Detecting AI Agents: How Claude, ChatGPT, and Perplexity Browsers Differ from Humans

In 2024, AI agents made their move from experimental demos into production traffic. Claude's Computer Use API can drive a browser. ChatGPT's browsing tools navigate websites to answer queries. Perplexity's answer engine crawls in real time. And a growing category of AI-powered assistants — Browserbase, Anthropic's Computer Use, OpenAI Operator — do end-to-end web tasks on behalf of users.

For a website, this creates a new category of visitor that doesn't fit either bucket in traditional bot detection. AI agents are not scrapers extracting data at scale. They're not humans clicking through a UI. They're something in between — one visitor per session, one goal per visit, but executing at machine speed with mechanical precision.

Detecting them matters differently than detecting bots. Sometimes you want to serve them (a helpful agent shopping for a customer). Sometimes you want to block them (unauthorized scraping via an AI wrapper). Either way, first you have to know they're there.

How AI agents differ architecturally

Three main architectures produce AI agent traffic on the web:

Browser-driving agents run a headless or headful browser controlled by an LLM. Anthropic's Computer Use, OpenAI Operator, Browserbase, and Skyvern all fit here. The browser is real Chrome or Chromium. The agent instructs it through DOM manipulation or via screenshot analysis and coordinate clicks.

API-only agents fetch pages via HTTP libraries (Node.js, Python, Go) and pass HTML to an LLM for processing. Most Perplexity and search-based agents work this way. There is no browser — just a fetching layer feeding text to a model.

Hybrid agents use a browser for JavaScript-heavy sites and API fetching for static content. Many production agents fall into this category, dynamically choosing based on the target.

Each architecture leaves different fingerprints.

Signal 1. Browser session lifetime

Real users have long, unfocused sessions. They open tabs, get distracted, come back. Median human session duration on a decision-making task is 8–20 minutes.

AI agents have short, focused sessions. A typical Computer Use task — book a flight, order groceries, extract product data — takes 30 seconds to 3 minutes end-to-end. The session begins with page load, executes 5–30 actions in sequence, and ends.

Session duration under 5 minutes with more than 10 discrete actions and no browser tab switching is atypical human behavior and typical agent behavior.

Signal 2. Coordinate click precision

Browser-driving agents from Anthropic and OpenAI use screenshot analysis to identify UI elements, then click coordinates. The coordinate calculation is precise to the pixel.

Real users click within regions. A button that's 200x40 pixels gets clicks distributed across the full area, weighted toward the center but with human variance. AI agents click within a narrow band — often within 2–3 pixels of the geometric center of the element. A hundred clicks with mean deviation under 3 pixels is not a human distribution.

Detection requires collecting click coordinates and analyzing them relative to element bounds. This works well on session-length data.

Signal 3. Absence of exploratory scrolling

Humans scroll to see what's on a page. They scroll down, then back up, then partway. They pause at content that catches their attention. Their scroll traces are ragged.

AI agents scroll only when necessary. If the goal is to click Add to cart and the button is above the fold, the agent may never scroll at all. If the target element is below the fold, the agent scrolls once, directly to the target, then executes.

Sessions with less than 2 scroll direction changes, or with scroll velocity constant across all scroll events, indicate task-driven browsing rather than exploration.

Signal 4. Text input timing

Real users type at a rate of 30–60 words per minute, with variable pauses, occasional deletions, and micro-corrections. Keystroke timing follows a distribution with high variance and non-zero deletion rate.

AI agents fill forms by pasting values or by simulating keystrokes at a fixed cadence — often 50–100 characters per second, uniformly, with no deletions. A field filled in 200ms with a 30-character string and zero backspaces is not human input.

Signal 5. Absence of typos

Related but distinct: humans make typos. In 1000 characters of text input, real users produce 15–40 corrections. AI agents produce zero. A form submission with 3 fields totaling 100+ characters and zero corrections is unusual for a human.

Signal 6. User agent inconsistencies

Some AI agents use custom user agents that identify them explicitly: perplexity-user, ChatGPT-User, ClaudeBot. These are polite agents that follow the convention of self-identification and often respect robots.txt.

