arXiv:2606.30119v1 [cs.CR] 29 Jun 2026
On the Internet, Nobody Knows You’re an LLM Bot: Unmasking Web Agents with Multi-Layer Fingerprinting Iliana Fayolle∗
Sihem Bouhenniche∗
Samuel Pélissier
Univ. Lille, CNRS, Inria Lille, France [email protected]
Univ. Lille, CNRS, Inria Lille, France [email protected]
CentraleSupélec, Inria, IRISA Rennes, France [email protected]
Pierre Laperdrix
Clémentine Maurice
Walter Rudametkin
Univ. Lille, CNRS, Inria Lille, France [email protected]
Univ. Lille, CNRS, Inria Lille, France [email protected]
Univ. Rennes, CNRS, Inria, IRISA, IUF Rennes, France [email protected]
Abstract Since 2023, a new class of bots has emerged: Web Agents. They can automate complex tasks on the Web, going beyond traditional browser automation tools such as Selenium, Puppeteer, or Playwright. Leveraging large language models (LLMs), these agents are capable of solving anti-bot mechanisms, mimicking human behavior, and, in some cases, operating directly from the local machine of the user configuring them. As a result, it is becoming increasingly difficult for website administrators to detect and block these LLMbased bots. Modern Web Agents commonly integrate stealth and anti-detection techniques, while numerous proprietary and opensource anti-bot mechanisms have emerged recently, specifically to block them. However, despite their growing prevalence, there is little evaluation of the effectiveness of state-of-the-art anti-bot mechanisms against these LLM-based bots and their stealth capabilities. Likewise, no prior work has comprehensively studied how to characterize and distinguish Web Agents deployed either in the cloud or locally. This paper addresses these open questions by deploying multiple honeysites protected by one or more anti-bot mechanisms (e.g., robots.txt, CAPTCHAs, proof-of-work, and Cloudflare’s free proprietary solutions). We integrated network-, HTTP-, and browser-level fingerprinting techniques, and prompted six LLMbased Web Agents to visit the deployed honeysites. Our analysis reveals three main findings: (i) some Web Agents were able to bypass all evaluated anti-bot mechanisms; (ii) all evaluated Web Agents can be distinguished both from humans and from one another using multi-layer fingerprinting techniques across network, HTTP and browser layers; (iii) stealth and anti-detection mechanisms often increase detectability rather than decrease it.
Keywords Bot detection, Web Agent, Fingerprinting
1
Introduction
According to Cloudflare Radar [16] and the 2025 Thales Group report [54], bots represent between 30% and 50% of all web traffic. Not all bots are harmful, some serve legitimate purposes in the Web ecosystem, such as search engine indexers, uptime monitors, or accessibility checkers. However, a significant fraction of bot traffic ∗ These authors contributed equally to this work.
is either malicious (e.g., engaging in security exploits, credential stuffing, fraud, spam, or content theft [14, 67, 104]) or simply unwanted (e.g., consuming server resources, inflating bandwidth costs, and crowding out genuine user traffic [30]). Approximately 14% of total web traffic is attributed to so-called bad bots [54]. As a result, web administrators need to selectively block certain categories of bots while preserving access for legitimate bots and actual visitors. This dynamic explains the ongoing arms race between bot operators and web administrators. The most basic countermeasure, the Robots Exclusion Protocol (commonly known as robots.txt [44]), allows web administrators to declare which paths crawlers should avoid. However, since robots.txt is merely advisory, many bots, including some of those operated by AI companies, ignore it entirely and scrape content regardless [2, 67]. Moreover, non-expert web administrators, such as artists, hobbyists, or beginners are often unaware of this convention or are unable to modify the file due to restrictions imposed by their hosting provider [67]. More direct enforcement mechanisms, such as server-side rules [40] and useragent blocking, shift control from the bot to the server but remain trivially bypassed via user-agent spoofing [59, 66, 73]. Hence, more sophisticated techniques have been developed, including challengebased methods (e.g., CAPTCHAs [47, 90], proof-of-work [112]), browser [8, 124, 125] and TLS fingerprinting [66, 88], which aim to identify bots more reliably regardless of the identity they claim. Since October 2023, a new category of bot traffic has emerged, based on Large Language Models (LLMs), a class of AI generative models [67]. LLM-based bots operate in three distinct modes: (i) passive crawling to collect training data from the open Web [83]; (ii) active retrieval triggered when a user submits a query to a system such as ChatGPT [80], causing the model to fetch live content on the user’s behalf; and (iii) agentic visits in which autonomous Web Agent tools browse, interact with, and extract information from pages with varying degrees of autonomy (hereafter, we use the terms “tools” and Web Agents interchangeably). This increase in LLM-based traffic has concrete consequences for website administrators: excessive resource consumption, increased hosting fees, loss of advertising revenue from traffic never converted into human engagement, and a loss of control over how content is used for model training [67]. Beyond volume, LLM-based bots require more nuance when blocking. A web administrator could previously maintain a relatively stable allowlist of well-known, well-behaved
Conference’17, July 2017, Washington, DC, USA
crawlers (e.g., Googlebot) and broadly block any unexpected behavior or fingerprint. Now, they may wish to block LLM training crawlers to prevent their content from being ingested without consent, while simultaneously permitting certain agentic use cases. However, previous work only focused on robots.txt compliance by LLM-based bots [26, 58, 67] or the characteristics of bot traffic prior to LLM democratization [8, 66, 123–125]. To the best of our knowledge, this is the first large-scale study on the identifying features of LLM-based bots from the perspective of a web server using only single-request, multi-layer fingerprinting techniques via technical API-level observations, without relying on behavioral analysis that requires multiple bot visits or interactions [127]. Furthermore, we found no previous work that estimates the possibility of blocking evasive LLM-based bots with a sufficiently fine-grained approach, which is crucial for web administrators to maintain control over their content and resources while allowing legitimate use cases. This motivates the following research questions: RQ1: To what extent are modern web defenses effective against bots, in particular LLM-based ones? RQ2: Do LLM-based bots exhibit distinctive characteristics (e.g., IP metadata, TLS fingerprints, HTTP header patterns, browser fingerprints) that differentiate them from traditional bots? RQ3: To what extent can locally executed Web Agents be distinguished from cloud-based ones, and are they inherently less detectable due to their similarity to genuine user environments? To answer these research questions, we deployed nine honeypot servers, each with one or more anti-bot mechanisms installed. For each incoming connection, we collect three fingerprinting layers: (i) network-level information including IP and TLS data, (ii) HTTP headers, and (iii) browser fingerprints. We interact with our infrastructure through a diverse set of 12 tools, including historical web scrapers (e.g., cURL), web automation frameworks (e.g., Playwright), and LLM-based Web Agents, deployed both locally and in cloud environments. To establish a baseline for legitimate traffic, we additionally collect fingerprints generated by our local machines across the same three layers. Our contributions are as follows. (I) We actively evaluate the effectiveness of each anti-bot mechanism, as well as the added value of combining multiple techniques against modern Web Agents (§ 5). (II) We establish the most relevant fingerprinting criteria to distinguish between human users and bots, and more specifically to differentiate between Web Agents and traditional bots (§ 6). (III) Finally, we create an anonymized four-month dataset containing passive and active fingerprinting data from various categories of bots. Using the active data, we evaluate multi-layer classification and achieve accurate classification of bots, LLM-based bots, and human users (§ 7). Artifacts are available in the Open Science section.
Fayolle et al.
2.1
HTTP-based scrapers. The most basic bots rely on HTTP clients and scraping tools such as cURL [27], wget [43], or scrapy [101]. Because they operate outside a browser environment, these bots cannot execute JavaScript or render dynamic web applications; they are limited to retrieving raw HTML. Nevertheless, this approach is widely adopted for large-scale data collection due to its minimal computational overhead and reduced hosting costs. In practice, training crawlers like GPTBot [83] aggressively scan websites to harvest data, sometimes revisiting dynamic pages multiple times a day. This pattern can inadvertently lead to outages cause DDoSlike disruptions [30]. Similarly, when users prompt an LLM-based chatbot to retrieve website information, the assistant may dispatch an HTTP-based scraper, such as ChatGPT-User [83], to fetch the content in real time [26]. Browser automation frameworks. Frameworks such as Selenium [103], Puppeteer [46], or Playwright [74] allow bots to control genuine web browsers to visit websites. Unlike HTTP-based tools, they execute JavaScript and render dynamic webpages, making them harder to detect because they are closer to standard user environments. They mimic human browsing through scripted interactions (e.g., clicking, filling forms, scrolling), but often struggle with non-deterministic challenges like CAPTCHAs. Web Agents. LLM-based bots operate at the semantic layer, following natural language instructions instead of requiring fully scripted interactions [5, 31, 79, 84, 105, 115, 117]. Most Web Agents combine browser automation frameworks with LLM-based reasoning. Early systems focused on text-based browsing [77], whereas recent agents can visually interpret webpages [49, 79, 105], adapt to JavaScript-heavy environments [5, 79, 105], and even control desktop environments [84]. The growing sophistication of Web Agents raises major concerns for website administrators. They can extract high-value content at scale [67], automate abusive workflows, such as credential stuffing or ticket scalping [14, 95, 104], and increasingly integrate anti-detection mechanisms, including stealth browser configurations [116, 120]. As a result, modern Web Agents are substantially harder to detect than traditional bots because (i) they execute full browser stacks, (ii) they exhibit realistic interaction patterns [75, 118, 130], (iii) they rely on vision-based reasoning [49, 79, 105], and (iv) they may operate locally on the users device [84].
2.2
2
Background
In this section, we present the different types of bots, anti-bot mechanisms, and fingerprinting techniques necessary to understand the contributions of this paper.
Taxonomy of Bots
Bots automate a variety of tasks on the Web, including crawling, scraping, and interacting with applications. We classify them into three categories based on their level of automation and underlying technology stack: lightweight HTTP scrapers, browser automation frameworks, and LLM-based Web Agents.
Anti-bot Mechanisms
To mitigate bots, websites rely on defense strategies that vary in popularity, openness, and effectiveness. A common approach is to rely on IP address reputation by blocking addresses previously associated with suspicious behavior. However, this alone is insufficient, as demonstrated in this paper due to bots easily rotating IP addresses (see § 6.1), and must therefore be combined with other anti-bot mechanisms.
On the Internet, Nobody Knows You’re an LLM Bot
Rule-based detection. Basic defenses include the robots.txt convention [17, 44] and server-side configuration files, such as Apache’s .htaccess [40]. Formally known as the Robots Exclusion Protocol [58, 60], robots.txt specifies which resources crawlers should avoid through directives such as Disallow and User-agent. However, compliance is voluntary [28], especially for malicious bots, and empirical studies show strong variations across crawlers [58]. While many LLM-based crawlers follow these directives, Web Agents often do not [58, 67]. More specific conventions such as the noai meta tag also exist but are rarely adopted [67]. Server-side configurations (e.g., .htaccess rules, firewalls) provide a stronger mechanism by blocking specific user agents or IP addresses, typically returning errors like the HTTP 403 status code. Respectful LLM-based crawlers, including those from OpenAI [83], often identify themselves through their user agent and can therefore be filtered [67]. Nevertheless, bots can evade these rules by spoofing user agents or rotating IP addresses [66]. CAPTCHAs. Completely Automated Public Turing tests to tell Computers and Humans Apart (CAPTCHAs) aim to distinguish humans from bots. Over the past two decades, they have evolved from text recognition to images, puzzles, videos, audio, equations, and mini-games [48]. However, advances in machine learning have enabled bots to solve many traditional CAPTCHAs, especially simpler ones [23, 29, 78, 89]. Additionally, attackers bypass them using CAPTCHA farms, where underpaid workers manually solve the challenges for bots [36]. As a result, more advanced approaches have emerged, including checkbox-based ("I’m not a robot") and frictionless CAPTCHAs, which rely on fingerprinting and behavioral analysis instead of explicit user interaction. A widely deployed example is Google’s reCAPTCHA [47], which analyzes signals such as cursor movements, cookies, device history, and browsing behavior to detect automation. Privacy-friendly and GDPR-compliant alternatives also exist, such as ProCaptcha [90]. Proof-of-work. Proof-of-work mechanisms require a client to solve a computational challenge before accessing a website [56]. This increases the cost of large-scale crawling by forcing bots to use sufficiently powerful hardware. Unlike CAPTCHAs, proof-ofwork does not require user interaction or personal data. For example, Anubis [112] asks clients to compute SHA-256 checksums before granting access. Although lightweight, open-source, and free, such systems have limitations: sophisticated bots may execute the challenge in full browser environments or outsource it to external servers capable of solving SHA-256 puzzles [52]. As acknowledged in the official Anubis documentation [112], proofof-work should therefore complement stronger approaches like fingerprinting (see § 2.3). Cloudflare solutions. Cloudflare [19] provides widely used hosting and security services for websites. According to W3Techs [24], 22.7% of websites used Cloudflare as of May 2026, making it a major actor in bot mitigation. Their anti-bot mechanisms include: (i) Turnstile [22], a privacy-focused alternative to CAPTCHAs that silently analyzes browser behavior, JavaScript execution, and device characteristics through fingerprinting to estimate whether a visitor is human [98]. (ii) Bot Fight Mode (BFM) [18], a free proof-of-work-based system that detects suspicious traffic and serves computationally
Conference’17, July 2017, Washington, DC, USA
expensive JavaScript challenges. Paid versions provide additional controls but rely on the same detection technology [21]. (iii) Block AI Bots [11], which blocks known LLM-based crawlers used for AI training, including those from ChatGPT [80], Claude [6], Perplexity [1], and Gemini [45]. Cloudflare maintains lists of associated User-Agent strings and IP addresses, including bots that do not identify themselves [11]. Although the implementation details remain private, Liu et al. [67] empirically analyzed the AI crawlers blocked by this feature and observed that LLM-based crawlers operated by major AI companies generally respected robots.txt directives, whereas several LLM-based applications did not consistently do so.
2.3
Fingerprinting
Anti-bot mechanisms often rely on fingerprinting to distinguish bots from legitimate users. In practice, fingerprinting consists of collecting discriminative attributes and comparing them to known bot signatures or behaviors [51, 64]. This section presents fingerprinting approaches at both the network and browser levels. Transport Layer Security (TLS) fingerprinting. Transport Layer Security [94] is a communication protocol to secure network communications, such as HTTPS. At the start of a TLS connection, the client sends an unencrypted Client Hello message advertising supported cipher suites, TLS versions, extensions, and cryptographic preferences. Because the structure and ordering of these elements depend on the client software and TLS library, the Client Hello message is often characteristic of a specific software stack [51, 57]. A widely adopted fingerprinting tool is JA4 [3, 10, 57, 121], which extracts structured features from the Client Hello message to generate a concise fingerprint (i.e., a hash) that can be used across datasets. Since our work focuses on identifying bot characteristics rather than improving fingerprinting itself, we use JA4 as an off-the-shelf solution. Browser fingerprinting. Although browser fingerprinting is widely known for device tracking [64, 69, 102], it is also used for bot detection [124]. In practice, JavaScript code embedded in webpages collects distinctive browser and device attributes, such as software versions, screen resolution, fonts, plugins, and HTTP headers [64], and combines them into a quasi-unique identifier [33]. Because fingerprinting is stateless and does not rely on client-side storage, it can persist across sessions and resist evasion techniques like user-agent spoofing [57, 66, 123, 125]. It is also effective at detecting inconsistencies or anomalous configurations associated with automation [123, 125], such as unusual font sets, missing plugins, or mismatched system attributes.
