💻 computer science

FP-Agent: Fingerprinting AI Browsing Agents

This paper presents FP-Agent, a study demonstrating that while browser fingerprints offer limited discrimination among AI browsing agents, behavioral fingerprints derived from typing, scrolling, and mouse movements effectively distinguish these agents from humans and each other, significantly outperforming existing detection systems like Cloudflare.

Original authors: Ethan Wang, Zubair Shafiq, Yash Vekaria

Published 2026-05-05

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Ethan Wang, Zubair Shafiq, Yash Vekaria

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the internet is a giant, bustling city. For years, the police (website owners) have been trying to spot the "robots" (bots) walking around. Usually, robots were easy to catch because they moved like stiff, mechanical soldiers: they didn't blink, they walked in straight lines, and they wore identical, generic uniforms.

But now, a new kind of robot has arrived: the AI Browsing Agent. These are like robots that have been given a human brain. They can sit in a real browser, click buttons, fill out forms, and even "think" about what to do next. They look and act so much like a human that the old police methods can't tell them apart.

This paper, titled "FP-Agent," is like a new investigation technique. The researchers asked: "If these AI agents are so good at pretending to be human, can we still catch them by looking at the tiny, invisible details of how they move and type?"

Here is what they found, explained simply:

1. The "Uniform" Problem (Browser Fingerprints)

Imagine every computer has a unique ID card called a "browser fingerprint." It lists things like your screen size, your operating system, and your fonts.

The Finding: The researchers tried to catch the AI agents just by looking at these ID cards. It didn't work well.
The Analogy: It's like trying to catch a group of spies by checking their passports. If five different spies are all using the same "spy agency" computer in a cloud server, they all have the exact same passport. You can't tell them apart, and you can't even tell them apart from a human who happens to be using the same type of computer. The "ID card" alone isn't enough.

2. The "Movement" Clues (Behavioral Fingerprints)

Since the ID cards were useless, the researchers started watching how the agents moved. This is where they found the smoking gun. Even though the AI agents are smart, they move differently than humans.

Typing:
- Humans: We type with a rhythm. We pause, we hesitate, we sometimes hit backspace to fix a mistake, and our fingers move at different speeds.
- AI Agents: They are weirdly perfect or weirdly robotic. Some just "paste" whole blocks of text instantly (like a magician pulling a rabbit out of a hat). Others type with a mechanical, unchanging rhythm. One agent (Skyvern) even had a strange habit of typing a sentence, deleting it all, and then typing it again, as if it was testing different options before committing.
- The Metaphor: A human typing is like a jazz musician improvising—full of pauses, speed changes, and little mistakes. An AI typing is like a metronome or a printer—either perfectly steady or jumping instantly from start to finish.
Scrolling:
- Humans: We scroll smoothly. We glide down a page, maybe stopping to look at something, then gliding again.
- AI Agents: They don't "glide." They "teleport." They know exactly where the next button is, so they jump the screen instantly to that spot. It's like a video game character using a "fast travel" cheat code instead of walking.
Mouse Movement:
- Humans: When we move a mouse, we draw a curve. Our hand moves in a smooth arc.
- AI Agents: They don't move the mouse at all. They just "snap" the cursor directly to the button they want to click. It's like a bird landing on a branch instantly, rather than a human walking up to it.

3. The New Detective Tool: FP-Agent

The researchers built a new tool called FP-Agent. Think of it as a super-smart security guard who doesn't just check your ID card, but watches your walk, your typing style, and your hand movements.

The Results: When they tested this tool against 7 different AI agents and real humans, it was incredibly accurate. It could tell the difference between a human and an AI, and even tell the difference between different AI agents (like telling a "Claude" robot from a "ChatGPT" robot).
The Comparison: They tested this new tool against a famous security company called Cloudflare.
- Cloudflare's Guard: Caught only 1 out of 7 AI agents.
- FP-Agent: Caught all 7 AI agents.

