AI Browsing Agent Detection: Cloudflare Misses 6 of 7

Seven AI browsing agents were sent to book flights, shop online, and post in forums. Cloudflare's bot detection caught one of them. The other six completed every task without triggering a single block.

That result comes from a controlled study, not a marketing claim, and it says something uncomfortable about where bot detection actually stands in 2026: the industry is still fingerprinting browsers, while the thing that gives an agent away is how it behaves.

The short version

• Researchers tested seven AI browsing agents — OpenAI's Atlas Browser and ChatGPT Agent, Anthropic's Claude for Chrome, Perplexity's Comet, Meta's Manus, and the open-source Browser Use and Skyvern — against Cloudflare's live bot defenses.
• Cloudflare detected only one agent (Manus). The other six finished flight-booking, shopping, and forum tasks undetected.
• A classifier built for the study, called FP-Agent, combined 418 browser fingerprint features with 50 behavioral features and hit a perfect 1.0000 precision and recall across the full dataset.
• Browser fingerprints alone were weak: 0.7969 F1. Behavioral signals alone — typing cadence, scroll rhythm, mouse micro-movement — scored 0.9993 F1 on their own.
• The classifier reached near-peak accuracy after just 60 seconds of watching a session. Detection doesn't need a long observation window once behavior is in the model.

Why does Cloudflare miss six of seven AI browsing agents?

Because it's still mostly checking the browser, not the behavior. Modern agents run on real Chromium, pass navigator.webdriver checks, and produce clean TLS/JA4 handshakes — the exact signals Cloudflare, DataDome, and Akamai were built to catch. None of that flags an agent that simply looks like a normal browser doing normal things.

The study, published as FP-Agent: Fingerprinting AI Browsing Agents in May 2026, ran 1,000 trials per agent — 7,000 agent sessions in total — against 546 human sessions from 56 undergraduate participants, all on an instrumented test site. Manus was the one agent Cloudflare flagged, and even then the paper doesn't attribute the catch to any single signal Cloudflare disclosed.

This tracks with what DataDome and Akamai have said publicly about their own stacks. DataDome now runs upwards of 85,000 customer-specific machine learning models, one per protected site, and still leans on browser-level and network-level telemetry as the first filter. If an agent's browser layer is clean, it clears that filter — full stop.

What actually separates an agent from a human, if not the browser?

Timing. FP-Agent's behavioral features — inter-keystroke intervals, scroll velocity changes, cursor jitter between clicks — hit 0.9993 F1 almost by themselves, dwarfing the 0.7969 F1 that browser fingerprints alone produced. Combined, the two feature sets hit a perfect 1.0000.

The gap makes sense once you think about what each agent is actually doing. Multiple agents built on the same underlying browser engine end up sharing near-identical fingerprint surfaces — the JavaScript environment, canvas output, and header order converge. But no two agents type, scroll, or move a cursor the same way an autonomous LLM-driven loop moves it, and none of them move the way a human does either.

How long does detection take to become reliable?

About a minute. FP-Agent's combined classifier reached near-plateau accuracy after roughly 60 seconds of observed session activity — meaning a defender doesn't need to watch an entire multi-step task play out to make a confident call. That's a much shorter window than most anti-bot teams currently budget for behavioral scoring, and it changes the calculus for anyone assuming a long enough session gives an agent room to blend in.

What this means for anyone running browser automation at scale

The uncomfortable read for the anti-bot industry is that browser-level defenses — the ones Cloudflare's default rules and most WAF products lean on — are already behind. The uncomfortable read for automation teams is the opposite: behavioral fingerprinting is coming for the layer that browser-level stealth doesn't touch. Spoofing navigator.webdriver or randomizing canvas noise, the standard playbook, does nothing against a model trained on typing cadence and scroll rhythm.

This is the exact asymmetry DLBrowser is built around — a real, unmodified browser runtime under the hood so the fingerprint layer never diverges from genuine Chromium in the first place, rather than trying to patch over a spoofed one. When defenses move to behavior, the fix isn't a better disguise; it's not needing one at the layer that's easy to check.

For deeper coverage of how these detection stacks work today, see our earlier dispatch on CDP detection and headless browser fingerprinting, and browse the research desk for more primary-source breakdowns like this one.

None of this makes agentic browsing undetectable in principle — FP-Agent proves the opposite, at a perfect F1 score, in a lab setting with cooperative logging. What it proves in practice is that production bot detection hasn't caught up to what a dedicated study can already do. Six agents out of seven walked past Cloudflare's live defenses this year. The question worth sitting with isn't whether behavioral detection works — it clearly does — it's how long the gap between "works in a paper" and "deployed at the edge" stays open.

Frequently Asked Questions

What is FP-Agent? FP-Agent is a research classifier that identifies AI browsing agents using both browser fingerprints (418 features) and behavioral fingerprints (50 features, covering typing, scrolling, and mouse movement). Combined, it reached a perfect 1.0000 F1 score across 7,000 agent sessions and 546 human sessions.

Which AI browsing agents did the study test? Seven agents: OpenAI's Atlas Browser and ChatGPT Agent, Anthropic's Claude for Chrome, Perplexity's Comet, Meta's Manus, and the open-source Browser Use and Skyvern. Each ran 1,000 trials across flight booking, shopping, and forum tasks.

Did Cloudflare actually fail to detect these agents? In this study, yes — Cloudflare's live bot detection flagged only one of the seven agents (Manus). The other six completed all assigned tasks without being blocked, despite running against Cloudflare's active defenses during the trials.

Why do behavioral fingerprints outperform browser fingerprints for detection? Agents built on the same browser engine share near-identical technical fingerprints, so that signal alone scored just 0.7969 F1. Typing cadence, scroll rhythm, and cursor movement are much harder to standardize across agents, pushing behavioral-only detection to 0.9993 F1.

Abhishek Gupta is Co-Founder at Dekrypt Labs, building DLBrowser — a stealth browser runtime for real-world data collection. dekryptlabs.com