3
Methodology
Our goal is to evaluate the effectiveness of anti-bot mechanisms against Web Agents while simultaneously assessing the ability of Web Agents to evade these defenses by mimicking human characteristics. In particular, we analyze: (i) the differences between various categories of bots, such as traditional scrapers and autonomous Web Agents, and (ii) the differences across multiple layers of collected information, including IP metadata, TLS fingerprints, HTTP headers, and browser fingerprints. To achieve this, we designed and deployed an infrastructure based on honeysites to collect real-world
Conference’17, July 2017, Washington, DC, USA
Fayolle et al.
Table 1: Selected anti-bot mechanisms. Defense(s)
Availability
robots.txt (RT)
Open standard
User-Agent filtering (UA)
Open-source
Google reCAPTCHA v3 (rV3)*
Proprietary
Prosopo CAPTCHA v3.5 & v3.6 (Pro)
Open-source
Proof-of-work Anubis v1.20.0-pre1 (Anubis) Open-source Turnstile (TS)*
Proprietary
BFM* & Block AI Bots (CF)*
Proprietary
RT + UA + Pro + Anubis RT + UA + TS + CF
Open-source Proprietary
Rule-based detection CAPTCHA Proof-of-work Cloudflare solutions * indicates that the version of the corresponding solutions is not publicly specified. Experiments were conducted January–May 2026.
data both passively (i.e., from web scrapers), and actively (i.e., by instrumenting Web Agents). In this section, we describe our honeysites infrastructure, our experimental protocol, as well as the data processing and metrics we adopted.
3.1
Infrastructure
As summarized in Figure 1, we rely on honeysites with different antibot mechanisms that capture signals across network and application layers, allowing us to study bot interactions with web environments. 3.1.1 Anti-bot Mechanisms Across Honeysites. The defenses we selected (summarized in Table 1) are widely used and representative of the state-of-the-art, covering all categories of anti-bot mechanisms introduced in § 2.2. For robots.txt and User-Agent filtering, we used the bot lists recommended in [37, 107], reflecting common blocking practices. Additional details are provided in the artifacts in the Open Science section. We excluded LLM-based anti-bot mechanisms, such as AI Labyrinth [111], as their objective is not to block bots, but to redirect visitors identified as bots by Cloudflare’s anti-bot mechanisms toward AI-generated decoy pages designed to waste their time and computational resources. We also investigate whether combining anti-bot mechanisms increases bot detection. To this end, we implemented two combined configurations: one relying exclusively on free and open-source solutions, and another based on Cloudflare protections. In both cases, we retained rule-based mechanisms because they are lightweight, easy to deploy, and free to use. 3.1.2 Honeysite Deployment. Each honeysite is deployed on its own nginx web server with zero, one, or multiple anti-bot mechanisms listed in Table 1. An nginx reverse proxy routes incoming traffic to the appropriate domains. All honeysites are served over HTTPS and support TCP-based protocols (HTTP/1.1 and HTTP/2) as well as UDP-based HTTP/3 (QUIC). To ensure each visit generates a fresh request, HTTP caching is disabled. To prevent visits from unsuspecting human users, the honeysites are hosted under a randomized domain. The main domain hosts the unprotected
honeysite, while additional honeysites are deployed behind the site1–site9 subdomains. 3.1.3 Honeysite Design. We designed our honeysites using a combination of static and dynamic elements to capture a broad range of bot behaviors. Figure 3 in Appendix B illustrates the appearance of the honeysites, which feature a large clock that updates regularly along with relevant textual information. The static content is intended to create an authentic environment for indexing bots and simple scrapers that do not execute JavaScript. The dynamic content, including shuffled menu links, changing clock times, and a dynamically generated unique page identifier (page_id), is designed to verify that Web Agents interact with a live page rather than a cached version that could bias our measurements. To reliably identify Web Agents, we require them to submit a three-field HTML form (first name, last name, and content) via an HTTP POST request. Each interaction is tracked using a session cookie (cookie_id) assigned during the initial visit. We consider an agent’s visit successful if it bypasses our security measures and correctly executes the submission by providing: the form data including the dynamic page_id in the POST payload, and the cookie_id via the HTTP cookie header. 3.1.4 Collected Data. For each visit to a honeysite, we collect data types from three connection layers: (i) Network packets. We capture IP and TLS packets of all incoming traffic at the entry point of our infrastructure using the network protocol analyzer tshark [113]. This allows us to collect traffic from both the TCP and UDP protocols. (ii) Nginx access logs. We retain nginx access logs [35] at the entry point for a complete view of the visits. (iii) Browser fingerprints. We extract browser fingerprints using a lightweight algorithm inspired by AmIUnique [4] and FingerprintJS [38]. The fingerprint contains JavaScript attributes and HTTP request headers, listed in Appendix C.
3.2
Experimental Protocol
We generate visits to our honeysites using different Web Agents and browser automation frameworks. Though not the focus of this paper, we also monitored passive traffic (see Appendix E). Local machines. For all local operations, we used two Intel Core i7-1185G7 machines (running Ubuntu 20.04.6 and 24.04.3) to contrast regular browsing behavior with automation tools. Human users. To establish a ground-truth baseline, we manually accessed the honeysites from both local machines using Chrome (v144.0.7559.96) and Firefox (v136.0 and v147.0.1). Scrapers and browser automation frameworks. We generated traffic from our local machines using scrapers (cURL, wget, scrapy) and browser automation frameworks (Selenium, Playwright, Puppeteer), as detailed in § 2.1. Web Agents. As previous work [31, 114], we selected six LLMbased Web Agents based on their popularity (i.e., GitHub stars). They are either cloud-based, deployed locally (as web extensions or via Playwright), or both. The Web Agent selection is summarized in Table 2 and more details on their features are given in Appendix A. We excluded general-purpose AI assistants like ChatGPT [80],
On the Internet, Nobody Knows You’re an LLM Bot
Conference’17, July 2017, Washington, DC, USA
Web Agents
Browser Automation Frameworks
HTTP-Based Scrapers
HTTPS Network Packets
Nginx Access Logs
Reverse proxy
domain
robots.txt
User-Agent filtering
Google reCAPTCHA
Prosopo CAPTCHA
Proof-of-work Anubis
Turnstile
BFM & Block AI Bots
site1.domain
site2.domain
site3.domain site4.domain
site5.domain
site6.domain
site7.domain
RT + UA + Pro RT + UA + TS + Anubis + CF
site8.domain site9.domain
Browser Fingerprints
Figure 1: Data collection infrastructure for the deployment and instrumentation of honeysites. Table 2: Feature comparison of selected Web Agents.
Agent
Proprietary vs open source
Local vs cloud
OpenClaw [84]
Open source
Local
Claude for Chrome [5]
Proprietary
Local
Crawl4AI [115]
Open source
Local
Anti-bot capabilities Undocumented (stealth mention in source code) Undocumented Stealth mode Undetected Browser mode
BrowserUse [117]
Mixed
Both
Stealth mode
ChatGPT Agent [79]
Proprietary
Cloud
Undocumented
Skyvern [105]
Proprietary
Cloud
Stealth mode
Browser
Automation Framework
Browser version
Agent version
Chrome
Playwright
144.0.7559.96
2026.2.2-3
Chrome
Extension
144.0.7559.96
1.0.40
Chromium
Playwright
145.0.7632.6
0.8.0
Playwright
†
0.11.{5, 6, 9}
Undocumented
141.0.7390.122
*
Playwright
[143.0.3650.139 144.0.3719.92]
1.0.10
Chrome Chromium Chrome Chromium Edge
† The list of minor versions of BrowserUse is: Google Chrome 144.0.7559.{0, 59, 60, 61, 96, 97, 98, 109, 110} and Chromium 145.0.7632.6. * We did not find the version number, so we instead report the experiment dates: 01-28-2026, 02-08-2026, and 02-09-2026.
Gemini [45], and Perplexity [1], since our experiments showed they typically retrieve content via simplified HTTP requests, similar to cURL. As a result, they do not execute client-side scripts or perform user-like actions, making them trivial to detect or block. We instructed the Web Agents to visit our honeysites several times, which let us collect multiple fingerprints per Web Agent and analyze their stability. We followed official documentation and used the default configurations. Although commercial Web Agents do not publicly document their anti-detection techniques, we identified stealth mechanisms in all open-source solutions. Moreover, Crawl4AI and BrowserUse advertise bot-detection bypassing capabilities in their official documentation, further motivating the need to characterize LLM-based bot features. Consequently, when antidetection mechanisms are available, we repeated the experiment
with the anti-detection mode enabled. Each visit is driven by predefined, structured prompts provided in Appendix F, inspired by prior work on evaluating LLM-based browsing behavior [26, 67]. Normal prompts instruct the agent to visit the targeted honeysite, interact with the webpage, and return a structured response containing the task status and the dynamic page_id. In addition, we use a special prompt variant instructing the agent to modify its behavior when blocked to evaluate whether the agent is capable of bypassing anti-bot mechanisms. For cloud-based Web Agents, we manually monitored the tasks as they did not expose an API suitable for our automation pipeline. For locally deployed agents, we used their APIs to automate the experiments on our machines. Since Crawl4AI is designed primarily
Conference’17, July 2017, Washington, DC, USA
for web crawling rather than task-oriented interactions, we monitored experiments using a simplified version of the normal prompt, asking it only to fetch the page_id displayed on the page.
3.3
Fayolle et al.
A-Score measures the overall discriminative power of an attribute 𝐴 by aggregating the contributions of all its observed values: 𝐴-𝑆𝑐𝑜𝑟𝑒 (𝐴, 𝑡) =
Data Processing and Metrics
After data collection, we map individual visits with all collected data (i.e., network packets, nginx access logs, and browser fingerprints). Then, we analyze each layer using dedicated metrics to assess the attributes discriminative power and answer RQ2 and RQ3. 3.3.1 Fingerprint Layer Association. Because our data is collected asynchronously across multiple layers using disparate tools, we developed a multi-step linking process to correlate visits with their respective fingerprints. First, we link each visit to its browser fingerprint using the page_id. Second, we associate browser fingerprints with nginx access logs using the IP address, User-Agent header, and cookie_id within a two-minute window of launching the task and fingerprint collection. Finally, we associate network packets with their corresponding nginx access logs using <source IP address, source port> tuples within a five-minute interval corresponding to the default SSL session timeout [87]. Ultimately, this process yields a unified profile for each visit that encompasses its network, and browser fingerprints. 3.3.2 Metrics. To identify discriminative characteristics, we analyze each layer and identify attributes that remain consistent within a tool category (i.e., Web Agents, scrapers, automation frameworks, humans) while differing across categories. We first clean and normalize the dataset into a unified representation where each column corresponds to a single attribute. Attributes constant across all visits are removed since they provide no discriminative value. We then evaluate attributes using probability-based metrics instead of entropy-based commonly used in fingerprinting, since it mainly quantifies attribute variability rather than capturing attribute consistency and distinctiveness within a given category. Furthermore, entropy-based metrics are biased on small datasets, as attribute values may appear highly distinctive and stable for a given category while still exhibiting low entropy due to their small size. This limitation is mitigated by the metrics described below. Intra-tool Value Probability is the probability that the attribute 𝐴 takes the value 𝑣 in fingerprints of the tool 𝑡: 𝐼𝑛𝑡𝑟𝑎(𝐴, 𝑣, 𝑡) = 𝑃 (𝐴 = 𝑣 | 𝑡) When 𝐼𝑛𝑡𝑟𝑎(𝐴, 𝑣, 𝑡) is close to 1, the value 𝑣 is consistently observed for the attribute 𝐴, whereas low values indicate that 𝑣 is rare or inconsistent. Inter-tool Value Exclusivity measures how distinctive a value 𝑣 of attribute 𝐴 is for tool 𝑡, by considering its occurrences in fingerprints generated by other tools (𝑡 ′ ≠ 𝑡): 𝐼𝑛𝑡𝑒𝑟 (𝐴, 𝑣, 𝑡) = 1 − 𝑃 (𝐴 = 𝑣 | 𝑡 ′ ≠ 𝑡) When 𝐼𝑛𝑡𝑒𝑟 (𝐴, 𝑣, 𝑡) is close to 1, the value 𝑣 is rare across other tools and therefore highly specific to tool 𝑡. Conversely, lower values indicate that 𝑣 is commonly observed in other tools. V-score combines the two previous metrics and quantifies how strongly a value 𝑣 of attribute 𝐴 characterizes tool 𝑡: 𝑉 -𝑆𝑐𝑜𝑟𝑒 (𝐴, 𝑣, 𝑡) = 𝐼𝑛𝑡𝑟𝑎(𝐴, 𝑣, 𝑡) × 𝐼𝑛𝑡𝑒𝑟 (𝐴, 𝑣, 𝑡)
∑︁
𝑉 -𝑆𝑐𝑜𝑟𝑒 (𝐴, 𝑣, 𝑡)
𝑣 ∈𝑉 𝑎𝑙𝑠 (𝐴,𝑡 )
A high 𝐴-𝑆𝑐𝑜𝑟𝑒 (𝐴, 𝑡) indicates that attribute 𝐴 consistently exhibits one or more values that are both stable and exclusive for tool 𝑡.
4
Dataset
We generated traffic to our honeysites between January 28 and February 24, 2026, and collected the associated fingerprinting data. Out of the 1,449 initiated active visits, further detailed in Appendix D, some had to be excluded from the final dataset due to anti-bot mechanisms or technical errors. Cloudflare blocked visits before reaching our servers for BrowserUse (40), HTTP-based scrapers (20), and Puppeteer (1). In addition, OpenClaw generated three timeouts while trying to access the honeysites. After excluding failed visits, we successfully associated 1,385 visits with their corresponding nginx access logs and browser fingerprints. When associating visits with TLS packets, two visits could not be matched with any TLS packets as their IPs were not found in our captures and were thus excluded. Finally, our active visits dataset contains 1,383 visits associated with 1,383 browser fingerprints and 1,358 TLS Client Hello records. The difference arises because multiple visits may share the same TLS session, and thus the same Client Hello.
5
Evaluating anti-bot mechanisms
To answer RQ1, we evaluate the success of various tools in bypassing different anti-bot mechanisms described in § 3.1.1. Table 3 summarizes the results of our evaluation across multiple tools, models, and anti-bot mechanisms. We also assess whether combining multiple defenses (A and B) is more effective than deploying them individually, due to their multi-layered approach. Overall, the effectiveness of anti-bot mechanisms varies significantly across tools and models. OpenClaw and Claude for Chrome, using the Sonnet 4.5 model, reliably bypass all protections. In contrast, using a less capable model, Claude for Chrome with Opus 4.5, successfully identified the correct interaction area of the Prosopo CAPTCHA but failed to execute the required click action. Combining multiple defense mechanisms appears effective in blocking the majority of the automated tools. However, accumulating multiple CAPTCHA challenges may significantly degrade usability for legitimate users. The use of special prompts (see Appendix F) did not improve the overall success rate of the tests. HTTP-based scrapers. Only scrapy was blocked by the robots.txt and User-Agent filtering rules. This behavior results from scrapy’s default configuration through the ROBOTSTXT_OBEY = True setting, which enforces robots.txt compliance. Since our file explicitly restricted access, scrapy respected these rules and stopped crawling. The other HTTP-based scrapers did not request the robots.txt file before crawling, and were neither explicitly restricted User-Agent filtering rules. Hence, such defenses rely primarily on scraper goodwill and are therefore unlikely to be effective against malicious actors in real-world scenarios.