4. Why This Matters

The paper concludes that while AI agents are getting better at looking like humans, they haven't mastered acting like humans yet. Their "digital body language" gives them away.

The Takeaway: To stop these AI agents from doing things like stealing data or buying up all the concert tickets, websites need to stop just checking "who you say you are" (like a self-declared ID) and start watching "how you move."
The Warning: The researchers note that this is an "arms race." As AI gets smarter, they might learn to type with pauses and move their mouse in curves. But for now, this new method of watching their "behavioral fingerprints" is the most effective way to spot them.

In short: You can't hide your identity if you can't hide your habits. Even if an AI wears a human's face, its "digital gait" still looks like a robot.

Technical Summary: FP-Agent: Fingerprinting AI Browsing Agents

1. Problem Statement

AI browsing agents represent an emerging class of bots that leverage Large Language Models (LLMs) to autonomously navigate websites and perform complex tasks (e.g., booking flights, shopping) using real browsers. Unlike traditional web bots, these agents mimic human workflows, making them difficult to distinguish from legitimate human traffic using conventional signals like IP addresses or User-Agent strings.

Current defense mechanisms rely heavily on voluntary self-identification (e.g., robots.txt, Web Bot Auth) or static rules. However, these approaches are insufficient because malicious operators can simply avoid identification, and even benign agents may not consistently adopt these standards. The core problem addressed by this paper is the lack of empirical understanding regarding whether existing AI browsing agents possess distinct browser and behavioral fingerprints that can reliably differentiate them from humans and from one another in a controlled setting.

2. Methodology

The authors present FP-Agent, a measurement framework designed to characterize and classify browsing agents. The methodology involves the following components:

Subjects: The study evaluates seven distinct browsing agents (five proprietary: Atlas Agent, ChatGPT Agent, Claude for Chrome, Comet, Manus; and two open-source: Browser Use, Skyvern) alongside a control group of 56 human participants.
Instrumentation: A controlled "honey website" was deployed with client-side JavaScript instrumentation. This site generates unique subpages for each visitor to isolate traffic and collect artifacts.
- Browser Fingerprints: Captured using the FingerprintJS library to gather system and browser attributes (e.g., screen resolution, fonts, plugins).
- Behavioral Fingerprints: Custom event listeners recorded interaction primitives, including typing (inter-key/hold latencies, paste vs. keystroke events), scrolling (distance, duration, burst patterns), and mouse movements (curvature, continuity).
Tasks: Three representative tasks were designed to exercise common web interaction primitives:
1. Flight Booking: Multi-step forms, date pickers, and toggles.
2. Online Shopping: Search, filtering, and cart interaction.
3. Forum Interaction: Navigation, reading, and composing long-form text.
Data Collection: 1,000 trials were conducted for each browsing agent across the three tasks. Human participants performed three repetitions of each task on their own devices.
Analysis: The collected artifacts were featurized into 418 browser features and 50 behavioral features. The authors trained XGBoost multi-class classifiers to evaluate the discriminative power of these features. They utilized SHAP (SHapley Additive exPlanations) and feature importance metrics to interpret model decisions and statistical tests (Mann-Whitney U, Brown-Forsythe) to validate differences between classes.

3. Key Findings and Results

3.1 Browser Fingerprints Offer Limited Discriminative Power

Shared Fingerprints: Multiple browsing agents (specifically Atlas Agent, Browser Use, and Claude) often share identical browser fingerprints when running on the same underlying operating systems (e.g., macOS or Windows).
Correlation with Environment: Browser fingerprints for local agents are highly correlated with the test environment (e.g., screen resolution, system type) rather than active variation. Cloud-based agents (e.g., Manus) also show stable fingerprints reflecting their specific remote execution environments.
Classification Performance: A classifier using only browser fingerprints achieved an $F_1$ score of approximately 0.80. Misclassifications occurred frequently when agents shared the same fingerprint, as the classifier defaulted to the most frequent class associated with that fingerprint in the training set.

