AI agent browser: 4 layers sites detect and how to run past them

Your agent can plan the task, but the run ends at the page: a block before the site loads, a checkbox that never turns green, a login that is gone the next morning. None of those endings is a model problem: each one happens in the browser underneath the agent. This guide walks the path of one run, from the first TLS packet to the last click, and names at each step what a site reads and what we measured.

What is an AI agent browser?

An AI agent browser is a real browser that an agent operates through a protocol, with its own profile that keeps logins, cookies and one identity across runs. Two things carry the name. The activity is the agent reading a page and acting on it, one tool call at a time. The object is the browser itself: a Chromium or Firefox build, its profile on disk, and the address its traffic leaves from.

A test browser started by Playwright or Selenium is not the same thing, even when an agent drives it. It starts empty, it is built to be recognised as automated, and nothing on it is meant to survive the run.

Which 4 layers decide whether an agent's browser gets through?

A site checks four layers, and the first one is read before any script runs. The list follows the order in which a site sees them during one page load, and each item carries one finding of ours.

1. The connection. The TLS ClientHello becomes a JA4 fingerprint, specified by FoxIO with its extension list "sorted (not in the order they appear)". Our Chromium 151 build sent 16 extensions where branded Chrome 151 sent 17.
2. The JavaScript fingerprint. Canvas, WebGL, fonts, screen and timezone must describe one plausible device. When we added noise to canvas readback, 5 of 5 profiles got distinct hashes and a public checker flagged the canvas as manipulated.
3. The control plane. How the browser is driven leaves traces of its own. Reddit ships 9 such checks in its bundle, and lifted verbatim they catch a bare CDP driver.
4. The input. Pointer paths and typing rhythm are compared with people. Injected hand tremor made our paths reverse direction 17 times as often as a person on the same bench.

How do sites detect an AI agent's browser?

Sites detect an agent's browser by combining the four layers, and one wrong value on a single layer can decide the result. Against PayPal's DataDome, one Accept-Language header decided between the block page and the login page in 4 of 4 of our runs on 12 August 2026. The clearest public evidence about the control plane is Ian L. Paterson's benchmark of 7 tools against 31 targets, published in May 2026. nodriver, which drives Chrome over CDP with no Playwright in between, was the only tool with no blocked target, 28 of 31 OK. Paterson's summary of the rest: "Playwright forks fail regardless of patch quality, and defeating that layer takes a control plane that is not Playwright."

Which browser stacks can run an AI agent today?

Today an agent can run in five kinds of stack, and they differ in where the browser lives, whether an identity survives the run and which control plane drives it. The table describes each kind, not a ranking.

Should the browser run in the cloud or on your own machine?

The browser should run where its hardware matches what it claims, and on a machine without a graphics card that claim is hard to keep. Kernel's own bot detection documentation puts it plainly: "Software-rendered browsers produce pixel hashes that don't match any real consumer GPU, which is a strong bot signal on sites with rendering-based fingerprinting." A cloud browser saves you the machine and its operation, and on a data-centre host it needs a GPU option to avoid the software renderer Kernel describes. A browser on your own machine brings a real graphics card, a real display and your own exit, and it needs the machine to stay on.

What stops an agent after it gets past detection?

Three things stop a run after detection: a challenge, the sign-in and the token bill. Each of them has a measured answer.

A challenge is often passable in the browser itself. On live widgets with real site keys our agent solved 18 challenge types without a paid solving service, from Cloudflare Turnstile to hCaptcha image tasks; the rotation captcha and Arkose remain open.

How does an agent stay signed in between runs?

An agent stays signed in when its profile keeps cookies and passkeys between runs and when the second factor is computed where the secret lives. A TOTP code changes every 30 seconds by default under RFC 6238, so a run that waits for a person to read it from a phone waits every time.

What does it cost in tokens to let an agent see a page?

A page costs as many tokens as the tool sends back after each action. On Hacker News one follow-up step cost 462 tokens with a page map that sends only what changed, and 12,494 with Playwright MCP, which sends the whole accessibility tree again.

Where do you start with your own agent?

Start by measuring the layer you suspect, against a real browser on the same machine. Open the account-free check page in the browser your agent uses and once in your everyday Chrome, and compare the two. The documentation explains how a Scalebrowser profile is created, connected to an MCP client and handed to an agent.