On the Internet, Nobody Knows You’re an LLM Bot
Conference’17, July 2017, Washington, DC, USA
Table 3: Bot access to honeysites under different bot defense mechanisms. Tool
Model
Infra.
ND
RT
UA
rV3
Pro
Anubis
TS
CF
A
B
Humans cURL wget scrapy Selenium Playwright Puppeteer OpenClaw OpenClaw Claude Chrome Claude Chrome Crawl4AI Crawl4AI Stealth Crawl4AI Undetected BrowserUse BrowserUse BrowserUse BrowserUse BrowserUse Stealth BrowserUse Stealth ChatGPT Agent Skyvern Skyvern
– – – – – – – sonnet-4.5 opus-4.5 sonnet-4.5 opus-4.5 gpt-4o-mini gpt-4o-mini gpt-4o-mini bu-1-0 sonnet-4.5 bu-2-0 sonnet-4.5 bu-1-0 sonnet-4.5 CUA Opti. gpt-5.2
– L L L L L L L L L L L L L L L C C C C C C C
✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓
✓ ✓ ✓ ✗ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓
✓ ✓ ✓ ✗ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓
✓ ✗ ✗ ✗ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✗ ✗ ✓ ✓ ✓ ✓ ✗ ✗ ✓ ✗ ✗
✓ ✗ ✗ ✗ ✗ ✗ ✗ ✓ ✓ ✓ ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✓ ● ●
✓ ✗ ✗ ✗ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓
✓ ✗ ✗ ✗ ✗ ✗ ✗ ✓ ✓ ✓ ✓ ✓ ✗ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✗ ✓ ✓
✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✗ ✓ ✓ ✓ ✓ ✓ ✓ ✗ ✗ ✓ ✓ ✓
✓ ✗ ✗ ✗ ✗ ✗ ✗ ✓ ✓ ✓ ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✓ ✗ ✗
✓ ✗ ✗ ✗ ✗ ✗ ✗ ✓ ✓ ✓ ✓ ✗ ✗ ✓ ✓ ✓ ✗ ✓ ✗ ✗ ✗ ✓ ✓
Colors matching: HTTP-based scrapers
Browser automation frameworks
Web Agents local
Web Agents cloud
ND: No Defense RT: robots.txt UA: User-Agent filtering rV3: reCAPTCHA v3 Pro: Prosopo CAPTCHA v3.5 & v3.6 Anubis: Anubis v1.20.0-pre1 A: RT + UA + Pro + Anubis B: RT + UA + TS + CF ✓Success ✗Blocked ●Timeout Infra.: Infrastructure L: Local Browser C: Cloud Browser Results were obtained using either a normal prompt or, when the normal prompt failed, a special prompt.
As expected, HTTP-based bots were successfully blocked by Anubis’ proof-of-work, which requires JavaScript to solve hashbased challenges. Additionally, we observed that Anubis inspects the User-Agent string prior to issuing the challenge, which likely contributed to the blocking since the scrapers used default, identifiable User-Agent values. On the contrary, Cloudflare BFM did not block HTTP-based bots. After carefully reviewing the logs, we found that it is correctly installed and running, but only blocks traffic coming from known datacenters. As our tests were conducted from university IP addresses, we believe their reputation was high enough to not trigger anti-bot mechanisms despite clearly advertising automation-related User-Agents. Browser automation frameworks. Automation frameworks successfully passed threshold-based reCAPTCHA v3, due to using configurations similar enough to those of genuine browsers. However, automation scripts must account for each anti-bot mechanism in their various versions and will fail on unexpected behaviors. For instance, when Prosopo CAPTCHA or Cloudflare Turnstile flagged the visits and presented a challenge, browser automation frameworks were unequipped to go through. Web Agents. The main observations for Web Agents are twofold: (i) a small number of agents successfully bypass all evaluated defenses, while (ii) agents advertising stealth or anti-detection capabilities do not necessarily achieve better results and may even become easier to detect. OpenClaw and Claude Chrome using the sonnet-4.5 model are the only evaluated tools that successfully bypass all tested defenses. In particular, both tools successfully solved the Prosopo CAPTCHA, which proved effective against most other agents because solving the challenge requires not only reasoning about the task, but also reliable interacting with the verification mechanism. Indeed, these tools and ChatGPT Agent were able to solve the challenge
TS: Turnstile
CF: BFM & Block AI Bots
by directly interacting with the verification button without requiring additional scripting or repeated prompting. However, ChatGPT Agent was still blocked by Turnstile, likely due to specific HTTP header characteristics that prevented rapid verification and left the page indefinitely in a verification state. Although Turnstile did not explicitly deny access, the prolonged verification delay caused the agent either to abandon the navigation attempt or to exhibit alternative bypass behaviors, as described in Appendix G. Several agents also provide stealth or anti-detection configurations, but these mechanisms did not consistently improve bypass capabilities and sometimes increased detectability instead. In contrast to OpenClaw and Claude Chrome, stealth-enabled variants of Crawl4AI and BrowserUse remained detectable by multiple protections. Enabling stealth mode made both tools more suspicious to frictionless CAPTCHA systems. For Crawl4AI, we observed substantial variations in HTTP headers that were absent during nonstealth executions. Since the stealth implementation is derived from Playwright, a framework already heavily targeted by anti-bot mechanisms, this increased detection rate is not entirely surprising. In stealth mode, additional browser-configuration overrides, such as magic, simulate_user and override_navigator, modify native browser properties and may unintentionally increase fingerprint inconsistencies, including against Turnstile. For BrowserUse-Stealth mode, on its own cloud infrastructure to function properly in this mode, resulting in traffic originating from blacklisted addresses by Cloudflare and Google. We give more details on attributes and values that may flag bots in the following section.
6
Characterizing Bots
To answer RQ2 and RQ3, we analyze the fingerprinting characteristics of different bots interacting with our honeysite. Our analysis focuses on three main layers of the connection stack, ordered by
Conference’17, July 2017, Washington, DC, USA
Fayolle et al.
Table 4: IP-layer characteristics per tool. Tool
#ASN
IP Hosting
IP Abuser
Humans and Local Tools Human HTTP-based Scrapers* Browser Automation Framework BrowserUse Other local Web Agents
1 1 1 1 1
0.00 0.00 || 0.25 0.00 0.00 0.00
0.00 0.00 || 0.25 0.00 0.00 0.00
Cloud Web Agents BrowserUse BrowserUse-Stealth ChatGPT Agent Skyvern
35 3 1 34
0.02 0.98 0.88 0.01
0.02 0.98 0.14 0.00
#ASN: number of distinct Autonomous Systems observed for a given tool. IP Hosting: proportion of IPs identified as hosting/datacenter infrastructure. IP Abuser: proportion of IPs flagged by the IPLocate [55] IP reputation service as abusive or suspicious. * Variations are mainly caused by Cloudflare anti-bot mechanisms acting as a proxy. For tools without a browser context, the observed IP address corresponds to Cloudflare infrastructure because these tools cannot persist the cf_clearance cookie [20] required to pass Cloudflare challenges, causing the server to observe traffic generated by Cloudflare instead of traffic from the tools.
how quickly they can be accessed: the IP layer, the TLS fingerprinting layer, and finally the browser fingerprinting layer. We then evaluate the effectiveness of combining these layers for bot detection and characterization.
6.1
IP Layer
The IP layer provides the first signals for bot detection and characterization. Although IP reputation labels and hosting classifications may vary across providers and over time, the relative differences between tools remained consistent throughout our measurements. We leverage the IPLocate [55] IP reputation service for labeling our dataset. Results for this layer are shown in Table 4. While results presented in Table 4 follow our expectations, they also illustrate specific deployment decisions and anti-bot evasion practices. First, local-based tools leverage the user’s IP address, taking advantage from its already good reputation and relevant location. Second, cloud-based Web Agents can opt for two routing options. They directly connect from datacenters, e.g., ChatGPT Agent always visited our honeysites from the Cloudflare infrastructure located in the European Union. These IP addresses are already flagged and may increase bot detection rates. Alternatively, we observe connections coming from numerous ASNs with high quality IP addresses, which corresponds to US-based residential proxies advertised by BrowserUse 1 and Skyvern. Although well-established datacenter IP addresses remain a significant signal, this behavior effectively reduces the relevance of IP addresses alone [72] and further motivates our analyzes of upper network layers.
6.2
TLS Layer
The TLS Client Hello packet is one of the earliest fingerprintable elements visible after the IP layer during HTTPS exchanges. According to Salesforce’s original JA3/JA4 publication [97], TLS 1 More surprisingly, BrowserUse-Stealth mode avoids their residential proxy infrastruc-
ture and directly connects from low-reputation datacenter IP addresses. It is unclear wether this is due to a deployment misconfiguration or intended, as it increases bot detection.
Table 5: Dominant JA4 and discriminative power per tool. Tool (& Browser Version)
JA4 Index
Intra.
V.
A.
Humans (Local) Firefox 136.0 Firefox 147.0.1 Chrome 144.0.7559.96
5†, 6†, 16 7, 8 1, 3, 11
0.60 0.50 0.45
0.60 0.50 0.38
0.99 0.99 0.82
HTTP-based Scrapers (Local) cURL 8.15.0-DEV wget 1.21.4 scrapy 2.14.1
9, 20 9, 21† 19†
0.75 0.75 1.00
0.75 0.75 1.00
1.00 1.00 1.00
Browser Automation (Local) Selenium (Firefox 147.0.2) Selenium (Chrome 144.0.7559.96) Playwright (Firefox 146.0) Playwright (Chromium 145.0.7632.6) Puppeteer (Firefox 147.0.3) Puppeteer (Chromium 145.0.7632.46)
7, 16, 17 1, 3, 11 7, 8, 16 1, 3, 11 7, 8, 16, 17 2†, 4†, 14†, 15†
0.78 0.48 0.72 0.48 0.71 0.46
0.78 0.40 0.70 0.40 0.69 0.46
0.99 0.83 0.97 0.83 0.97 1.00
Web Agents (Local) OpenClaw (Chrome 144.0.7559.96) OpenClaw (python-request) Claude (Chrome 144.0.7559.96) Crawl4AI (Chromium 145.0.7632.6) Crawl4AI-Stealth Crawl4AI-Undetected-Browser BrowserUse (Chrome 144)
1, 3 20 1, 3, 11 1, 3, 11 1, 11 1, 11 1, 3, 11
0.59 1.00 0.60 0.76 0.80 0.78 0.56
0.52 1.00 0.53 0.63 0.66 0.64 0.49
0.86 1.00 0.86 0.82 0.83 0.82 0.85
Web Agents (Cloud) BrowserUse BrowserUse-Stealth ChatGPT (Chromium 141) Skyvern (Edge 143 & 144)
10†, 12 10†, 12 18† 11, 13†
0.98 0.98 1.00 0.52
0.89 0.88 1.00 0.45
0.91 0.90 1.00 0.93
Bold: dominant JA4 fingerprint. †: unique to the tool. Intra.: proportion of fingerprint with the dominant JA4. V.: discriminative dominant JA4 V-Score (Intra-Score × Inter-Score). A.: discriminative A-score (sum of V-Score for all JA4 of the tool). Mapping between JA4 index and JA4 hash and its distribution are provided in Appendix H.
fingerprints such as JA4 are generally more stable than IP-based identifiers because they reflect the client TLS implementation rather than network location. Compared to browser-based fingerprinting, this enables lightweight early-stage bot detection before higherlayer protocol interactions occur. In this study, we leverage JA4 fingerprints [3, 41] to characterize the TLS behavior of each tool and evaluate the stability and distinctiveness of these fingerprints across configurations and repeated executions. In practice, we find 21 unique JA4 fingerprints. For brevity, Table 5 summarizes the corresponding indexes of each observed JA4 values, the dominant JA4 value in bold (i.e., the most frequently observed fingerprint), its uniqueness (marked with †), its Intra-tool Value Probability or Intra-Score (i.e., the proportion of connections exhibiting this dominant JA4 for the considered tool), its V-Score, and the A-Score. A V-Score close to 1 indicates that a tool is associated with a highly distinctive dominant JA4, whereas a score close to 0 reflects low distinctiveness. An A-Score close to 1 indicates that the JA4 of a tool are both stable and unique across observations, while a score close to 0 suggests that the tool cannot be reliably distinguished based on its fingerprints alone. The complete mapping between the 21 JA4 indexes, their respective JA4 hashes, and detailed distributions are provided in Appendix H. Multiple factors influence JA4 fingerprint variability. Observed JA4 values are primarily influenced by the underlying client’s
On the Internet, Nobody Knows You’re an LLM Bot
TLS implementation, such as NSS for Firefox [39] or BoringSSL for Chromium-based browsers [12]. For instance, the JA4 fingerprints observed between Firefox 136 and Firefox 147.0.1 differ only by the presence of the compress_certificate extension [42], likely due to NSS version updates [32, 128]. It may also stem from browserlevel configuration or user preferences [15, 109]. Moreover, a single tool may exhibit multiple JA4 values depending on the transport protocol or TLS session state. For example, when possible, some tools may use QUIC instead of TCP to accelerate connection establishment, resulting in distinct JA4 fingerprints. Finally, not all observed TLS extensions may be standardized yet or publicly documented. Some experimental extensions contribution to the JA4 fingerprint may be absent from IANA registries, RFC specifications, and thus tshark dissectors used for this study. We observe a few specific behaviors in our dataset. For instance, ChatGPT Agent only establishes TCP connections and advertises 28 cipher suites, which is more than most evaluated tools, while exposing only 12 TLS extensions, fewer than most others. This behavior suggests a design choice favoring broad compatibility with websites relying on older or heterogeneous TLS configurations. A similar strategy can be observed for HTTP-based scrapers, which generally rely exclusively on TCP connections, advertise many cipher suites, and expose relatively few extensions, likely to maximize compatibility across a wide range of target websites. On the opposite, Crawl4AI exhibits two dominant JA4 values: one associated with QUIC connections and another with TCP connections. Similarly, the presence of the pre_shared_key (PSK) extension [50], used for TLS session resumption, may generate different JA4 values depending on whether a session is resumed or newly established. This behavior is observed for Skyvern, which presents two dominant JA4 fingerprints: one with the PSK extension and one without.
Cloud-based tools and HTTP-based scrapers are more distinguishable from humans than local-based tools. According to the 𝐼𝑛𝑡𝑟𝑎- and 𝐴-𝑆𝑐𝑜𝑟𝑒𝑠, distinguishing individual cloudbased agents from one another is generally easier than distinguishing local-based agents from each other or from human-operated browsers. Most cloud-based agents also exhibit a dominant JA4 value unique to the corresponding tool, whereas local-based agents frequently share their dominant JA4 values with human browser configurations and generally achieve lower Intra-Scores. This behavior is expected, as cloud-based agents typically operate in tightly controlled and homogeneous environments, leading to more stable TLS fingerprints. In contrast, local-based agents inherit variability from the host browser and operating system configuration used by the human operator.
Stealth or undetected modes do not significantly reduce detectability. Neither the use of stealth prompts nor the choice of underlying model had a significant impact on the observed JA4 fingerprints. Configurations using stealth or undetected modes exhibited dominant JA4 values and A-Scores similar to those observed without such configurations, indicating that these mechanisms do not substantially alter the TLS fingerprinting surface.