3.2 Behavioral Fingerprints are Highly Distinctive

Behavioral features provided near-perfect discrimination, with classifiers achieving $F_1$ scores of 0.9993 (behavioral only) and 1.0000 (combined). Key distinguishing behaviors include:

Typing Behavior:
- Paste vs. Keystroke: Agents like ChatGPT Agent, Atlas Agent, and Comet predominantly use paste events (Ctrl+V or programmatic paste) rather than character-by-character typing.
- Latency Patterns: Agents using keystrokes (e.g., Manus, Skyvern, Browser Use) exhibit inter-key and hold latencies in the range of milliseconds, often with very low variance. In contrast, humans exhibit significantly higher latencies and much greater variance.
- Programmatic Quirks: Skyvern exhibits a unique pattern of typing 20 characters via keystrokes before switching to programmatic input. Browser Use generates double the number of "change events" compared to other agents due to its specific text-field clearing logic.
Scrolling Behavior:
- Non-Continuous Scrolling: Agents do not scroll smoothly. They either perform instantaneous jumps (DOM-based agents like Skyvern and Manus) or discrete, multi-burst explorations (Vision-based agents like ChatGPT Agent).
- Human Distinction: Humans exhibit longer, more variable, and continuous scrolling durations and distances compared to most agents.
Mouse Behavior:
- Teleportation: Browsing agents typically generate a single mousemove event immediately followed by a click at the target location, effectively "teleporting" the cursor.
- Continuous Movement: Humans generate continuous streams of mousemove events with measurable curvature and direction, a feature that strongly separates them from agents.

3.3 Comparison with Existing Defenses

In a case study evaluating Cloudflare's free bot management:

FP-Agent: Successfully detected and classified all seven studied browsing agents.
Cloudflare: Detected and blocked only Manus (which is a verified bot in Cloudflare's directory). The other six agents completed their tasks successfully. Cloudflare blocked some server-side requests from providers (e.g., ClaudeBot, Perplexity-User) but failed to block the local or cloud-based execution of the agents themselves.

4. Contributions

First Controlled Measurement: This is the first study to systematically measure and compare the browser and behavioral fingerprints of seven diverse AI browsing agents against human users.
FP-Agent Framework: The authors provide an extensible measurement framework and dataset (available publicly) for characterizing browsing agent traffic.
Empirical Evidence of Behavioral Distinction: The study demonstrates that while browser fingerprints are often shared or environment-dependent, behavioral fingerprints (typing, scrolling, mouse movement) contain robust, agent-specific signatures that reliably distinguish AI agents from humans and from each other.
Limitations of Current Defenses: The paper highlights that current industry defenses (like Cloudflare's) are largely ineffective against modern browsing agents that do not self-identify, whereas behavioral fingerprinting offers a viable detection mechanism.

5. Significance and Limitations

The paper argues that behavioral fingerprinting is a critical component for the reliable detection and control of AI browsing agents. It suggests that as AI automation becomes prevalent, relying solely on voluntary self-identification or static browser attributes is insufficient.

Modest Claims and Limitations:

Generalizability: The findings are based on a specific set of seven agents and three tasks. The authors acknowledge that future agents may adopt more human-like behaviors, potentially narrowing the gap in behavioral fingerprints.
Task Dependency: While behavioral classifiers performed well on seen tasks, their performance dropped on unseen tasks (e.g., $F_1$ dropping from ~0.99 to ~0.73 for behavioral-only classifiers), though the combined classifier remained robust.
Population Scope: The human data was collected from undergraduate students, which may not capture the full diversity of global human browsing behavior.
Arms Race: The authors note that detection is an ongoing arms race; while current agents are distinguishable, future iterations may actively mimic human behavioral patterns more closely.

The paper concludes that FP-Agent provides a foundation for future research into fine-grained controls and detection mechanisms for this emerging form of web traffic.