Intel / article

What Does It Take to Detect an AI Agent? Minimal Feature Sets for Behavioral Detection under Browser Automation

Source: arxiv.org
Author: Vishisht Choudhary, Lukas Schmidt, Anne Zo\"e Kenntner, Feras Skhab, Michel Osswald, Jens Ernstberger
Date: Published Jul 30, 2026

Context

A browser detector can appear exceptionally good at identifying AI agents because it recognizes how their automation software generates input. In a controlled study, researchers found that Playwright-driven sessions lacked the raw pointer-movement and scroll-wheel streams produced by physical input devices.

The authors report that two behavioral measurements identified every tested session across their evasion conditions, with precision of 99.4%, meaning some sessions flagged as agents were false positives. The useful result is a detectable signature of the tested browser-automation setup. It does not establish a general ability to recognize AI reasoning or every kind of automated browser.

Key takeaways · AI-distilled

The tell is a missing signal, not clever reasoning: Playwright never emits the raw pointer-move and wheel-delta streams a physical input device produces. That absence survives trajectory manipulation, including replayed real human cursor data.
Finding the minimal feature set took brute force — every subset of size 1 to 5 across 9,401 gradient-boosted models. The winning pair was mouse event rate and teleport click ratio, at 0.994 agent precision.
The signal is redundantly encoded: drop teleport click ratio entirely and agent detection still holds at 100%. A single feature is degenerate, hitting perfect recall only by collapsing into always predicting "agent".
The fix for the binary blind spot is the label space, not better features. Adding an explicit agent class produced per-class agent F1 of 1.000 in all 30 runs; five features separate all three traffic classes at macro-F1 of 0.99 or better.

Terms in this piece · Glossary

AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.

Key quotes

“Bot detectors deployed at scale treat traffic as binary: human or bot.”

“The discriminative signal is a browser-automation artifact, not evidence of agent reasoning: Playwright does not emit the raw pointer-move and wheel-delta streams a physical input device produces, and this absence signature survives trajectory manipulation.”

“Two features robustly isolate agents; five separate all three traffic classes at macro-F1 $\geq 0.99$.”

Read the source arxiv.org