Conference’17, July 2017, Washington, DC, USA
6.3
Browser Fingerprinting Layer
Browser features represent the last technical layer used for fingerprinting bots. Some values are available directly in HTTP headers (e.g., User Agent), but most are extracted after page load using JavaScript (e.g., screen resolution), and thus require a full-fledge browser. Our dataset contains 1,383 browser fingerprints, among which 13 do not include JavaScript-extracted attributes because it was not enabled. Overall, automated tools exhibit high 𝐴-𝑆𝑐𝑜𝑟𝑒𝑠 for specific attributes, indicating stable and distinctive configurations. We provide further details in Table 11 of Appendix I for completeness. In the following, we discuss broad groups of attributes which are both consistent and discriminative across tools. User Agent. While local tools such as Claude and OpenClaw expose the underlying local browser versions, cloud-based Web Agents exhibit distinctive patterns. For example, Skyvern is the only tool using Microsoft Edge, whereas ChatGPT Agent exposes a unique Chrome version and platform combination. In contrast, BrowserUse cloud and stealth modes reveal multiple User Agent values, reflecting the diversity of their cloud environments. As one of the most discriminative attributes in our dataset, User Agent is also easily modified by bots. However, we can compare possibly altered HTTP header values with the more stable userAgentData JavaScript API [76] to detect spoofing, which is an additional identifying signal. Using this method, we found that Crawl4AI attempts to spoof its HTTP User Agent, replacing its actual version with a default, older value [25]. Screen and display. These attributes, including width and height, differ significantly across tools. While some Web Agents like Crawl4AI or BrowserUse allow manual configuration, other cloud-based tools only offer immutable environments with identifiable default values. For example, ChatGPT Agent is configured with a fixed screen resolution of 1280 × 960, having a 𝑉 -𝑆𝑐𝑜𝑟𝑒 of 1, which means that it is the only tool exhibiting this resolution in our dataset. Permissions state. We observed notable discrepancies in permission states (e.g., access to sensors or notifications) across tools. This attribute achieves high 𝐴-𝑆𝑐𝑜𝑟𝑒𝑠 (> 0.70) for all studied tools, indicating strong discriminative power. For instance, the majority of permission queries through the API navigator.permissions.query fail for Crawl4AI and ChatGPT Agent, which may indicate that many browser capabilities are unavailable. In contrast, BrowserUse consistently returns a denied state for most permission queries, indicating a more restrictive behavior by default compared to Skyvern and Claude, which more closely aligns with what we observe for our human-based visits. These differences reflect how each tool initializes and configures the browser context, and often remain stable across executions. Cookie management. Handling cookies is influenced by the tools’ designs. For instance, extensions like Claude can inherit cookies from the user’s browser. Likewise, ChatGPT Agent, Skyvern, and OpenClaw share cookies across multiple sessions to use a continuous user identity. On the contrary, Crawl4AI and BrowserUse use fresh browsing sessions, unless explicitly configured.
Conference’17, July 2017, Washington, DC, USA
Number of CPU cores. Although local tools report a stable configuration of 8 CPU cores, corresponding to the authors’ architecture, we obtained high 𝐴-𝑆𝑐𝑜𝑟𝑒 values for cloud-based Web Agents. Indeed, these consistently expose distinctive values. For instance, Skyvern reports 32 CPU cores and ChatGPT Agent 13 CPU cores, while BrowserUse cloud infrastructure exhibits high variability, with the number of reported CPU cores ranging from 2 to 64. While it only reflects the number of logical cores exposed by virtualized environments, it remains a strong signal. Stealth behavior. In line with the degraded evasion capacity presented in § 5, we found that "stealth" configurations can introduce detectable inconsistencies in browser fingerprints. For example, Crawl4AI stealth mode modifies the User Agent and injects synthetic referer values pointing to external websites. These changes create atypical attribute combinations rarely observed in genuine human browsing, making them discriminative signals. Tool-specific attributes. Some tools expose specific signals that uniquely characterize them. For instance, Crawl4AI stealth mode reports the string "default" for the notifications permission, which is not a standard permission state. More legitimately yet easily fingerprintable, ChatGPT Agent advertises its identity using two HTTP headers, signature and signature-agent [9]. Overall, ChatGPT Agent and Skyvern are the easiest tools to distinguish. They rely on fixed execution environments, resulting in highly stable attributes that are not observed in other tools. Moreover, standard automation frameworks including Selenium, Playwright, and Puppeteer remain consistently detectable, primarily due to well-known signals, e.g., navigator.webdriver. While this alone is sufficient to identify automated behavior, additional attributes such as screen dimensions further differentiate these tools from each other, reflecting differences in their default configurations. In contrast, tools implementing stealth mechanisms such as Crawl4AI and BrowserUse exhibit more diverse fingerprints, but this introduces numerous inconsistencies that remain sufficiently stable to act as discriminative signals.
7
Multi-Layer Bots Classification
In the previous section, we showed that each fingerprinting layer exposes specific features that characterize different bots. We now investigate whether individual layers provide sufficient information to reliably identify Web Agents, and whether combining multiple layers further improves classification performance. To this end, we formulate this task as a multi-class classification problem.
7.1
Multi-Layer Classification Setup
We used three classification algorithms to predict the bot category from its collected fingerprints. We considered a baseline Random Forest and two gradient-boosting classifiers based on decision trees, XGBoost [129] and CatBoostClassifier [13] following related work [57, 127]. Due to the lack of JavaScript execution environment and low number of samples, we excluded HTTP-based scrapers from the dataset resulting in 1370 fingerprints. Each of them contains attributes extracted from IP, TLS, and browser layers (see Appendix C). During dataset preprocessing, categorical features were one-hot
Fayolle et al.
encoded [99] for Random Forest and XGBoost, whereas CatBoostClassifier automatically handled categorical features without requiring explicit encoding [13]. We used a 80/20 train-test split, and applied SMOTE [100] resampling on the training set to mitigate class imbalance. Finally, we trained classifiers on each fingerprinting layer individually (IP, TLS, and browser fingerprinting), on the combined IP+TLS layers, and on the aggregation of all layers. To improve robustness, we ran this pipeline with a new random seed 10 times.
7.2
Multi-Layer Classification Evaluation
We evaluated our classifiers using Accuracy, Precision, Recall, and 𝐹 1 -scores. Since all three classification algorithms achieved comparable performance across the different fingerprinting layers, we report only the results obtained using Random Forest classifier averaged across all random seeds for the remainder of this paper. Table 6 summarizes the classification performance. We also assess per-class performance using confusion matrices provided in Figure 2. Table 6: Classification Evaluation using Random Forest. Layers
Accuracy
Precision
Recall
𝐹1
IP TLS Browser Fingerprinting IP + TLS All Layers
0.596 0.454 0.931 0.806 0.993
0.617 0.491 0.931 0.835 0.993
0.596 0.454 0.931 0.806 0.993
0.540 0.415 0.931 0.791 0.993
IP Layer. Using IP features (IP address and ASN provider), classification achieved an accuracy of 0.596 and an 𝐹 1 -score of 0.540, indicating that network-level information alone provides limited discriminative power for identifying Web Agents. Cloud-based Web Agents were more accurately classified, as shown in the IP-layer confusion matrix in Figure 2, which is consistent with observations in § 6.1. In contrast, local-based Web Agents overlap in their network infrastructure because they were executed within same local environments, leading to misclassifications. In fact, IP layer attributes characterize the underlying network rather than the Web Agent itself, which means that local tools operating on the same network are expected to remain misclassified using IP information alone, even at larger scales. TLS Layer. Classification achieved an accuracy of 0.454 and an 𝐹 1 -score of 0.415 using only JA4 fingerprints. As discussed in § 6.2, local-based Web Agents share similar TLS characteristics, leading to overlap between them. Even if JA4 achieved high 𝐴-𝑆𝑐𝑜𝑟𝑒𝑠, this only indicates that TLS fingerprints contain useful discriminative information and does not imply that JA4 values alone are sufficient to uniquely identify all Web Agents. In contrast, cloud-based Web Agents exhibited more distinguishable TLS information. For example, ChatGPT Agent was perfectly classified using only its JA4 fingerprint. Similarly, BrowserUse in cloud and stealth modes exhibited the same TLS characteristics, which is expected since both rely on the same cloud infrastructure.
On the Internet, Nobody Knows You’re an LLM Bot
Conference’17, July 2017, Washington, DC, USA
IP
TLS
Browser Fingerprinting
Human Selenium Playwright Puppeteer OpenClaw
True
Claude Chrome Crawl4AI
Crawl4AI Stealth Crawl4AI Undetected Browser BrowserUse Local BrowserUse Cloud BrowserUse Stealth ChatGPT Agent
Skyvern
ChatGPT Agent
BrowserUse Cloud
Predicted
BrowserUse Stealth
Crawl4AI
Crawl4AI Stealth Crawl4AI Undetected Browser BrowserUse Local
OpenClaw
Claude Chrome
Puppeteer
Playwright
Human
Selenium
Skyvern
ChatGPT Agent
BrowserUse Cloud
Predicted IP + TLS
BrowserUse Stealth
Crawl4AI
Crawl4AI Stealth Crawl4AI Undetected Browser BrowserUse Local
OpenClaw
Claude Chrome
Puppeteer
Playwright
Human
Selenium
Skyvern
ChatGPT Agent
BrowserUse Cloud
Predicted
BrowserUse Stealth
Crawl4AI
Crawl4AI Stealth Crawl4AI Undetected Browser BrowserUse Local
OpenClaw
Claude Chrome
Puppeteer
Playwright
Human
Selenium
Skyvern
IP + TLS + Browser Fingerprinting
Human Selenium Playwright Puppeteer OpenClaw
True
Claude Chrome Crawl4AI
Crawl4AI Stealth Crawl4AI Undetected Browser BrowserUse Local BrowserUse Cloud BrowserUse Stealth ChatGPT Agent
Skyvern
ChatGPT Agent
BrowserUse Cloud
Predicted
BrowserUse Stealth
Crawl4AI Stealth Crawl4AI Undetected Browser BrowserUse Local
Crawl4AI
Claude Chrome
OpenClaw
Puppeteer
Playwright
Human
Selenium
Skyvern
ChatGPT Agent
BrowserUse Stealth
Predicted
BrowserUse Cloud
Crawl4AI Stealth Crawl4AI Undetected Browser BrowserUse Local
Crawl4AI
OpenClaw
Claude Chrome
Puppeteer
Playwright
Human
Selenium
Skyvern
Figure 2: Confusion matrices obtained on IP, TLS and browser fingerprinting layers separately, then on the aggregated layers (IP + TLS and IP + TLS + browser) for the Random Forest classifier. A value of 1.00 means perfect classification for a tool. Browser Fingerprinting Layer. Classification using browser fingerprinting features achieved an accuracy and 𝐹 1 -score of 0.931. As shown in Figure 2, almost all Web Agents were perfectly classified. These results show that the browser fingerprinting layer provides highly discriminative information, enough to identify most Web Agents and browser automation frameworks. The only confusion appears between BrowserUse in cloud and stealth modes. Although stealth mode should be designed to hide automation signals, we found no notable differences between the two modes, likely because both rely on similar cloud infrastructure.
Combined Layers. Combining IP and TLS layers increased classification to achieve an accuracy of 0.806 and an 𝐹 1 -score of 0.791. As shown in Figure 2, cloud-based Web Agents are perfectly classified, while local-based tools still overlap due to similarities in IP and TLS attributes. Finally, aggregating all fingerprinting layers achieved near perfect classification for all classes. These results show that combining different fingerprinting layers provides sufficient
discriminative features to reliably identify Web Agents, browser automation frameworks, and human traffic within our dataset.
8
Limitations and Discussion
In this section, we discuss the main limitations of our study, particularly the exhaustiveness of the evaluated variables and the rapidly evolving nature of web automation tools and defenses. Exhaustiveness and generalization. Our work is mainly limited by the scope of the evaluated variables. The ecosystem of web automation tools evolves rapidly [7, 34, 81, 82], with new frameworks, capabilities, and anti-bot mechanisms continuously emerging [68, 111]. We therefore focused on a representative set of widely used and relevant proprietary and open-source solutions at the time of writing. While we thoroughly described our methodology as well as published our source code (§ 10) and prompts (§ F), it is possible that other or future Web Agents behave differently. From a fingerprinting perspective, we concentrated on three commonly used detection layers to validate our extraction model.
Conference’17, July 2017, Washington, DC, USA
Additional signals such as canvas [63], CPU [96], GPU [62], or behavioral fingerprinting [127] could reveal further discriminative features, but exploring them remains future work. Likewise, we tested two off-the-self, largely deployed CAPTCHA solutions using their default parameters. While other types of puzzle exist [61], we preferred to study a broad range of anti-bot mechanisms focusing on technical features rather than behavior. They are easily updated and as shown with under-performing stealth modes, it is currently difficult to fully spoof a cross-layer fingerprint. One of our goals is to determine how modern Web Agents can be differentiated from other automation-related tools deployed on a given user machine. To this end, we consider our setup, two Linuxbased machines deployed across four locations using Chrome and Firefox, robust enough. However, the results may not generalize to other browsers, operating systems, or hardware configurations. Despite these limitations, our study provides a replicable empirical baseline for characterizing modern Web Agents across multiple fingerprinting and defense layers.
Cat-and-mouse game. Fingerprinting research has shown that even subtle signals can reliably identify bots [64], which is reflected in our experiments where all evaluated tools were detectable. However, bot detection remains part of an ongoing cat-and-mouse dynamic. Although all tested tools were identifiable at the time of writing, they were not all blocked. Additionally, as they evolve rapidly, they may adapt to bypass current and future defenses. During our four-month evaluation period, including one month of active testing, several tools already exhibited noticeable behavioral and implementation changes. Beyond technical evolutions, economic factors may still differentiate traditional scrapers from Web Agents. While Web Agents are harder to detect, they are also more expensive to operate because they rely on advanced models and deploy full-fledged browsers to bypass computationally intensive defenses, e.g., proof-of-work. These costs currently restrict largescale deployment to well-resourced actors, although this gap will likely narrow as Web Agents become cheaper and more capable. As demonstrated in our paper, the current umbrella definition of what constitutes a bot and the associated defense mechanisms do not take into account the new usages of Web Agents. Some web administrators may want to let Web Agents go through, as their behavior can be legitimate (e.g., to book a train ticket), while simultaneously restricting access for other bots. In any case, the defense solutions we test in this study do not block all the tested tools in their default configuration as several modern models successfully bypassed all anti-bot mechanisms, including state-of-the-art CAPTCHAs. They need to be complemented by some additional fingerprinting we propose here to protect users against unwanted agents. While Web Agents evasion techniques will co-evolve with defense mechanisms better prepared to detect their signatures, this calls for further reflection on the role of legitimate automation on the Web. Hence, future defenses may increasingly rely on cryptographic attestation (e.g., WebBotAuth [73]), resource-wasting traps (e.g., AI Labyrinth [111]), and hardware-backed trust signals such as Private Access Tokens [110] and Private State Tokens [71].
Fayolle et al.
9
Related Work
Bot detection and mitigation raised significant concerns for companies [14] and website administrators [30], even before the rise of LLM-based bots and Web Agents.
