Free Guide
Detecting artificial intelligence (AI) content starts with a reality check.
There is no single tool that reliably tells you whether something was made by AI. Even OpenAI withdrew its own AI-text classifier in 2023, citing its low rate of accuracy.[1] The dependable approach is the one digital forensic investigators use: combine provenance, technical evidence, context, and out-of-band verification, then weigh the results together.
The SIFT habit (from digital-literacy educator Mike Caulfield): Stop before reacting, Investigate the source, Find better coverage, and Trace claims, quotes, and media back to the original. It works on AI fakes and human ones alike.
Text
Checking whether text was written by a large language model (LLM).
Signals worth noticing
- Polished but generic writing with few specific, checkable details
- Citations, quotes, statistics, or case law that do not exist when you look them up
- Uniform sentence rhythm, tidy summaries, and the same structure in every paragraph
- Confident claims about recent events the writer could not know
- Leftover chatbot phrasing, such as "as an AI language model" or "certainly, here is"
Better evidence than a detector score
- Verify every reference. Fabricated sources are the strongest single tell.
- Look at process evidence: document version history, drafts, and edit timestamps.
- Ask follow-up questions about the content; authors can explain their reasoning.
- Check for watermarks where vendors offer them, such as Google's SynthID for text from Google models.[3]
Caution: AI-text detectors produce false positives, and they are known to misflag writing by non-native English speakers. Never discipline an employee, student, or vendor based on a detector score alone.
Images
Spotting AI-generated and AI-edited images.
Look closely
- Hands, teeth, ears, and jewelry with extra, merged, or missing parts
- Garbled or nonsensical text on signs, badges, and documents
- Shadows and reflections that do not match the light sources
- Backgrounds that melt, repeat, or bend straight lines
- Skin that is too smooth, and hair that blends into the background
The newest generators make fewer of these mistakes, so a clean image is not proof of authenticity.
Check provenance and metadata
- Content Credentials: upload the file to contentcredentials.org/verify to read Coalition for Content Provenance and Authenticity (C2PA) data showing how it was made and edited.[2]
- SynthID Detector: Google's portal checks for watermarks embedded by Google AI tools.[3]
- Reverse image search: Google Lens, Bing Visual Search, or TinEye can find the original or earlier versions.
- Metadata: tools such as ExifTool show camera model, software, and timestamps. Missing metadata proves nothing, because most social platforms strip it.
- Error level analysis: FotoForensics can highlight areas edited differently from the rest of an image. Interpret with care.
Video & Deepfakes
Checking video and live video calls.
Recorded video
- Lip movements that drift out of sync with speech
- Unnatural blinking, frozen expressions, or stiff head movement
- Flicker or blur around the hairline, jaw, glasses, and earrings
- Lighting on the face that does not match the room
- Use the free InVID-WeVerify plugin to split video into keyframes and reverse-search them.
Live video calls
- Ask the person to turn their head fully sideways, or pass a hand in front of their face.
- Ask a question only the real person would know, and that is not on social media.
- Watch for call lag, mismatched voice tone, and pressure to act quickly or secretly.[4]
- End the call and call back on a number you already have on file.
Voice Cloning
Stopping AI voice-clone fraud.
A few seconds of public audio is enough to clone a voice convincingly. The Federal Bureau of Investigation (FBI) warns that AI voice clones can sound nearly identical to the real person.[4] Process controls beat ears.
- Callback rule: verify any request for money, credentials, or data by calling a known number, never the number that called you.
- Code words: agree on a verbal passphrase for executives, finance staff, and family members.
- Dual approval: require two people to approve payments, wire changes, and new vendor bank details.
- Slow down urgency: train staff that "urgent and confidential" is a warning sign, not an instruction.
- Limit voice samples: be thoughtful about long public recordings of executives where they are not needed.
Chat & Social Media
Is the account or chat partner a bot or a person?
Common signs
- Long, polished replies that arrive instantly at any hour
- Answers that never reference shared history or specific details you mentioned earlier
- New accounts with stock or AI-generated profile photos and generic bios
- Networks of accounts posting near-identical wording
Simple tests
- Ask about something local, current, or personal that requires real experience.
- Ask the same question twice in different words and compare the answers.
- Ask directly. In California, bots used to sell products or influence votes must disclose that they are bots, and the European Union (EU) AI Act adds AI-interaction transparency duties.[7]
- Move important conversations to a verified channel such as a video call or known email address.
Your Website: Front End
Detecting AI bots and automated agents on your website.
AI crawlers, scrapers, and browser-driving AI agents now make up a meaningful share of web traffic. Some announce themselves; others pretend to be people.
