Browser agents: how sites detect them and how to pass
What a browser agent is, the 4 layers a site reads to detect the browser it drives, which stacks exist today, and what stops an agent after detection.
Davide Valli · Founder, Scalebrowser
Updated Sep 26, 2026 · 7 min read
Short answer
Your agent can plan the task, but the run ends at the page: a block before the site loads, a checkbox that never turns green, a login that is gone the next morning. None of those endings is a model problem: each one happens in the browser underneath the agent. This guide walks the path of one run, from the first TLS packet to the last click, and names at each step what a site reads and what we measured.
What is a browser agent, and what is an AI agent browser?
A browser agent is an AI agent that reads a web page and acts on it, one tool call at a time; the AI agent browser is the real browser it drives through a protocol, with its own profile that keeps logins, cookies and one identity across runs. People search for both names, and they mean the two halves of one run. The browser agent is the activity. The AI agent browser is the object: a Chromium or Firefox build, its profile on disk, and the address its traffic leaves from. How a computer use agent and a browser agent each see a page is compared in Computer use agent or browser agent.
A test browser started by Playwright or Selenium is not the same thing, even when an agent drives it. It starts empty, it is built to be recognised as automated, and nothing on it is meant to survive the run.
Which 4 layers decide whether an agent's browser gets through?
A site checks four layers, and the first one is read before any script runs. The list follows the order in which a site sees them during one page load, and each item carries one finding of ours.
- The connection. The TLS ClientHello becomes a JA4 fingerprint, specified by FoxIO with its extension list "sorted (not in the order they appear)". Our Chromium 151 build sent 16 extensions where branded Chrome 151 sent 17.
- The JavaScript fingerprint. Canvas, WebGL, fonts, screen and timezone must describe one plausible device. When we added noise to canvas readback, 5 of 5 profiles got distinct hashes and a public checker flagged the canvas as manipulated.
- The control plane. How the browser is driven leaves traces of its own. Reddit ships 9 such checks in its bundle, and lifted verbatim they catch a bare CDP driver.
- The input. Pointer paths and typing rhythm are compared with people. Injected hand tremor made our paths reverse direction 17 times as often as a person on the same bench.
| Layer | What we measured, and when | Result |
|---|---|---|
| Connection | TLS extensions of our Chromium 151 build against branded Chrome 151, 25 Aug 2026, 3 runs | 16 against 17 |
| JavaScript fingerprint | canvas hashes with seeded noise, 5 profiles on one machine, July 2026 | 5 of 5 distinct, flagged as manipulated |
| Control plane | Reddit's platform health checks lifted verbatim, 8 Sep 2026 | a bare CDP driver is caught |
| Input | direction reversals per 100 pointer samples, tremor model against a person, August 2026 | 4.5 against 0.27 |
How do sites detect an AI agent's browser?
Sites detect an agent's browser by combining the four layers, and one wrong value on a single layer can decide the result. Against PayPal's DataDome, one Accept-Language header decided between the block page and the login page in 4 of 4 of our runs on 12 August 2026. The clearest public evidence about the control plane is Ian L. Paterson's benchmark of 7 tools against 31 targets, published in May 2026. nodriver, which drives Chrome over CDP with no Playwright in between, was the only tool with no blocked target, 28 of 31 OK. Paterson's summary of the rest: "Playwright forks fail regardless of patch quality, and defeating that layer takes a control plane that is not Playwright."
Which browser stacks can run an AI agent today?
Today an agent can run in five kinds of stack, and they differ in where the browser lives, whether an identity survives the run and which control plane drives it. The table describes each kind, not a ranking. How an identity per profile differs from one per session is covered in browser-use alternative.
| Stack | Where it runs | Identity per profile across runs | Control plane |
|---|---|---|---|
| Puppeteer or Playwright with a stealth plugin | your machine | only what your code saves | Puppeteer or Playwright over CDP |
| nodriver | your machine | a fresh profile on each run | CDP directly |
| Patchright | your machine | only what your code saves | Playwright with protocol leaks patched |
| Camoufox | your machine | only what your code saves | Playwright, Firefox build |
| Cloud agent browser (Browserbase, browser-use Cloud, Steel, Kernel, Hyperbrowser) | the vendor's data centre | the vendor's context or profile feature | a CDP connect address |
Should the browser run in the cloud or on your own machine?
The browser should run where its hardware matches what it claims, and on a machine without a graphics card that claim is hard to keep. Kernel's own bot detection documentation puts it plainly: "Software-rendered browsers produce pixel hashes that don't match any real consumer GPU, which is a strong bot signal on sites with rendering-based fingerprinting." A cloud browser saves you the machine and its operation, and on a data-centre host it needs a GPU option to avoid the software renderer Kernel describes. A browser on your own machine brings a real graphics card, a real display and your own exit, and it needs the machine to stay on. It is also where an account's session stays, as with the Facebook profile in reading Facebook groups as a member, which reads and posts only in the groups its member belongs to. The costs of both are compared in Cloud browser or local browser for AI agents.
Scalebrowser runs real browser profiles on your own PC: your AI agent drives them over MCP and signs in without ever seeing a password.
Download freeWhat stops an agent after it gets past detection?
Three things stop a run after detection: a challenge, the sign-in and the token bill. Each of them has a measured answer.
A challenge is often passable in the browser itself. On live widgets with real site keys our agent solved 18 challenge types without a paid solving service, from Cloudflare Turnstile to hCaptcha image tasks; the rotation captcha and Arkose remain open.
How does an agent stay signed in between runs?
An agent stays signed in when its profile keeps cookies and passkeys between runs and when the second factor is computed where the secret lives. A TOTP code changes every 30 seconds by default under RFC 6238, so a run that waits for a person to read it from a phone waits every time. What a signed-in profile changes can be complete: on 11 October 2026 a browser signed in to a Reddit account read 10 of 10 current threads where Claude Code's web fetch read none, in a test of Reddit through a signed-in browser.
What does it cost in tokens to let an agent see a page?
A page costs as many tokens as the tool sends back after each action. On Hacker News one follow-up step cost 462 tokens with a page map that sends only what changed, and 12,494 with Playwright MCP, which sends the whole accessibility tree again. Keeping a still image of every browser step is covered in AI agent observability.
Where do you start with your own agent?
Start by measuring the layer you suspect, against a real browser on the same machine. Open the account-free check page in the browser your agent uses and once in your everyday Chrome, and compare the two. The documentation explains how a Scalebrowser profile is created, connected to an MCP client and handed to an agent.