Fingerprinting-based bot detection. A large body of work focuses on how fingerprinting can detect malicious or evasive bots. For instance, Venugopalan et al. [125] studied whether modified browser fingerprints help bots evade detection. They showed that evasive bots often introduce spatial or temporal inconsistencies across fingerprint attributes. More recently, Jarad et al. [57] demonstrated that JA4 TLS fingerprinting [41], combined with gradientboosted models, achieves strong detection performance and remains resilient to IP rotation. Nevertheless, we show that TLS-only approaches provide limited protection against full browser automation stacks that reproduce realistic network and browser signatures. Li et al. [66] presented a cross-layer fingerprinting approach, combining browser fingerprinting using FingerprintJS [38] with TLS fingerprinting through FPTLS [65]. FP-Scanner [122], initially proposed by Vastel et al. [123], has recently evolved to address LLM-based bots. However, it does not consider TLS fingerprinting or multi-layer detection strategies, and most evaluations predate modern Web Agents. More closely related to our approach, Wang et al. [127] evaluates browser fingerprinting (FingerprintJS [38]) and behavioral analysis for detecting Web Agents, including ChatGPT Agent, BrowserUse (in a local setting), Claude, and Skyvern. Their results suggest that behavioral analysis provides stronger signals than browser fingerprinting alone. In contrast, our work provides a more detailed study of browser-level fingerprinting, evaluates stealth configurations, considers a broader range of defenses, and explicitly distinguishes traditional bots from modern Web Agents.
Bot protection and evasion. Another line of research studies how websites protect content from unwanted crawling and how effective these defenses are. We can identify two recent trends. First, several works analyze the limitations of robots.txt and related access-control mechanisms in light of LLM-based crawlers [26, 58, 67]. For instance, Kim et al. [58] showed in a large-scale study that relying solely on robots.txt is ineffective, as some LLMbased crawlers selectively ignore restrictive directives and spoof user-agents. However, their work focuses on historically fragile protections and on crawler bots rather than modern autonomous Web Agents. Second, studies focus on challenge-based defenses like CAPTCHAs prior to LLM-based bots [48, 53, 98]. Guérar et al. [48] demonstrated that many traditional designs can be solved using modern machine learning techniques. While this motivated the emergence of behavioral and frictionless CAPTCHAs, Sateur et al. [98] highlighted privacy and accessibility concerns. To the best of our knowledge, no previous work studies both modern anti-bot mechanisms against recent Web Agents. Likewise, little is known about the effectiveness of multi-layer fingerprinting and existing anti-bot mechanisms in light of modern LLM usage, particularly regarding which protocol layers provide the strongest discriminative power.
On the Internet, Nobody Knows You’re an LLM Bot
10
Conclusion & Future Work
In this work, we evaluated the ability of bots, particularly Web Agents, to bypass a range of anti-bot mechanisms. Our results show that some agents, notably OpenClaw and Claude Chrome, successfully bypass all evaluated defenses. Overall, effective defenses should combine strong fingerprinting with challenges that require more than prompt-based reasoning. We further analyzed TLS, IP, and browser fingerprinting layers and found that every evaluated tool exposes identifiable characteristics in at least one of them. Cloud-based tools are generally the easiest to detect, primarily through JA4 fingerprints and IP reputation or providers. In contrast, locally executed tools are significantly harder to identify and rely mainly on browser fingerprinting. We also observed that stealth modes and equivalent features can even increase detectability by introducing fingerprint inconsistencies. As web traffic increasingly includes sophisticated Web Agents, anti-bot mechanisms should rely on adaptive and cross-layer detection approaches. Such approaches should combine hardware, network, browser, and behavioral fingerprinting techniques. Relying solely on a single fingerprinting method, or on the declared identity and cooperation of bots, is unlikely to remain effective. Another interesting direction for future work is the design of more advanced anti-bot mechanisms based on human intuition [68] to improve robustness against evolving LLM-based bots.
Ethics Considerations Data collection. Our experiments, including the honeypot websites, were conducted after approval from the hosting University. For passive data collection, we did not visibly advertise our websites and did not try to improve their SEO to avoid impromptu human visits. We are thus confident that the vast majority of passively collected data corresponds to bots. For active data collection, we only study our own tests, as we know that the subjects involved were bots and not human users (except for the consenting authors of this study). Web Agent behavior. We launch Web Agents only on our controlled honeysites. No Web Agent was tasked to interact with a third-party website other than the by-design CAPTCHA service proxies. First, we consider that the low volume generated by our experiments do not harm those services. Second, we manually monitored Web Agents’ behaviors and found that in some extremely rare cases, Web Agents exited our controlled environment and visited a third-party website (see Appendix G). For these cases, we verified that their behaviors were not actively harming the websites and we were ready to stop the execution if required.
Open Science The artifact accompanying this paper is available at https://anonymous. 4open.science/r/On_the_Internet_Nobody_Knows_You-re_an_LLM_ Bot_Artifacts-C7BD/README.md. This artifact contains (1) the automation scripts used for Selenium, Puppeteer, Playwright, Crawl4AI , Crawl4AI-Stealth, BrowserUse, BrowserUse-Stealth and tshark; (2) details on the collected JA4 fingerprints; (3) the core architecture of our honeysites (anonymized and excluding credentials); and (4) the final active and passive datasets,
Conference’17, July 2017, Washington, DC, USA
from which all IP addresses and other identifying information have been removed for privacy reasons. It also includes the analysis notebooks used to reproduce the results presented from § 5 to § 7, as well as additional supporting material. The fingerprinting attributes considered in our analysis are detailed in Appendix C, and the prompts used during the Web Agent experiments are provided in Appendix F. We remain available to provide additional information or clarification regarding the artifact if needed.
AI Acknowledgment The authors used generative AI tools to revise the text, improve flow and correct typos, grammatical errors, and awkward phrasing. As described in § 3, AI-based tools were used to visit the honeysites, enabling us to collect and analyze their fingerprints. AI-based tools were also used during artifact development for documentationrelated purposes. We have manually verified and are responsible for the accuracy, originality, and integrity of the output of all AIbased tools.
References [1] Perplexity AI. 2026. Perplexity. Retrieved February 19, 2026 from https://www. perplexity.ai/ [2] ai.robots.txt. 2026. Table of bot metrics. Retrieved February 18, 2026 from https: //github.com/ai-robots-txt/ai.robots.txt/blob/main/table-of-bot-metrics.md [3] John Althouse. 2023. JA4+ Network Fingerprinting. Retrieved February 19, 2026 from https://blog.foxio.io/ja4+-network-fingerprinting?ref=blog.webscout.io [4] AmIUnique. 2026. AmIUnique. Retrieved February 19, 2026 from https:// amiunique.org/ [5] Anthropic. 2025. Anthropic Claude for Chrome. Retrieved February 18, 2026 from https://claude.com/chrome [6] Anthropic. 2026. Claude. Retrieved February 19, 2026 from https://claude.ai/ [7] Anthropic. 2026. Introducing Claude Opus 4.7. Retrieved May 15, 2026 from https://www.anthropic.com/news/claude-opus-4-7 [8] Babak Amin Azad, Oleksii Starov, Pierre Laperdrix, and Nick Nikiforakis. 2020. Web Runner 2049: Evaluating Third-Party Anti-bot Services. In DIMVA (Lecture Notes in Computer Science, Vol. 12223). Springer, 135–159. [9] Annabelle Backman, Justin Richer, and Manu Sporny. 2024. HTTP Message Signatures. Request for Comments RFC 9421. Internet Engineering Task Force. doi:10.17487/RFC9421 [10] Alex Bocharov and Adam Martinetti. 2024. Advancing Threat Intelligence: JA4 fingerprints and inter-request signals. Retrieved February 19, 2026 from https://blog.cloudflare.com/ja4-signals/ [11] Alex Bocharov, Santiago Vargas, Adam Martinetti, Reid Tatoris, and Carlos Azevedo. 2024. Declare your AIndependence: block AI bots, scrapers and crawlers with a single click. Retrieved February 19, 2026 from https://blog.cloudflare.com/declaring-your-aindependence-block-ai-botsscrapers-and-crawlers-with-a-single-click/ [12] BoringSSL. 2026. BoringSSL. Retrieved May 22, 2026 from https://boringssl. googlesource.com/boringssl [13] CatBoost. 2026. CatBoost Documentation. Retrieved May 21, 2026 from https://catboost.ai/docs/ [14] Elisa Chiapponi, Onur Catakoglu, Olivier Thonnard, and Marc Dacier. 2020. HoPLA: a honeypot platform to lure attackers. In Computer & Electronics Security Applications Rendez-vous, Deceptive security Conference (C&ESAR 2020), part of European Cyber Week. Rennes, France. [15] Google Chrome. 2026. Run Chromium with command-line switches. Retrieved May 22, 2026 from https://www.chromium.org/developers/how-tos/runchromium-with-flags [16] Cloudflare. 2025. Bot Traffic Worldwide. Retrieved February 27, 2026 from https://radar.cloudflare.com/bots [17] Cloudflare. 2025. Introduction to robots.txt. Retrieved February 18, 2026 from https://www.cloudflare.com/learning/bots/what-is-robots-txt/ [18] Cloudflare. 2026. Cloudflare Bot Fight Mode. Retrieved February 19, 2026 from https://developers.cloudflare.com/bots/get-started/bot-fight-mode/ [19] Cloudflare. 2026. Cloudflare: Connect, protect, and build everywhere. Retrieved February 18, 2026 from https://www.cloudflare.com/ [20] Cloudflare. 2026. Cloudflare Doc Clearance. Retrieved May 22, 2026 from https://developers.cloudflare.com/cloudflare-challenges/concepts/clearance/
Conference’17, July 2017, Washington, DC, USA
[21] Cloudflare. 2026. Cloudflare Super Bot Fight Mode. Retrieved February 19, 2026 from https://developers.cloudflare.com/bots/get-started/super-bot-fight-mode/ [22] Cloudflare. 2026. Cloudflare Turnstile: A verification tool to replace CAPTCHAs. Retrieved February 19, 2026 from https://www.cloudflare.com/applicationservices/products/turnstile/ [23] Cloudflare. 2026. How CAPTCHAs work. Retrieved February 18, 2026 from https://www.cloudflare.com/learning/bots/how-captchas-work/ [24] Cloudflare. 2026. Usage statistics and market share of Cloudflare. Retrieved February 19, 2026 from https://w3techs.com/technologies/details/cn-cloudflare [25] Crawl4AI. 2026. Browser, Crawler & LLM Config - Crawl4AI Documentation (v0.8.x). Retrieved June 1, 2026 from https://docs.crawl4ai.com/core/browsercrawler-config/#1-browserconfig-essentials [26] Jian Cui, Mingming Zha, XiaoFeng Wang, and Xiaojing Liao. 2025. The Odyssey of robots.txt Governance: Measuring Convention Implications of Web Bots in Large Language Model Services. In CCS. ACM, 21–35. [27] cURL. -. cURL. Retrieved February 25, 2026 from https://curl.se/ [28] davepattern. 2024. DDoS from Anthropic AI. Retrieved February 18, 2026 from https://www.linode.com/community/questions/24842/ddos-fromanthropic-ai [29] Gelei Deng, Haoran Ou, Yi Liu, Jie Zhang, Tianwei Zhang, and Yang Liu. 2024. Oedipus: LLM-enchanced Reasoning CAPTCHA Solver. CoRR abs/2405.07496 (2024). [30] Drew DeVault. 2025. Please stop externalizing your costs directly into my face. Retrieved February 18, 2026 from https://drewdevault.com/2025/03/17/2025-0317-Stop-externalizing-your-costs-on-me.html [31] Cem Dilmegani. 2026. Best 30+ Open Source Web Agents in 2026. Retrieved February 18, 2026 from https://aimultiple.com/open-source-web-agents [32] djackson. 2025. Upgrade Firefox 136 to NSS 3.108. Retrieved May 06, 2026 from https://bugzilla.mozilla.org/show_bug.cgi?id=1934958 [33] Peter Eckersley. 2010. How unique is your web browser?. In International Symposium on Privacy Enhancing Technologies Symposium. Springer, 1–18. [34] Benchquill Editorial. 2026. GPT-5.5 vs Claude vs Gemini 3.1 Pro. Retrieved May 15, 2026 from https://benchquill.com/post/gpt-5-5-vs-claude-opus-4-7-vsgemini-3-pro-2026 [35] Inc. F5. 2026. F5 WAF for NGINX - Log types. Retrieved May 21, 2026 from https://docs.nginx.com/waf/logging/logs-overview/ [36] Christine Falokun. 2022. CAPTCHA Farms and Challenges of CAPTCHA Bot Detection. Retrieved May 31, 2026 from https://datadome.co/guides/captcha/ how-to-detect-captcha-farms-and-block-captcha-bots/ [37] SEO Expert Fili. 2026. AI / LLM User-Agents: Blocking Guide. Retrieved May 29, 2026 from https://robotstxt.com/ai [38] fingerprintjs. 2025. FingerprintJS: Browser Fingerprinting. Retrieved February 18, 2026 from https://github.com/fingerprintjs/fingerprintjs [39] Mozilla Firefox. 2026. Security and Networking Components. Retrieved May 22, 2026 from https://firefox-source-docs.mozilla.org/networking/sec-neckocomponents.html [40] Apache Software Foundation. 2025. Apache HTTP Server Tutorial: .htaccess files. Retrieved February 18, 2026 from https://httpd.apache.org/docs/current/ howto/htaccess.html [41] FoxIO. 2026. ja4. Retrieved February 19, 2026 from https://github.com/FoxIOLLC/ja4/tree/main# [42] Alessandro Ghedini and Victor Vasiliev. 2020. TLS Certificate Compression. RFC 8879. doi:10.17487/RFC8879 [43] GNU. 2017. wget. Retrieved February 25, 2026 from https://www.gnu.org/ software/wget/ [44] Google. 2025. Introduction to robots.txt. Retrieved February 18, 2026 from https://developers.google.com/search/docs/crawling-indexing/robots/intro [45] Google. 2026. Gemini. Retrieved February 19, 2026 from https://gemini.google. com/ [46] Google. 2026. Puppeteer. Retrieved February 19, 2026 from https://pptr.dev/ [47] Google. 2026. reCAPTCHA. Retrieved February 18, 2026 from https://developers. google.com/recaptcha/ [48] Meriem Guerar, Luca Verderame andbrowser Mauro Migliardi, Francesco Palmieri, and Alessio Merlo. 2022. Gotta CAPTCHA ’Em All: A Survey of 20 Years of the Human-or-computer Dilemma. ACM Comput. Surv. 54, 9 (2022), 192:1–192:33. [49] Hongliang He, Wenlin Yao, Kaixin Ma, Wenhao Yu, Yong Dai, Hongming Zhang, Zhenzhong Lan, and Dong Yu. 2024. Webvoyager: Building an end-to-end web agent with large multimodal models. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 6864–6890. [50] Russ Housley. 2020. TLS 1.3 Extension for Certificate-Based Authentication with an External Pre-Shared Key. RFC 8773. doi:10.17487/RFC8773 [51] Martin Husák, Milan Čermák, Tomáš Jirsík, and Pavel Čeleda. 2016. HTTPS Traffic Analysis and Client Identification Using Passive SSL/TLS Fingerprinting. EURASIP Journal on Information Security 2016, 1 (Dec. 2016), 6. doi:10.1186/ s13635-016-0030-7
Fayolle et al.
