software agents without redesigning their payment systems.

This places the partnership at the intersection of cybersecurity, digital identity and online payments. While much of the recent focus on AI agents has centred on productivity tools and assistants, the commercial question is whether websites can safely admit autonomous software into processes involving accounts, transactions and money.

John Maddison, Chief Marketing Officer at F5, said a key issue for merchants is being able to distinguish hostile bots from software acting for a real customer.

"The rise of agentic AI represents a fundamental shift in how commerce happens online," said John Maddison, Chief Marketing Officer, F5. "Merchants need the ability to distinguish between a malicious agent or bot and a verified AI agent acting on behalf of a real customer. Through our partnership with Skyfire, F5 customers will gain that visibility. This combined solution enables them to confidently open their doors to the next generation of Internet traffic while maintaining the security posture they depend on."

Skyfire framed the deal as an effort to give AI agents a recognised identity layer on the web, rather than forcing them to operate in an environment where anti-bot tools routinely shut them out.

"AI agents are the new consumers of the Internet, but they've been locked out by security measures designed for a human-only web," said Amir Sarhangi, CEO and Co-founder, Skyfire. "Through our partnership with F5, we're enabling an Internet where verified agents are first-class participants in the digital economy, where identity and security protocols work with them, not against them. F5's unmatched scale in protecting the world's largest enterprises makes this a pivotal step toward making agentic commerce a reality everywhere."

The integration with F5 Distributed Cloud Bot Defence is scheduled to be available by April 30, 2026. Customers will be able to enable Skyfire-verified agent traffic through the F5 Distributed Cloud Console.