Browser agents can now operate a real Chrome instance, execute JavaScript, and send traffic from a user's own device. A valid browser fingerprint therefore proves less than it once did. The site still needs to determine whether the actor is automated, who operates it, whether the user authorized this task, and how much risk the action creates. Those are separate questions. Reliable browser agent detection now requires three layers: probabilistic detection, cryptographic authentication, and explicit authorization.
This distinction matters because the web is moving beyond a simple human-versus-bot boundary. A shopping agent may be welcome when comparing products and unacceptable when testing stolen payment cards. An accessibility tool may produce unusual pointer and keyboard patterns while remaining a legitimate human interface. A signed agent may prove who operates its infrastructure while still exceeding the authority granted by the user.
The target is no longer to block every bot. It is to make automated access verifiable, governable, and proportionate to risk.
Why real Chrome weakens static fingerprints
Traditional bot detection combines signals such as User-Agent, screen dimensions, timezone, fonts, plugins, Canvas or WebGL output, hardware concurrency, and network reputation. This works well when automation leaks a synthetic environment. It becomes less reliable when several agents share the same ordinary browser, operating system, and residential network.
The FP-Agent study measured this directly. Researchers instrumented a honey website and asked seven browser agents and human participants to complete flight-booking, shopping, and forum tasks. The system collected 418 browser fingerprint features and 50 behavioral features.
When humans were included as an eighth class, browser fingerprints alone produced an F1 score of 0.8223. Several agents running in the same macOS environment generated overlapping fingerprints. The classifier often learned the execution environment instead of the agent.
Behavior was much more distinctive. Some agents pasted text while others generated key events. Some jumped directly to click targets without a continuous mouse path. Scrolling ranged from instantaneous jumps to repeated short bursts. Human traces tended to contain more variation, correction, and continuous movement. Behavioral features reached 0.9994 F1 in the paper's main closed-world test, and combined features reached 1.0.
Those numbers show that behavior contains strong signal. They do not establish a universal detector.
The near-perfect result has a narrow boundary
FP-Agent used 56 undergraduate participants, three task families, known agent classes, and an 80/20 split drawn from the same experimental setting. A classifier trained on known agents can separate those agents exceptionally well while remaining uncertain about a new agent, a different task, or a person using assistive technology.
The paper's leave-one-task-out tests expose this boundary. Behavioral-only F1 fell by as much as 0.369. Combined static and behavioral features generalized better, but still depended on the experimental distribution. The authors also expect future agents to imitate human interaction more closely.
Another correction is essential. FP-Agent was submitted on May 2, 2026. Cloudflare introduced Precursor on July 13. The study's Cloudflare case used the free AI Crawl Control and Block AI Bots settings available at the time. Only Manus was fully blocked, while six other agents completed the tasks. That experiment did not test Precursor or Cloudflare Enterprise Bot Management.
The correct conclusion is historical: static and self-declared signals left a visible detection gap. Precursor is a later attempt to close that gap with continuous session behavior.
Precursor moves detection from requests to sessions
Precursor injects a lightweight client-side script and gathers pointer movement, keyboard activity, focus changes, and page visibility across a session. Edge-side evaluators cross-check streams. Pointer activity can be compared with how long the page was visible. Keyboard events can be checked against whether an input had focus. Signals accumulate across refreshes and feed bot scores, challenges, security rules, and session analytics.
This changes the unit of analysis. A single CAPTCHA or request asks whether one moment looks valid. A session asks whether a sequence of actions remains coherent over time. Automation can generate a plausible click. Reproducing the variable timing, corrections, focus changes, and task-dependent movement of an entire journey is more expensive.
Cloudflare says Precursor records keyboard timing and rhythm rather than the keys themselves, evaluates aggregate patterns, and avoids tying raw behavior to persistent user profiles. These are useful privacy constraints. They are also vendor claims. Public material currently provides no independently reproducible precision, recall, demographic error, adversarial robustness, or accessibility evaluation.
That missing evidence should shape deployment. Start in shadow mode. Measure errors in the target application. Treat a risk score as a signal, not an identity credential.
Detection, authentication, and authorization solve different problems
A production design becomes clearer when the three layers are separated.
1. Detection: does this session resemble automation?
Detection combines network, HTTP, device, browser, and behavior signals. It produces a probability or risk class. Its purpose is to handle unknown, evasive, or unsigned traffic.
Detection remains an adversarial loop. Models change, automation libraries add human-like delays, and legitimate users change devices or interaction methods. The classifier needs continuous recalibration against verified outcomes.