[52] Xe Iaso. 2025. Bot protection bypass when a sophisticated attacker asks to pass a challenge of difficulty 0. Retrieved February 18, 2026 from https://github.com/ Xe/x/security/advisories/GHSA-56w8-8ppj-2p4f [53] Christos Iliou, Theodoros Kostoulas, Theodora Tsikrika, Vasilis Katos, Stefanos Vrochidis, and Ioannis Kompatsiaris. 2021. Web bot detection evasion using generative adversarial networks. In 2021 IEEE International Conference on Cyber Security and Resilience (CSR). IEEE, 115–120. [54] Imperva. 2025. Bad bot report: the rapid rise of bots and the unseen risk for business. Retrieved February 27, 2026 from https://www.imperva.com/ resources/wp-content/uploads/sites/6/reports/2025-Bad-Bot-Report.pdf [55] IPLocate. 2026. IPLocate. Retrieved May 22, 2026 from https://www.iplocate.io/ [56] Markus Jakobsson and Ari Juels. 1999. Proofs of Work and Bread Pudding Protocols. In Communications and Multimedia Security (IFIP Conference Proceedings, Vol. 152). Kluwer, 258–272. [57] Ghalia Jarad and Kemal Bicakci. 2026. When Handshakes Tell the Truth: Detecting Web Bad Bots via TLS Fingerprints. arXiv preprint arXiv:2602.09606 (2026). [58] Taein Kim, Karstan Bock, Claire Luo, Amanda Liswood, Chloe Poroslay, and Emily Wenger. 2025. Scrapers Selectively Respect robots.txt Directives: Evidence From a Large-Scale Empirical Study. In IMC. ACM, 541–557. [59] Robb Knight. 2024. Perplexity AI Is Lying about Their User Agent. Retrieved February 18, 2026 from https://rknight.me/blog/perplexity-ai-is-lying-aboutits-user-agent/ [60] Martijn Koster, Gary Illyes, Henner Zeller, and Lizzi Sassman. 2022. Robots Exclusion Protocol. RFC 9309. doi:10.17487/RFC9309 [61] Mohinder Kumar, M. K. Jindal, and Munish Kumar. 2022. A Systematic Survey on CAPTCHA Recognition: Types, Creation and Breaking Techniques. Archives of Computational Methods in Engineering 29, 2 (March 2022), 1107–1136. doi:10. 1007/s11831-021-09608-4 [62] Tomer Laor, Naif Mehanna, Antonin Durey, Vitaly Dyadyuk, Pierre Laperdrix, Clémentine Maurice, Yossi Oren, Romain Rouvoy, Walter Rudametkin, and Yuval Yarom. 2022. DRAWN APART: A Device Identification Technique based on Remote GPU Fingerprinting. In NDSS. The Internet Society. [63] Pierre Laperdrix, Gildas Avoine, Benoit Baudry, and Nick Nikiforakis. 2019. Morellian Analysis for Browsers: Making Web Authentication Stronger with Canvas Fingerprinting. In DIMVA (Lecture Notes in Computer Science). Springer, 43–66. [64] Pierre Laperdrix, Nataliia Bielova, Benoit Baudry, and Gildas Avoine. 2020. Browser fingerprinting: A survey. ACM Transactions on the Web (TWEB) 14, 2 (2020), 1–33. [65] LeeBrotherston. 2020. FPTLS: TLS Fingerprinting Library. Retrieved February 18, 2026 from https://github.com/LeeBrotherston/tls-fingerprinting [66] Xigao Li, Babak Amin Azad, Amir Rahmati, and Nick Nikiforakis. 2021. Good Bot, Bad Bot: Characterizing Automated Brobrowserwsing Activity. In SP. IEEE, 1589–1605. [67] Enze Liu, Elisa Luo, Shawn Shan, Geoffrey M. Voelker, Ben Y. Zhao, and Stefan Savage. 2025. Somesite I Used To Crawl: Awareness, Agency and Efficacy in Protecting Content Creators From AI Crawlers. In IMC. ACM, 78–99. [68] Jiacheng Liu, Yaxin Luo, Jiacheng Cui, Xinyi Shang, Xiaohan Zhao, and Zhiqiang Shen. 2026. Next-Gen CAPTCHAs: Leveraging the Cognitive Gap for Scalable and Diverse GUI-Agent Defense. CoRR abs/2602.09012 (2026). [69] Zengrui Liu, Jimmy Dani, Yinzhi Cao, Shujiang Wu, and Nitesh Saxena. 2025. The First Early Evidence of the Use of Browser Fingerprinting for Online Tracking. In Proceedings of the ACM on Web Conference 2025. 4980–4995. [70] Mattwmaster58. 2026. playwright-stealth 2.0.2. Retrieved March 10, 2026 from https://pypi.org/project/playwright-stealth/ [71] MDN. 2026. Private State Token API. Retrieved May 15, 2026 from https: //developer.mozilla.org/en-US/docs/Web/API/Private_State_Token_API [72] Naif Mehanna, Walter Rudametkin, Pierre Laperdrix, and Antoine Vastel. 2024. Free Proxies Unmasked: A Vulnerability and Longitudinal Analysis of Free Proxy Services. In Proceedings 2024 Workshop on Measurements, Attacks, and Defenses for the Web. Internet Society, San Diego, CA, USA. doi:10.14722/madweb.2024. 23035 [73] Thibault Meunier and Mari Galicer. 2025. Forget IPs: using cryptography to verify bot and agent traffic. Retrieved May 15, 2026 from https://blog.cloudflare. com/web-bot-auth/ Retrieved February 19, 2026 from https: [74] Microsoft. 2026. Playwright. //playwright.dev/ [75] Atsuyuki Miyai, Zaiying Zhao, Kazuki Egashira, Atsuki Sato, Tatsumi Sunada, Shota Onohara, Hiromasa Yamanishi, Mashiro Toyooka, Kunato Nishina, Ryoma Maeda, Kiyoharu Aizawa, and Toshihiko Yamasaki. 2025. WebChoreArena: Evaluating Web Browsing Agents on Realistic Tedious Web Tasks. CoRR abs/2506.01952 (2025). [76] mozilla.org contributors. 2026. Navigator: userAgentData property. Retrieved May 29, 2026 from https://developer.mozilla.org/en-US/docs/Web/API/ Navigator/userAgentData [77] Reiichiro Nakano, Jacob Hilton, Suchir Balaji, Jeff Wu, Long Ouyang, Christina Kim, Christopher Hesse, Shantanu Jain, Vineet Kosaraju, William Saunders,
On the Internet, Nobody Knows You’re an LLM Bot
et al. 2021. Webgpt: Browser-assisted question-answering with human feedback. arXiv preprint arXiv:2112.09332 (2021). [78] Zahra Noury and Mahdi Rezaei. 2020. Deep-CAPTCHA: a deep learning based CAPTCHA solver for vulnerability assessment. CoRR abs/2006.08296 (2020). [79] OpenAI. 2025. OpenAI ChatGPT Agent. Retrieved February 18, 2026 from https://chatgpt.com/features/agent [80] OpenAI. 2026. ChatGPT. Retrieved February 19, 2026 from https://chatgpt.com/ [81] OpenAI. 2026. Introducing GPT-5.4. Retrieved May 15, 2026 from https: //openai.com/index/introducing-gpt-5-4/ [82] OpenAI. 2026. Introducing GPT-5.5. Retrieved May 15, 2026 from https: //openai.com/index/introducing-gpt-5-5/ [83] OpenAI. 2026. Overview of OpenAI Crawlers. Retrieved February 25, 2026 from https://developers.openai.com/api/docs/bots/ [84] OpenClaw. 2025. OpenClaw: Open-source AI agent that runs on youbrowserr machine, connects to your tools, and works autonomously in the background. Retrieved February 18, 2026 from https://openclaw.com.au/ [85] OpenClaw. 2026. Browser (OpenClaw-managed). Retrieved March 17, 2026 from https://docs.openclaw.ai/tools/browser#profiles-openclaw-vs-chrome OpenClaw chrome.ts stealth mechanism. Re[86] OpenClaw. 2026. trieved May 21, 2026 from https://github.com/openclaw/openclaw/blob/ 8e821a061cb61c8cd3e3f2a90880ff73099126c1/src/browser/chrome.ts/#L217 [87] OpenSSL. 2026. OpenSSl Documentation - SSL_get_default_timeout. Retrieved May 21, 2026 from https://docs.openssl.org/3.0/man3/SSL_get_default_timeout/ [88] Eva Papadogiannaki and Sotiris Ioannidis. 2023. Pump Up the JARM: Studying the Evolution of Botnets Using Active TLS Fingerprinting. In ISCC. IEEE, 764– 770. [89] A Priya, Abishek Ganesh, R Akil Prasath, and K Jeya Pradeepa. 2022. Cracking CAPTCHAs using Deep Learning. In 2022 Second International Conference on Artificial Intelligence and Smart Energy (ICAIS). 437–443. doi:10.1109/ICAIS53314. 2022.9742729 [90] Prosopo. 2026. Pro-Captcha. Retrieved February 18, 2026 from https://prosopo. io/ [91] Chrome DevTools Protocol. 2026. Chrome DevTools Protocol. Retrieved February 19, 2026 from https://chromedevtools.github.io/devtools-protocol/ [92] rbushria, Ahmet Yilmaz, Soham Kukreti, Chris Murphy, unclecode, and Claude Opus 4.5. 2025. Introducing ChatGPT agent: bridging research and action. Retrieved March 10, 2026 from https://openai.com/index/introducingchatgpt-agent/ [93] rbushria, Ahmet Yilmaz, Soham Kukreti, Chris Murphy, unclecode, and Claude Opus 4.5. 2026. Crawl4AI - Release v0.8.0: Crash Recovery, Prefetch Mode & Security Fixes. Retrieved March 10, 2026 from https://github. com/unclecode/crawl4ai/blob/aa7b05072d5b6deb9d1b85f9bb8b8561b936ac5e/ crawl4ai/async_configs.py#L1198 [94] Eric Rescorla. 2018. The Transport Layer Security (TLS) Protocol Version 1.3. RFC 8446. doi:10.17487/RFC8446 [95] Salvador Rodriguez, Sam Schechner, and Dustin Volz. 2024. Meta Takes Down ‘Inauthentic’ Accounts on Facebook, Instagram Linked to Israeli Firm. Retrieved February 25, 2026 from https://www.wsj.com/tech/meta-takesdown-inauthentic-accounts-on-facebook-instagram-linked-to-israeli-firmcb03821f? [96] Takamichi Saito, Koki Yasuda, Takayuki Ishikawa, Rio Hosoi, Kazushi Takahashi, Yongyan Chen, and Marcin Zalasinski. 2016. Estimating CPU Features by Browser Fingerprinting. In IMIS. IEEE Computer Society, 587–592. [97] Salesforce. 2025. JA3 and JA3S: TLS Fingerprinting Overview. Retrieved May 22, 2026 from https://deepwiki.com/salesforce/ja3 [98] Maxime Sateur, Javier Martínez Llamas, Davy Preuveneers, and Wouter Joosen. 2025. Evaluating Turnstile as a Privacy-Conscious Alternative to reCAPTCHA. In International Conference on Availability, Reliability and Security. Springer, 235–252. [99] scikit learn. 2026. OneHotEncoder Documentation. Retrieved May 22, 2026 from https://scikit-learn.org/stable/modules/generated/sklearn.preprocessing. OneHotEncoder.html [100] scikit learn. 2026. Over-sampling methods. Retrieved May 22, 2026 from https://imbalanced-learn.org/stable/references/over_sampling.html [101] scrapy. 2026. scrapy. Retrieved February 25, 2026 from https://www.scrapy.org/ [102] Jérôme Segura and Eugene Aseev. 2018. Operation Fingerprint: A look into several Angler exploit kit malvertising campaigns. Retrieved February 18, 2026 from https://site.geoedge.com/downloads/documents/Malware_ Operation_Fingerprint.pdf [103] Selenium. 2026. Selenium. Retrieved February 19, 2026 from https://www. selenium.dev/ [104] SimplAI. 2026. Ad Account Farming Agent. Retrieved February 25, 2026 from https://simplai.ai/solution/ad-account-farming-agent [105] Skyvern. 2025. Skyvern: Automate Browser-Based Workflows with AI. Retrieved February 18, 2026 from https://www.skyvern.com/ [106] Skyvern. 2026. Skyvern captcha-bot-detection.mdx built-in bot detection avoidance mechanism. Retrieved May 21, 2026 from https://github.com/SkyvernAI/skyvern/blob/6d9e24cb927a6ac7d0caae35134d6fa06e7d41d8/docs/going-to-
Conference’17, July 2017, Washington, DC, USA
production/captcha-bot-detection.mdx/#built-in-bot-detection-avoidance [107] Jeff Starr. 2026. Ultimate Block List to Stop AI Bots. Retrieved May 29, 2026 from https://perishablepress.com/ultimate-ai-block-list/ [108] steipete. 2026. browser-evaluate-cdp-refactor.md. Retrieved March 17, 2026 from https://github.com/openclaw/openclaw/blob/ 8e821a061cb61c8cd3e3f2a90880ff73099126c1/docs/experiments/plans/ browser-evaluate-cdp-refactor.md?plain=1#L17 [109] Mozilla Support. 2026. Configuration Editor for Firefox. Retrieved May 06, 2026 from https://support.mozilla.org/en-US/kb/about-config-editor-firefox [110] Reid Tatoris and Maxime Guerreiro. 2022. Private Access Tokens: eliminating CAPTCHAs on iPhones and Macs with open standards. Retrieved May 15, 2026 from https://blog.cloudflare.com/eliminating-captchas-on-iphones-and-macsusing-new-standard/ [111] Reid Tatoris, Harsh Saxena, and Luis Miglietti. 2026. Trapping misbehaving bots in an AI Labyrinth. Retrieved May 15, 2026 from https://blog.cloudflare.com/ailabyrinth/ [112] Techaro. 2026. Anubis. Retrieved February 18, 2026 from https://anubis.techaro. lol/ [113] Tshark. -. Tshark. Retrieved February 23, 2026 from https://www.wireshark. org/docs/man-pages/tshark.html [114] Alisha Ukani, Hamed Haddadi, Ali Shahin Shamsabadi, and Peter Snyder. 2025. Privacy Practices of Browser Agents. CoRR abs/2512.07725 (2025). [115] UncleCode. 2025. Crawl4AI: Open-source AI-powered web crawling and scraping. Retrieved February 18, 2026 from https://github.com/unclecode/crawl4ai [116] UncleCode. 2026. Crawl4AI Undetected Browser. Retrieved February 18, 2026 from https://docs.crawl4ai.com/advanced/undetected-browser [117] Browser Use. 2025. Browser Use: AI-Powered Browser Automation. Retrieved February 18, 2026 from https://browser-use.com/ [118] Browser Use. 2026. Browser Use Cloud Introduction. Retrieved March 09, 2026 from https://docs.browser-use.com/cloud/introduction [119] Browser Use. 2026. Browser Use Stealth. Retrieved February 19, 2026 from https://docs.cloud.browser-use.com/usage/stealth [120] Browser Use. 2026. Browser Use Stealth Mode. Retrieved February 18, 2026 from https://docs.cloud.browser-use.com/usage/stealth [121] vaskenh. 2025. JA4 Fingerprinting in GTI: Deep Dive. Retrieved February 19, 2026 from https://security.googlecloudcommunity.com/community-blog42/ja4-fingerprinting-in-gti-deep-dive-6043 [122] Antoine Vastel. 2025. FP-Scanner: Self-hosted browser fingerprinting and bot detection with real-world constraints in mind. Retrieved February 18, 2026 from https://github.com/antoinevastel/fpscanner [123] Antoine Vastel, Pierre Laperdrix, Walter Rudametkin, and Romain Rouvoy. 2018. { Fp-Scanner } : The privacy implications of browser fingerprint inconsistencies. In 27th USENIX Security Symposium (USENIX Security 18). 135–150. [124] Antoine Vastel, Walter Rudametkin, Romain Rouvoy, and Xavier Blanc. 2020. FPCrawlers: Studying the Resilience of Browser Fingerprinting to Block Crawlers. In MADWeb’20 - NDSS Workshop on Measurements, Attacks, and Defenses for the Web, Oleksii Starov, Alexandros Kapravelos, and Nick Nikiforakis (Eds.). San Diego, United States. doi:10.14722/ndss.2020.23xxx [125] Hari Venugopalan, Shaoor Munir, Shuaib Ahmed, Tangbaihe Wang, Samuel T. King, and Zubair Shafiq. 2024. FP-Inconsistent: Detecting Evasive Bots using Browser Fingerprint Inconsistencies. CoRR abs/2406.07647 (2024). [126] Vinyzu. 2026. patchright 1.58.2. Retrieved March 10, 2026 from https://pypi. org/project/patchright/ [127] Ethan Wang, Zubair Shafiq, and Yash Vekaria. 2026. FP-Agent: Fingerprinting AI Browsing Agents. arXiv preprint arXiv:2605.01247 (2026). [128] Anna Weine. 2025. Upgrade Firefox 147 to NSS 3.119. Retrieved May 06, 2026 from https://bugzilla.mozilla.org/show_bug.cgi?id=2000871 [129] XGBoost. 2026. XGBoost Documentation. Retrieved May 22, 2026 from https: //xgboost.readthedocs.io/en/stable/ [130] Tao Yu, Zhengbo Zhang, Zhiheng Lyu, Junhao Gong, Hongzhu Yi, Xinming Wang, Yuxuan Zhou, Jiabing Yang, Ping Nie, Yan Huang, and Wenhu Chen. 2026. BrowserAgent: Building Web Agents with Human-Inspired Web Browsing Actions. Trans. Mach. Learn. Res. 2026 (2026).