What you can see in the browser and analytics
- Visits with no mouse movement, scrolling, or time on page, or impossibly fast form fills
- Spikes from data-center networks or unusual countries, at odd hours
- Headless-browser signals, such as automation flags set in the browser
- Form submissions that fill hidden "honeypot" fields a human would never see
Defenses
- Add honeypot fields and server-side validation to forms
- Use a privacy-friendly challenge such as Cloudflare Turnstile on forms and logins
- Enable bot management or a web application firewall (WAF) with rate limiting
- Publish AI-crawler preferences in robots.txt, knowing that compliance is voluntary
| Common AI crawler (user agent) | Operator and purpose | Honors robots.txt? |
|---|---|---|
| GPTBot | OpenAI, collects content that may be used to train models | Yes[5] |
| OAI-SearchBot | OpenAI, surfaces sites in ChatGPT search results | Yes[5] |
| ChatGPT-User | OpenAI, fetches a page when a user asks ChatGPT to | May not apply, because a user initiated it[5] |
| ClaudeBot | Anthropic, model training crawler | Yes, per the operator |
| Google-Extended | Google, a robots.txt token that controls use of content for Gemini training | Yes, per the operator |
| PerplexityBot | Perplexity, search indexing | Yes, per the operator |
| CCBot | Common Crawl, open web dataset widely used for AI training | Yes, per the operator |
Watch for spoofing: anyone can fake a user-agent string. Confirm that a "GPTBot" or similar visitor really comes from the operator by checking its Internet Protocol (IP) address against the operator's published IP ranges (OpenAI publishes JSON lists for each crawler) or by a reverse Domain Name System (DNS) lookup.[5]
Your Systems: Back End
Finding bots and AI agents in server logs and APIs.
This section is written for your information technology (IT) team or managed service provider. Share it with them.
- Request patterns: steady, high-rate requests, sequential URL walking, and no loading of images, CSS, or JavaScript.
- Network origin: group traffic by autonomous system number (ASN) to spot cloud and hosting providers posing as home users.
- Fingerprints: Transport Layer Security (TLS) fingerprints such as JA3 and JA4, plus header order, often reveal automation tools behind a browser-like user agent.
- Application programming interface (API) abuse: watch for credential stuffing, scraping through APIs, and token sharing across many IP addresses.
- Agent behavior: AI agents that drive a real browser can look human, so watch for unusually consistent timing and task-only navigation.
- Centralize logs in your security information and event management (SIEM) tool and alert on spikes, new ASNs, and failed-login bursts.
Vendors & Products
Is a product or vendor quietly using an LLM?
Many software products have added AI features that send your data to a model provider. Here is how to find out.
- Read the privacy policy, terms, and subprocessor list for AI model providers such as OpenAI, Anthropic, Google, or Microsoft Azure OpenAI.
- Open your browser's developer tools (Network tab) while using the feature and look for calls to AI APIs or streaming responses.
- Notice word-by-word "typing" output and slightly different answers to the same question, both typical of LLMs.
- Ask the vendor directly in your security questionnaire: which models, where data is processed, retention, training use, and whether you can opt out.
- Request an AI bill of materials (AI-BOM) or model card for critical systems.
Verification Playbook
A five-step check before you trust, share, or act.
1. Pause
Strong emotion and urgency are the attacker's tools. Slow down.
2. Source
Who published it first? Is the account, domain, or number real?
3. Provenance
Check Content Credentials, watermarks, metadata, and reverse search.
4. Corroborate
Find independent, reputable coverage or a second channel.
5. Verify out of band
Call back on a known number before money, data, or access changes hands.
For organizations, the National Institute of Standards and Technology (NIST) report AI 100-4: Reducing Risks Posed by Synthetic Content describes provenance, watermarking, and detection approaches in more depth.[6]
Nexus Security Advisors can run deepfake and voice-clone fraud tabletop exercises, write verification and payment-approval procedures, review website bot defenses, and support digital forensic analysis of suspected synthetic media.
Sources
References
Sources cited on this page (last reviewed October 31, 2026)
- Search Engine Land, OpenAI's AI Text Classifier no longer available due to "low rate of accuracy", July 2023. searchengineland.com
- Content Authenticity Initiative, Using the Verify tool. opensource.contentauthenticity.org
- Google, SynthID Detector: a new portal to help identify AI-generated content. blog.google
- FBI Internet Crime Complaint Center (IC3), Public Service Announcement I-072026-PSA, July 20, 2026. ic3.gov
- OpenAI, Overview of OpenAI Crawlers. developers.openai.com
- NIST, AI 100-4: Reducing Risks Posed by Synthetic Content, November 2024. doi.org/10.6028/NIST.AI.100-4
- Orrick, EU AI Act Update: Digital Omnibus Finalizes 8 Compliance Changes, July 2026. orrick.com
Related free guides: AI Explained for Business Leaders · Responsible & Ethical AI