2. Authentication: which agent operator sent this request?
The emerging IETF Web Bot Auth work uses HTTP Message Signatures so automated clients can cryptographically identify an operator or product. This is much stronger than trusting a User-Agent string or published IP range. Cloudflare already documents a Web Bot Auth verification path.
Signed identity improves cooperation with legitimate agents. It does not solve hostile traffic because participation is voluntary. It also proves an operator, not necessarily the end user or the purpose of a specific action.
3. Authorization: may this agent perform this action now?
Authorization connects agent identity to delegated user authority. A token should describe the user, agent, resource, action, scope, expiry, and any human approval requirement. Reading a public catalog and changing a bank beneficiary deserve different policies.
NIST's concept paper on software and AI agent identity highlights this broader chain: identification, authentication, authorization, auditing, non-repudiation, on-behalf-of delegation, action intent, and tamper-evident records.
Behavior tells you what the actor resembles. A signature tells you who operates it. Authorization tells you what it may do. Audit evidence tells you what it actually did.
False positives are a product and accessibility risk
Behavioral detection can quietly redefine a typical human as a security policy. That creates risk for people using screen readers, keyboard-only navigation, voice control, switch devices, remote desktops, styluses, privacy browsers, or high-latency connections. FP-Agent's human sample did not evaluate these groups.
W3C has long documented CAPTCHA accessibility barriers. Continuous behavioral scoring may reduce visible challenges, but its fairness cannot be assumed. The relevant production metrics include challenge completion, appeal rate, abandonment, false positives by device and input mode, and the cost imposed on users who deviate from the training distribution.
A hard binary block is rarely the right first response. Better controls are progressive:
- Allow low-risk reads while recording the session.
- Rate-limit unknown automation and request a stronger signal.
- Require signed identity or delegated credentials for protected resources.
- Require explicit human confirmation for payment, deletion, permission changes, and other irreversible actions.
- Preserve an appeal or alternative verification path.
A production decision matrix
| Situation | Detection | Identity | Authorization | Recommended action |
|---|---|---|---|---|
| Public read, low volume | Low risk | Unknown | None required | Allow and observe |
| Unsigned repetitive extraction | Medium or high risk | Unknown | None | Rate-limit, challenge, or meter |
| Signed shopping agent | Low risk | Verified operator | Scoped user consent | Allow within scope |
| Signed agent changing account settings | Any | Verified operator | Broad or stale scope | Re-authorize and require confirmation |
| Unknown actor attempting payment or deletion | High risk | Unknown | Missing | Block the action and preserve evidence |
This matrix prevents a common failure: using one bot score to make every access decision. Risk depends on the action, authority, and consequences, not only on whether automation is present.
The web needs accountable agents, not invisible humans
Browser agents will continue to become harder to distinguish from human-operated browsers. Defenders can respond by collecting ever more intimate behavioral signals, while agents invest in ever more realistic imitation. That arms race has no stable endpoint.
A better web architecture gives legitimate agents a reason to identify themselves and gives sites a way to verify delegated authority. Behavioral detection then becomes the fallback for unsigned and adversarial traffic, rather than the sole gatekeeper.
The practical stack is straightforward: use cheap static signals for triage, session behavior for risk, signed identity for provenance, scoped authorization for actions, and external audit records for accountability. The system should continuously test its own false positives and drift.
The decisive question is no longer whether the browser looks human. It is whether the actor, authority, behavior, and result form a chain that the site can verify.
FAQ
Can websites detect AI agents using a real browser?
Yes, behavior and session timing can reveal automation even when the browser environment is genuine. Detection remains probabilistic and must be tested against new agents, tasks, devices, and human interaction modes.
Did FP-Agent show that Cloudflare Precursor detects only one of seven agents?
No. FP-Agent predates Precursor. It tested Cloudflare's free AI bot controls available in May 2026, not the session-level Precursor product released in July.
Is behavioral fingerprinting enough to identify an agent?
It can classify traffic, but it does not provide cryptographic identity or prove user authorization. Use it alongside signed identity and scoped access controls.
What is Web Bot Auth?
Web Bot Auth is emerging IETF work that applies HTTP Message Signatures to automated web clients. It helps sites verify an operator or product without trusting spoofable headers.
How should a site reduce false positives?
Deploy first in shadow mode, measure errors by device and input method, use graduated responses, and provide alternative verification for users affected by challenges.