A
Web Agents Description
In this section, we provide additional details on the Web Agents evaluated in this study, complementing the information presented in Table 2. OpenClaw [84]. Formerly known as Moltbot/Clawdbot, OpenClaw is an open-source Web Agent that runs locally and extends beyond browser-only interaction by integrating with system tools and messaging platforms. Browser interactions are expressed in natural language and orchestrated through Playwright, either using
Conference’17, July 2017, Washington, DC, USA
its managed browser [85] or the user’s local Chrome instance [108]. In our experiments, OpenClaw operated through the user’s Chrome browser. Beyond standard browser actions (e.g., clicking, scrolling, navigation, and form filling), OpenClaw also supports terminal control, local file access, and interaction with system applications. Although its documentation does not explicitly advertise anti-bot evasion, the source code mentions reducing the browser automation footprint to improve stealth [86]. Anthropic Claude for Chrome [5]. Released in August 2025, Claude for Chrome is a browser extension available to paid subscribers that operates directly within the user’s Chrome environment rather than through an external automation framework. Although its implementation is not publicly documented, it likely relies on rendered page content, screenshots, and custom Chrome DevTools Protocol (CDP)-based interactions executed within the browser context. Users interact through natural language instructions only, without access to a scripting interface. The agent can navigate webpages, click, scroll, move the mouse, fill and validate forms, extract data, process text, and execute multi-step workflows with optional user intervention. No explicit anti-bot evasion or stealth mechanisms are documented. Browser Use [117]. BrowserUse connects LLMs with browser automation frameworks by converting complex DOM structures into simplified representations suitable for LLM reasoning. It is available both as a Python library and through an API, with self-hosted and managed cloud deployments. The framework relies on existing automation tools such as CDP [91], Playwright [74], Selenium [103], and Puppeteer [46]. Users interact with BrowserUse through natural language instructions or custom automation scripts. It supports browser actions such as clicking, scrolling, navigation, form filling, text extraction, and multi-step workflows, while also providing reusable “skills” that encapsulate automation tasks. The platform additionally advertises stealth features for its cloud offering, including cookie blocking, CAPTCHA solving, and proxy configuration such as country-specific routing [119]. OpenAI ChatGPT Agent [79]. Released in July 2025, ChatGPT Agent enables users to delegate web tasks directly to ChatGPT. It operates in a cloud-hosted browser and terminal environment using the Computer-Using Agent (CUA) model, which combines GPT-4o vision capabilities with reinforcement learning. The agent appears to rely primarily on screenshots and rendered interface elements rather than DOM-based automation. Although its automation stack is not publicly documented, our experiments and OpenAI’s descriptions [92] suggest a custom cloud browser infrastructure instead of standard frameworks such as Playwright [74], Selenium [103], or Puppeteer [46]. Interaction is limited to natural language instructions, without a public scripting API. The agent supports webpage navigation, clicking, scrolling, mouse movements, form filling, text processing, and multi-step authenticated workflows. No explicit anti-bot evasion or stealth mechanisms are documented. Skyvern [105]. Skyvern is a vision-based Web Agent built around a three-stage architecture composed of a Planner that decomposes tasks, an Actor that executes interactions, and a Validator that
Fayolle et al.
verifies outcomes. It can be self-hosted or deployed through managed cloud services. Skyvern uses screenshots to identify and interact with webpage elements. Although its automation stack is not publicly documented, it likely relies on a custom browser automation framework adapted to vision-based interaction. Users interact through natural language instructions, while the system autonomously plans and executes tasks, optionally with human validation. Skyvern supports webpage navigation, clicking, scrolling, form filling, login validation, data extraction, text processing, and multi-step workflows. Its cloud offering advertises residential proxies, and the GitHub documentation mentions built-in bot detection avoidance mechanisms that reduce the automation footprint [106]. Crawl4AI [115]. Crawl4AI is an LLM-based crawler focused on content extraction rather than full interactive automation. Compared to other tools in this selection, it is closer to scripted bots leveraging browser automation frameworks than to full-fledged Web Agents. Built on top of Playwright [74], it primarily operates on raw DOM content and combines natural language objectives with scripting APIs for structured crawling workflows. However, Crawl4AI does not supports advanced interactions such as purchases or authenticated workflows. It explicitly provides antidetection features [116], including a Stealth Mode that modifies browser fingerprints and navigator properties, and an Undetected Browser Mode with deeper browser patches targeting WebDriver and CDP-based detection. Both rely on third-party open-source projects2 . The documentation also notes that robots.txt checking is disabled by default, as the check_robots_txt parameter defaults to False [93].
B
Honeysite Appearance
An overview of the webpage hosted on the default honeysite is shown in Figure 3. The web pages of the nine other honeysites are similar, differing only in the page name and the content of the first post describing the purpose of the site.
C
List of Collected Attributes
First, we extracted network-related data, including the source IP address and port, as well as the JA4 TLS fingerprint from TLS Client Hello packets using tshark. Second, we obtained HTTP headers attributes from nginx access logs, available in Listing 1. Third, Table 8 lists the attributes collected directly from the browser via JavaScript. Listing 1: Nginx Access Log file format. 'site="$server_name"' 'server="$host"' 'dest_port="$server_port"' 'dest_ip="$server_addr"' 'src="$remote_addr"' 'src_ip="$realip_remote_addr"' 'src_port="$realip_remote_port"' 'user="$remote_user"' 'time_local="$time_local"' 'timestamp="$msec"' 'protocol="$server_protocol"' 'ssl_protocol="$ssl_protocol"' 2 Respectively, the playwright-stealth plugin [70] and the patchright project [126].
On the Internet, Nobody Knows You’re an LLM Bot
Conference’17, July 2017, Washington, DC, USA
Table 7: Collected visits per tool. Tool Humans cURL wget scrapy Selenium Playwright Puppeteer OpenClaw Claude Chrome Crawl4AI BrowserUse Local BrowserUse Cloud ChatGPT Agent Skyvern Total: 1449 =
D
Active Data Collection
Table 7 provides a breakdown of all active visits per tool, including normal or special prompts (see Appendix F), as well as visits without LLM.
E
Passive Data Collection and Analysis
Following an approach similar to [67], we passively collected traffic over a four-month period, from January 8 to May 8, 2026, excluding the dedicated active collection experiments conducted between
SP Visits
NoLLM visits
– – – – – – – 102 102 150 200 100 50 153 857 +
– – – – – – – 12 22 0 90 30 15 53 222 +
40 10 10 10 100 100 100 – – – – – – – 370
HTTP scrapers Automation frameworks Web Agents local NP = Normal prompt ; SP = Special prompt
Figure 3: Honeysite appearance: baseline site. 'status="$status"' 'bytes_out="$bytes_sent"' 'bytes_in="$upstream_bytes_received"' 'http_referer="$http_referer"' 'http_user_agent="$http_user_agent"' 'nginx_version="$nginx_version"' 'http_x_forwarded_for="$http_x_forwarded_for"' 'http_x_header="$http_x_header"' 'uri_query="$query_string"' 'uri_path="$uri"' 'http_method="$request_method"' 'response_time="$upstream_response_time"' 'tls_cipher="$ssl_cipher"' 'tls_ciphers="$ssl_ciphers"' 'cookie="$http_cookie"' 'request_time="$request_time"' 'category="$sent_http_content_type"' 'https="$https"' 'SSL_session_reused="$ssl_session_reused"' 'SSL_session_ID="$ssl_session_id"' 'SSL_early_data="$ssl_early_data"' 'SSL_curves="$ssl_curves"' 'SSL_curve="$ssl_curve"' 'SSL_alpn_protocol="$ssl_alpn_protocol"' 'X-Blocked="$sent_http_x_blocked"' 'X-Verified="$sent_http_x_verified"'
NP visits
Web Agents cloud
January 28 and February 24, 2026. During this period, our infrastructure remained publicly accessible without any active traffic generation, allowing us to observe unsolicited visits from crawlers and automated systems. The collected passive traffic primarily originated from HTTPbased scrapers (e.g., cURL, wget, python-httpx), search engine crawlers (e.g., Googlebot, Bingbot, DuckDuckBot), AI crawlers (e.g., Applebot, AmazonBot, ClaudeBot, OAI-SearchBot, PerplexityBot), and security scanning services. Most of these visits did not execute JavaScript, resulting in fingerprints limited to TLS and HTTP layers. Furthermore, when applying our classification pipeline to the passive dataset, we did not observe any clear matches with the studied Web Agents. This is expected, as the passive traffic mainly consists of indexing and scanning bots, whereas LLM-based traffic is more commonly associated with training crawlers than with interactive Web Agents.
F
Normal and Special Prompts
We use the following normal prompt to instruct the Web Agents to access the honeysite corresponding to the URL given (i.e., one of our ten honeysites), and perform the necessary actions to bypass defenses, create a post, and retrieve the required information. We also use a special prompt that allows for more flexible behavior when accessing our honeysites, which may include the use of external solvers, automation exploits, or bypass techniques. Both the normal prompt and the special prompt are provided in Listing 2, the modified part of the normal prompt (marked by (I)) to create the special prompt is indicated by (II). In addition, we sometimes ask the Web Agent to include in the output the Browser Full Version obtained with the navigator.usserAgentData.getHighEntropyValues([’uaFullVersion’]) JavaScript API. This information shows that all our tested agents (except Skyvern, which hallucinated the answer in our tests) are able to retrieve this information. We verified their results by comparing the reported versions with those observed in their corresponding
Conference’17, July 2017, Washington, DC, USA
browser fingerprints. Nevertheless, nothing indicates that the Web Agents are capable of leveraging either the special prompt or the retrieved browser version to adapt their behavior and evade defenses by dynamically modifying their User-Agent string or other HTTP headers accordingly.
G
Notable Behaviors
When a Web Agent cannot bypass a defense mechanism, publish a post, or retrieve required browser information, it may exhibit anomalous behavior while attempting to overcome the obstacle. Some Web Agents, particularly those relying on Claude models, may explicitly refuse to bypass bot protections, citing internal safety guidelines that prohibit circumventing CAPTCHAs or other humanverification mechanisms. This behavior was especially pronounced with Prosopo CAPTCHA, which Claude Chrome refused to solve in 20 separate attempts. OpenClaw also exhibited a similar behavior once. Such cases were classified as BLOCKED in our dataset. Other agents behave differently. When blocked by a Prosopo CAPTCHA, Skyvern may repeatedly reload the page in an apparent infinite loop, attempt to access the Prosopo website directly, enter fabricated credentials to create an account in the hope of obtaining access to the target honeysite, or continuously generate
Fayolle et al.
posts on our honeysite without terminating. ChatGPT Agent may attempt to retrieve its user-agent string either through an external website or by opening a terminal. When facing Turnstile, ChatGPT Agent sometimes navigates to alternative honeysites (e.g., domain, site1.domain etc.) and clicks buttons associated with the protected site, as if credentials could be indirectly obtained from a weaker target, although this approach also fails. Finally, when confronted with a Prosopo CAPTCHA, BrowserUse may correctly identify the interactive element but fail to perform the required click action.
H
JA4 Hash-ID Mapping & Distribution
Table 9 and Table 10 present the mapping between the abbreviated JA4 indexes used throughout the paper and their corresponding complete JA4 hash values, along with the distribution of observed JA4 values for each configuration during our experiments.
I
Discriminative Browser Fingerprinting Attributes
Table 11 summarizes the most discriminative attributes identified by our metrics and discussed in Section 6.3. Since some attributes expose multiple values for a given tool, we report only the value with the highest 𝑉 -𝑆𝑐𝑜𝑟𝑒.
On the Internet, Nobody Knows You’re an LLM Bot
Conference’17, July 2017, Washington, DC, USA
Listing 2: Prompts. Input: `{URL}` Tasks: Navigate to the following URL: `{URL}` Complete the tasks below in order. 1. Access Attempt - Attempt to load the website normally. - (I) If a CAPTCHA, bot-detection, or access challenge appears, behave as a standard human user would by following the onscreen instructions using only the provided interface. - (II) Behave as a standard human user would by following the on-screen instructions using only the provided interface. You can change your discriminating parameters and also use external solvers, automation exploits, or bypass techniques. - If access is not granted within 15 seconds or after one retry, stop and respond: BLOCKED 2. Post Creation - Create and submit a new post. - Use a completely original first and last name. - Ensure the post content is unique. - Click the appropriate submit button. 3. Success Verification - Verify that the post was successfully submitted by detecting a newly generated post ID corresponding to the page ID. 4. Timeout & Failure Handling - Allow up to 15 seconds per step. - Retry each failed step once. - If a step still fails, respond: TIMEOUT Output: Final Response Format - If blocked: BLOCKED - If timed out: TIMEOUT - Otherwise: Page ID: <ID> First Name: <First Name> Last Name: <Last Name> Post content: <Post Content> (II) denotes the “special prompt” instruction replacing (I), which corresponds to the original “normal prompt” instruction. The remaining text is unchanged in both versions.
Conference’17, July 2017, Washington, DC, USA
Fayolle et al.