Detection here is trivial — read the user agent, match against known lists. The value is knowing when to serve them differently (or block them if you don't want scraping).

Other agents run browser-driving frameworks and inherit whatever user agent the browser uses — typically Chrome. These are harder to identify from user agent alone and require behavioral signals.

Signal 7. WebGL rendering under headless

Browser-driving agents that use Chromium in headless mode expose the SwiftShader renderer we discussed in the Puppeteer article. Any session where the WebGL renderer contains SwiftShader and the visitor executes 10+ deliberate actions is almost certainly a browser-driving AI agent.

Newer agent frameworks (Browserbase, some Skyvern setups) run headful Chrome to avoid this signal. They present real GPU strings. This means WebGL alone is insufficient for detection of modern agents — necessary as a starting filter, not a complete solution.

Signal 8. Perfect adherence to page structure

Real users click links even when there's a page redirect happening. They interrupt themselves. They double-click when a single click would suffice. They click on things that aren't links.

AI agents follow the DOM. When they want to navigate, they issue an action against a specific element. They don't click on the wrong element or refresh mid-load. Their sessions unfold with mechanical linearity that no distracted human produces.

Session traces with perfect adherence — every click on a valid element, every form field filled in DOM order, every page transition preceded by intentional action — read as agent-driven.

Signal 9. Time-to-interactive is zero

Real users need time to process a page. They read. They scan. They understand before they act.

AI agents parse the DOM instantly. The time between page load complete and first user action, for a real user, is typically 1.5–4 seconds even on simple pages. For AI agents, it can be under 200ms — the time it takes the LLM to identify the target element in the DOM.

Very fast first-action time on a page requiring content comprehension is a strong agent signal.

Signal 10. HTTP fetch patterns for API-only agents

Perplexity, some Claude tool-use flows, and most search-based agents don't run browsers. They fetch pages directly via HTTP libraries.

These agents leave the TLS and HTTP signals we discussed earlier — Node.js undici fingerprint, Python requests fingerprint, Go net/http fingerprint. They typically don't execute JavaScript, so they don't trigger client-side detection at all.

Detection for API-only agents happens at the network layer: TLS JA4 hashes, HTTP header ordering, missing browser-specific behaviors (no favicon fetch, no analytics beacon, no font requests). If you want to identify these agents, you have to look at what's not happening as much as what is.

Signal 11. Task-shaped session goals

The strongest signal isn't technical — it's behavioral. AI agent sessions are goal-directed in ways human sessions rarely are.

A real user searching for a product may look at 8 items, compare specs across 3 tabs, read reviews, abandon and return an hour later, then buy. An AI agent goes to the product, extracts the specs, adds to cart, checks out. Under 90 seconds. No deviation.

Detection systems that track session-level goal completion rates can identify agent traffic by the density of successful task completion in short sessions. This is a slower signal but a highly reliable one when combined with per-action signals.

Serving agents differently

Once identified, AI agent traffic can be handled several ways:

• Block — if the site doesn't want automated access, deny at the edge. Cheap and simple.

• Serve alternate content — respond with an API-optimized version (JSON, structured data) that's cheaper to generate than the full HTML page.

• Rate-limit — allow agents but constrain their request rate to preserve site performance.

• Charge — some sites are starting to charge AI companies for programmatic access to their data. Detection is prerequisite to billing.

• Serve normally — if the agent is acting on behalf of a real customer, serving them is business.

Different sites will make different choices. What matters technically is having the detection in place so the choice is available.

The moving target

AI agent frameworks improve monthly. Anthropic ships updates to Computer Use that add scroll variance. Browserbase adds mouse jitter. OpenAI Operator introduces typo simulation. Each generation of framework closes some of the detection surface described above.

The techniques that work in 2026 will need updating by 2027. But the underlying reality won't change: AI agents execute tasks. Humans experience websites. That asymmetry produces signal, whatever the specific techniques agents use to try to blend in.

Detection stacks that treat AI agents as a persistent, evolving category — rather than a one-time solved problem — will maintain visibility. Those that ship a single detector and move on will find their coverage silently degrading.