Former X Product Head Nikita Bier States That the Most Important Technical Issue in the Next Five Years is Establishing Widely Accepted Standards
Nikita Bier: Proxy self-verification is a challenge for the next five years
Former X Product Head Nikita Bier stated that the most important technical issue in the next five years is to establish widely accepted standards that allow proxies to prove their identity to service providers. Based on this, service providers can separate proxy traffic from human traffic and modify their interfaces.
He believes that the next six months are merely a transition period. Proxies will engage in a cat-and-mouse game to bypass detection in order to maintain the usability of products during their growth phase. This is just a stopgap measure and not a final solution. The post was in response to discussions about browser proxy use cases disappearing by about half within two days and websites beginning to change their strategies.
Bier had previously written in the same direction on September 22. He stated that bot detection and human verification would become the most urgent needs for businesses, as proxy clusters would overwhelm websites and forms, with small companies and government websites being the most vulnerable. At that time, he mentioned that X had evaluated market solutions but found none that integrated the latest technologies, so detection had to be done in-house.
He stepped down as X Product Head in August and transitioned to a consulting role, publicly stating that he is no longer full-time. During his tenure, X launched country of origin labeling for data sources and strengthened defenses against AI bots and spam traffic. This time, the issue was reframed from "blocking bots" to "allowing proxies to legally self-report their identity."
In responses, some have already proposed specifications in development. One side of WorkOS mentioned an open specification auth.md for proxy identity and registration. Another response stated that the existing OAuth authorization scope is too broad for proxies, and that Cross-App Access and ID-JAG are attempts at specification layers, with implementation possibly taking another two to three years. Until then, the authorizations obtained by proxies and regular applications will appear the same, relying only on post-authorization behavior for differentiation.
The buyers are proxy products that need to access websites, while the sellers are websites, forms, and login services. This is a detection battle driven by regulatory gaps, not a new model release. Within six months, funding will flow towards bypassing detection and human verification, while websites will allocate budgets for interception. The party that can first establish identity standards will benefit, while proxies that rely on disguising human traffic and small sites and government sites without protection will be under pressure.
Bier divides the timeline into two segments: five years to establish standards, and six months of guerrilla tactics. The endgame is for service providers to know that the other side is a proxy and proactively modify their interfaces, rather than continuing to treat all non-human traffic as an attack.
Source: Public Information
ABAB AI Insight
Bier was acquired by Meta while working on tbh, and by Discord while working on Gas, both paths focused on productizing the sharing behaviors of young people. From 2025 to 2026, he managed products at X, redesigning Android, timelines, and chat, while also adding country of origin labeling and defenses against AI bots. After stepping down to a consulting role in August, he continues to publicly frame the traffic issues seen from the platform side as industry challenges.
What he seeks is not to sell another human verification plugin. X could not find ready suppliers at the time and had to piece together detection internally, indicating that there are still no standard components for the identity layer. If proxies continue to leverage human conversations and overly broad OAuth, service providers will be unable to differentiate pricing, throttling, or interfaces. The first to create verifiable credentials stating "I am a proxy, representing whom, and what I can do" will stand to charge between websites and proxies.
This is akin to how robots.txt separates crawlers from browsers, and how OAuth separates applications from users. The difference is that proxies will actively disguise themselves, while early crawlers mostly self-reported. The industry is in a power vacuum, relying on detection for the next six months, with two to three years needed for specifications like Cross-App Access to be rolled out. Cloudflare grew by intercepting bots, and the next layer is to allow proxies but with re-pricing.
Essentially, this is a transfer of pricing power. Once traffic cannot be distinguished between humans and proxies, websites can only block all or allow all. Once identity standards are implemented, the same interface can be free for humans and charge per use or throttle for proxies. The cat-and-mouse game preserves usability during the growth phase, while the endgame is for service providers to modify delivery based on customer types, rather than proxies permanently pretending to be users.
ABAB News · Cognitive Law
If you can't recognize the customer, you can't set a price.
Disguise can lead to growth, but not to a final solution.
Before standards arrive, detection is the charging point.