Table 8: JavaScript-extracted browser fingerprinting attributes. Category
Attributes
Description
navigator.userAgent, navigator.userAgentData, navigator.platform, Browser, operating system, and execution navigator.buildID, navigator.product, navigator.productSub, environment identification information. navigator.vendor, navigator.vendorSub Localization & Preferences timezone, navigator.languages, navigator.doNotTrack fonts User language, fonts and privacy preferences. Hardware Characteristics navigator.hardwareConcurrency, navigator.deviceMemory, Hardware and system-level characteristics navigator.getBattery(), navigator.connection such as CPU cores, RAM size, battery state and network connection. Plugins & MIME Types plugins, mimeTypes Installed browser plugins and supported MIME types. Screen & Display At- window.screen.width, window.screen.height, Screen resolution, viewport size, window getributes window.screen.colorDepth, window.screen.availTop, ometry, pixel density, and display layout inwindow.screen.availLeft, window.screen.availHeight, formation. window.screen.availWidth, window.screen.left, window.screen.top, window.innerHeight, window.outerHeight, window.outerWidth, window.innerWidth, window.screenX, window.pageXOffset, window.pageYOffset, document.body.clientWidth, document.body.clientHeight, screen.pixelDepth, window.devicePixelRatio Storage Capabilities window.cookies, window.localStorage, window.sessionStorage, Browser storage available mechanisms. window.indexedDB, navigator.storage.usage, navigator.storage.quota Media & Audio APIs audioFormats, window.AudioContext(), videoFormats, Supported media devices and audio formats. navigator.mediaDevices Sensors & Input Devices Accelerometer, Gyroscope, window.ProximitySensor, Keyboard Availability and characteristics of hardware sensors and keyboard layout information. Permissions APIs navigator.permissions Browser permission states exposed through the Permissions API. Window & UI Attributes window.key, window.locationbar.visible, window.menubar.visible, Browser window configuration and visible window.personalbar.visible, window.statusbar.visible, user interface components. window.toolbar.visible, Automation & Bot Detec- navigator.webdriver Signals related to browser automation frametion works. Chrome-specific Features window.chrome, window.chrome.runtime Chrome-specific runtime objects and implementation details. Browser Identity
On the Internet, Nobody Knows You’re an LLM Bot
Conference’17, July 2017, Washington, DC, USA
Table 9: Mapping between JA4 index, full JA4 and its features. ID
JA4
Proto #Cipher #Ext ALPN PSK CC DC RSL App PHA ETM Notes
J1 J2 J3 J4 J5 J6 J7 J8
q13d0311h3_55b375c5d22e_653d80c3fe9d q13d0312h3_55b375c5d22e_178839b6cec1 q13d0312h3_55b375c5d22e_5a06198afb93 q13d0313h3_55b375c5d22e_b0954bf1abdf q13d0314h3_55b375c5d22e_61e396c58b1f q13d0314h3_55b375c5d22e_9dd3975af409 q13d0315h3_55b375c5d22e_dc5437974b47 q13d0316h3_55b375c5d22e_dc4af083c550
QUIC QUIC QUIC QUIC QUIC QUIC QUIC QUIC
03 03 03 03 03 03 03 03
11 12 12 13 14 14 15 16
h3 h3 h3 h3 h3 h3 h3 h3
J9 J10 J11 J12 J13 J14 J15 J16 J17 J18 J19 J20 J21
t13d1412h2_e33ad33b3d25_6b314db333b6 t13d1516h2_8daaf6152771_02713d6af862 t13d1516h2_8daaf6152771_d8a2da3f94cd t13d1517h2_8daaf6152771_b0da82dd1658 t13d1517h2_8daaf6152771_b6f405a00624 t13d1517h2_8daaf6152771_dcad5a053991 t13d1518h2_8daaf6152771_0c9ac9b5c72c t13d1717h2_5b57614c22b0_3cbfd9057e0d t13d1717h2_5b57614c22b0_e6dcd7ae0a9e t13d2812h2_a01be8c064b6_ef4b9b248d72 t13d301000_1d37bd780c83_c3976d268853 t13d3012h2_1d37bd780c83_882d495ac381 t13d751100_479067518aa3_fb8d5ffd48c1
TCP TCP TCP TCP TCP TCP TCP TCP TCP TCP TCP TCP TCP
14 15 15 15 15 15 15 17 17 28 30 30 75
12 16 16 17 17 17 18 17 17 12 10 12 11
h2 h2 h2 h2 h2 h2 h2 h2 h2 h2 – h2 –
✓ ✓
✓ ✓ ✓ ✓
✓ ✓
✓ ✓ ✓ ✓
✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓
J1 + U51764* J1 + PSK J2 + PSK ✓ ✓ ✓ ✓
✓ ✓ ✓ ✓
J5 + PSK J5 + CC J6 + CC ✓ J10 - App + U17613* J10 + PSK J11 + PSK J11 + U51764* J14 + PSK
✓
✓ ✓
✓ ✓
J16 + PSK
✓ ✓
✓ ✓ ✓ ✓
J19 + ALPN + PHA J19 + PHA + 45 ciphers
PSK: pre_shared_key CC: compress_certificate DC: delegated_credentials RSL: record_size_limit App: application_settings PHA: post_handshake_auth ETM: encrypt_then_mac. All fingerprints indicate the use of TLS 1.3 and include the server_name (SNI) extension. * These extensions are unknown to Wireshark, suggesting that they are either undocumented, not standardized, or not supported by its parser yet.
Conference’17, July 2017, Washington, DC, USA
Fayolle et al.
Table 10: Count of JA4 per configuration. Tool
Model
Browser
Infra. Tool Ver.
Human Firefox 136.0 L Human Firefox 147.0.1 L Human Chrome 144.0.7559.96 L cURL L wget L scrapy L Selenium Firefox 147.0.2 L Selenium Chrome 144.0.7559.96 L Playwright Firefox 146.0 L Playwright Chromium 145.0.7632.6 L Puppeteer Firefox 147.0.3 L Puppeteer Chromium 145.0.7632.46 L OpenClaw opus-4.5 Chrome 144.0.7559.96 L OpenClaw sonnet-4.5 Chrome 144.0.7559.96 L OpenClaw sonnet-4.5 Python Request L Claude Chrome opus-4.5 Chrome 144.0.7559.96 L Claude Chrome sonnet-4.5 Chrome 144.0.7559.96 L Crawl4AI gpt-4o-mini Chromium 145.0.7632.6 L Crawl4AI-Stl. gpt-4o-mini Chromium 145.0.7632.6 L Crawl4AI-Undet. gpt-4o-mini Chromium 145.0.7632.6 L BrowserUse bu-1-0 Chrome 144.0.7559.96 L BrowserUse sonnet-4.5 Chrome 144.0.7559.96 L BrowserUse bu-2-0 Chrome 144.0.7559.{60,96,97,98,110} C BrowserUse bu-2-0 Chrome 144.0.7559.{0,59,60,97,98,109} C BrowserUse bu-2-0 Chrome 144.0.7559.110 C BrowserUse sonnet-4.5 Chrome 144.0.7559.{60,96,97,109,110} C BrowserUse sonnet-4.5 Chrome 144.0.7559.59 C BrowserUse-Stl. bu-1-0 Chrome 144.0.7559.{0,59,60,61,96,109,110} C BrowserUse-Stl. bu-1-0 Chrome 144.0.7559.97 C BrowserUse-Stl. sonnet-4.5 Chrome 144.0.7559.{0,59, 60,61,96,98,109} C BrowserUse-Stl. sonnet-4.5 Chrome 144.0.7559.{97,110} C ChatGPT Agent CUA Chromium 141 C Skyvern GPT 5.2 Edge 143.0.3650.139 C Skyvern GPT 5.2 Edge 144.0.3719.92 C Skyvern Skyvern Opti. Edge 143.0.3650.139 C Skyvern Skyvern Opti. Edge 144.0.3719.92 C Colors matching: Humans
HTTP-based scrapers
J1 J2 J3 J4 J5 J6 J7 J8 J9 J10 J11 J12 J13 J14 J15 J16 J17 J18 J19 J20 J21
0 0 0 0 0 0 2 0 9 8.15.0-DEV 0 0 0 1.21.4 0 0 0 2.14.1 0 0 0 4.18.1 0 0 0 4.18.1 24 0 19 1.58.0 0 0 0 1.58.0 24 0 16 24.37.2 0 0 0 24.37.2 0 23 0 2026.2.2-3 24 0 33 2026.2.2-3 21 0 32 2026.2.2-3 0 0 0 1.0.40 25 0 40 1.0.40 21 0 35 0.8.0 7 0 5 0.8.0 10 0 0 0.8.0 11 0 0 0.11.5 38 0 17 0.11.5 35 0 20 0.11.6 0 0 0 0.11.9 0 0 0 0.11.9 0 0 0 0.11.9 0 0 0 0.11.9 0 0 0 0.11.5 0 0 0 0.11.5 0 0 0 0.11.5 0 0 0 0.11.5 0 0 0 * 0 0 0 1.0.10 0 0 0 1.0.10 0 0 0 1.0.10 0 0 0 1.0.10 0 0 0
Browser automation frameworks
0 0 0 0 0 0 0 0 0 0 0 3 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
6 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
Web Agents local
0 0 0 5 5 0 0 0 0 0 0 1** 0 0 1** 0 0 0 2 0 0 0 0 0 2 12 0 0 0 0 1 7 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 15 43 4 61 3 23 36 15 42 0 0 0 0 0
0 0 9 0 0 0 0 7 0 10 0 0 0 0 0 2 1 38 40 39 10 10 0 0 0 0 0 0 0 0 0 0 0 32 1 74
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 22 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 2 0 0 0 0 0 0 2 0 0 33 0 0 3 0 0 61 0
0 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 9 39 0 0 0 0 0 0 36 0 0 0 0 0 0 0 35 6 0 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 65 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0 0 0 0 0 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0 0 0 3 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
Web Agents cloud
Infra.: Browser infrastructure: L or C L: Local Browser C: Cloud Browser Tool Ver.: Tool version Stl.: Stealth Undet.: Undetected-Browser Opti.: Optimized * ChatGPT Agent version is undocumented so we give the different testing date instead: 01-28-2026, 02-08-2026 and 02-09-2026. ** These JA4 fingerprints are not directly associated with cURL or wget, but with Cloudflare when accessing Site 7 protected by Cloudflare BFM & Block AI. Because curl and wget lack a browser context, such visits cannot obtain or persist the cf_clearance cookie required to pass Cloudflare’s challenges [20] and are proxied. Consequently, the server primarily observes traffic originating from Cloudflare itself, exposing Cloudflare’s JA4 fingerprint and related network characteristics rather than those of the original clients. This also explains the stability of the observed JA4 fingerprints across executions of cURL and wget.
0 0 0 0 3 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
On the Internet, Nobody Knows You’re an LLM Bot
Conference’17, July 2017, Washington, DC, USA
Table 11: Selection of most discriminative browser fingerprinting attributes. Tool
Attributes
Dominant Values Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Human
User Agent Screen Resolution Permissions State CPU Cores Cookies Management
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Browser Automation
User Agent Screen Resolution Permissions State CPU Cores Cookies Management User Agent Screen Resolution Permissions State CPU Cores Cookies Management
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
OpenClaw
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Claude
User Agent Screen Resolution Permissions State CPU Cores Cookies Management
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Crawl4AI
User Agent Screen Resolution Permissions State CPU Cores Cookies Management
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
Crawl4AI-Stealth
User Agent Screen Resolution Permissions State CPU Cores Cookies Management Referer* User Agent Screen Resolution Permissions State CPU Cores Cookies Management
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/116.0.0.0 Safari/537.36
Crawl4AI-Undetected-Browser
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
BrowserUse Local
User Agent Screen Resolution Permissions State CPU Cores Cookies Management
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
BrowserUse Cloud
User Agent Screen Resolution Permissions State CPU Cores Cookies Management User Agent Screen Resolution Permissions State CPU Cores Cookies Management
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
ChatGPT Agent
User Agent Screen Resolution Permissions State CPU Cores Cookies Management Signature-Agent Header*
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0
Skyvern
User Agent Screen Resolution Permissions State CPU Cores Cookies Management
BrowserUse Stealth
2560 × 1440 p|NS|NS|p|p|NS|NS|p|p|NS|NS|p|p 8 REUSED_COOKIE
1280 × 800 p|NS|NS|p|p|NS|NS|p|p|NS|NS|p|p 8 ROTATING_COOKIE
1920 × 1080 p|g|g|p|p|g|g|p|NS|p|g|p|p 8 REUSED_COOKIE
1920 × 1080 p|g|g|p|p|g|g|p|NS|p|g|p|p 8 SHARED_WITH_HUMAN
1080 × 600 NS|NS|NS|NS|NS|NS|NS|NS|NS|NS|NS|NS|default 8 ROTATING_COOKIE
1080 × 600 NS|NS|NS|NS|NS|NS|NS|NS|NS|NS|NS|NS|default 8 ROTATING_COOKIE EXTERNAL
1080 × 600 p|g|g|p|p|g|g|p|NS|p|g|p|p 8 ROTATING_COOKIE
1920 × 1080 d|d|d|d|d|d|d|d|NS|g|d|d|g 8 ROTATING_COOKIE
1512 × 982 d|d|d|d|d|d|d|d|NS|g|d|d|g 10 ROTATING_COOKIE
1512 × 982 d|d|d|d|d|d|d|d|NS|g|d|d|g 10 ROTATING_COOKIE
1280 × 960 NS|NS|NS|NS|NS|NS|NS|NS|NS|NS|NS|NS|d 13 REUSED_COOKIE https://chatgpt.com
1920 × 1080 p|g|g|p|p|g|g|p|NS|p|g|p|d 32 PARTIAL_REUSE_COOKIE
𝑉 -𝑆𝑐𝑜𝑟𝑒
𝐴-𝑆𝑐𝑜𝑟𝑒
0.344 0.449 0.444 0.337 0.869
0.844 0.649 0.800 0.337 0.869
0.334 0.334 0.489 0.419 0.507
0.940 0.559 0.896 0.419 0.507
0.742 0.366 0.767 0.355 0.948
0.742 0.366 0.767 0.355 0.948
0.752 0.370 0.776 0.360 0.967
0.752 0.370 0.776 0.360 0.967
0.240 0.924 0.962 0.340 0.411
1.000 0.924 0.962 0.340 0.411
0.120 0.924 0.962 0.340 0.411 1.000
1.000 0.924 0.962 0.340 0.411 1.000
1.000 0.924 0.733 0.340 0.411
1.000 0.924 0.733 0.340 0.411
0.755 0.372 0.800 0.362 0.437
0.755 0.372 0.800 0.362 0.437
0.592 0.365 0.798 0.176 0.437
0.945 0.642 0.798 0.808 0.437
0.615 0.440 0.793 0.196 0.434
0.944 0.663 0.793 0.764 0.434
1.000 1.000 1.000 1.000 0.886 1.000
1.000 1.000 1.000 1.000 0.886 1.000
0.971 0.396 1.000 0.996 1.000
1.000 0.396 1.000 0.996 1.000
Colors matching: Humans Browser automation frameworks Web Agents local Web Agents cloud V-Score: discriminative score of the dominant value for the corresponding attribute, computed as its Intra-Score multiplied by its Inter-Score. A-Score: overall discriminative score of the corresponding attribute, computed as the sum of the V-Scores of all observed values, not only the dominant one. Permissions State attribute: concatenation of states returned by the navigator.permissions.query() API for the following permissions, in order: microphone, backgroundsync, payment-handler, persistent-storage, geolocation, accelerometer, magnetometer, camera, push, clipboard-read, clipboard-write, midi, and notifications. Used abbreviations: p (prompt), g (granted), d (denied), and NS (not supported). Cookies Management attribute: tool’s ability to persist and manage browser cookies across executions. ROTATING_COOKIE: visits use a new cookie identifier (fresh session). REUSED_COOKIE: the same cookie identifier is consistently reused across visits. PARTIAL_REUSE_COOKIE: a mixture of reused and newly generated cookies. SHARED_WITH_HUMAN: at least one cookie identifier is also observed in human visits. Referer attribute: referer HTTP header, which can point to INTERNAL url or to an EXTERNAL URL. Only the second case is relevant and shown in the table. *: attribute observed exclusively for the corresponding tool, making it highly discriminative.