AI agents applying to jobs: a guide for recruiters

An AI agent application is one where software, acting for a candidate, does some or all of the work of applying. That can mean a browser assistant that fills in the form while the candidate watches, a chat assistant that opens a careers page on request, or an auto apply service that finds matching roles and submits applications on a schedule.

These sit on a spectrum. At one end the candidate reads the job, decides to apply and lets a tool type the answers. At the other end the candidate sets broad preferences and may never see the individual postings. Both are AI agent applications, but they tell a recruiter very different things about intent.

This guide uses "agent" for any of these tools. It does not cover candidates who use AI to draft a cover letter and then submit it themselves, which is now common and unremarkable.

There is no reliable public figure for how many applications are submitted by agents today, and claims about it vary widely. What is documented is the pressure on both sides. Greenhouse's 2025 survey of 4,136 job seekers, recruiters and hiring managers in the US, UK, Ireland and Germany describes a cycle in which "jobseekers use AI to apply to more and more jobs, while employers use it to filter candidates back out again"1. It found that 49% of US job seekers had submitted more applications than a year earlier, and that 34% of US recruiters spend up to half their week filtering spam and junk applications.

The same survey found that 41% of US job seekers admit to using prompt injections, which Greenhouse describes as hidden text designed to bypass AI filters1. That is a candidate tactic aimed at the employer's screening tools, separate from agents, but it shows how much of the application process is now one piece of software talking to another.

It is easy to treat any automation as cheating. That would be unfair to many candidates and would not hold up for long. People use agents for the same reasons they use any software: to save time on repetitive forms, to manage a long search while working another job, or because typing and navigating complex forms is hard for them. For some disabled candidates an assistant is the practical way to apply at all.

An application filled in by an agent can still come from a qualified, honest person who wants the job. Penalising the tool itself screens out those people along with everyone else, and it pushes candidates to hide their tools instead of declaring them.

Using an AI agent to apply is not misconduct. A fair policy treats it as information about how an application arrived, and judges the candidate on the same criteria as everyone else.

The real risk with automated applications is that automation makes it cheap to create many applicants who do not exist, or one person posing as many. That ties into a wider identity problem in hiring. In Checkr's 2026 survey of 3,000 US managers involved in hiring, 40% said they had personally interviewed a candidate later revealed to be using a fake identity, and 67% had confirmed or strongly suspected an interview proxy standing in for a candidate2. Only 23% were extremely confident their process would catch a fraudulent candidate.

So the useful questions about an agent application are about the person behind it:

• Is there a real person behind this application who knows it was sent?
• Is that person unique, or is the same individual behind several applicant profiles?
• Is the person who interviews, and who starts on day one, the same person who applied?

None of these depend on whether a tool filled in the form. They are the same questions you would ask of any remote applicant. Our guide to identity verification in hiring covers how to answer them, and how to spot a fake job candidate covers the wider warning signs.

Many agents announce themselves, and there is growing support for doing so in a way a website can verify.

User agent tokens

Every web request carries a user agent string. Some AI services publish the token their agents use. OpenAI, for example, documents a ChatGPT-User token for actions in ChatGPT that a user initiates, and notes that it is not used for crawling the web automatically3. A known token is a helpful hint, but any client can copy a user agent string, so on its own it is a claim and carries no proof.

Signed requests with Web Bot Auth

A stronger approach is cryptographic. HTTP Message Signatures, published as RFC 9421, describes a way to create, encode and verify digital signatures over parts of an HTTP request4. The IETF Web Bot Auth working group is building on it so that automated clients can cryptographically sign outbound requests and servers can verify their identity with confidence5. The draft defines a Signature-Agent header and a key directory that the site uses to check the signature. See Web Bot Auth in the glossary.

A valid signature tells you which agent or operator sent the request. It does not tell you who the candidate is. The working group's charter lists authenticating the end user of a participating client or agent as out of scope6. Signed agent traffic is therefore a reliable label, and confirming the person is still a separate step.

Behaviour on the form

Some agents do not declare themselves. A form can still notice when input arrives in a way people rarely produce, for example a whole page completed in a second with no pointer or key activity. Treat that as a label for review. Fast typists, password managers and accessibility tools can produce similar patterns.

The right policy depends on the role. A high volume hourly role and a senior engineering role with access to production systems carry different risks. Most teams choose from three options.

• Allow and label. Agent applications come in like any other, marked so recruiters know how they arrived. This suits most roles.
• Allow, then confirm the person. The application is held until the candidate confirms they are a real person who meant to apply, for example with a passkey or a short liveness check. This keeps the convenience of the agent and removes applications nobody stands behind.
• Verified candidates only. Applications proceed only once the candidate has verified their identity. This suits sensitive remote roles where identity fraud is a known risk.

Whatever you choose, apply it per role or per team, write it down, and tell candidates on the job posting. Candidates who know the rule can follow it.

1. Separate how an application arrived from whether it is genuine. Record agent use as a label. Keep it out of any fraud or quality score.
2. Use the same criteria for every candidate. Judge skills and experience the same way whether a person or a tool filled in the form.
3. Confirm the person at the right moment. A light check when an agent application is held, and a full identity check at the shortlist, costs genuine candidates little.
4. Check continuity. Confirm that the person who interviews and starts work is the person who applied. Our guide to deepfake and proxy interviews explains why.
5. Keep a person in the loop. Send unclear cases to a reviewer with the reason written out. Do not reject anyone automatically because an agent was involved.
6. Review screening tools. If you rely on AI to screen résumés, test how it handles hidden text and keep a human check on rejections.

Elsin lets each team, or each job, choose to let agent applications in with a label when an agent is detected, hold each one until the candidate confirms with a passkey or a short liveness check, or accept only verified candidates. Detection uses Web Bot Auth signatures, known agent user agent tokens and input events, and it only labels: it never adds to a risk score. Read more about the product or how it connects to your ATS.