Andrii Bidochko

• Updated: July 4, 2026
• 6 min read

Whose Agent Are You? Multi-Layer Fingerprinting and Attribution of Autonomous Web Agents

Direct Answer

The paper introduces a cross‑layer fingerprinting framework that can reliably identify autonomous AI web agents—such as those built on Claude, Gemini, or AutoGen—by examining both network‑level signals (TLS handshakes, HTTP headers) and browser‑interaction patterns. This matters because it gives website operators a practical, evasion‑resistant tool to protect content and enforce security policies against increasingly sophisticated AI‑driven scrapers.

Background: Why This Problem Is Hard

AI‑powered web agents have moved beyond simple crawlers. Modern agents combine large language models (LLMs) with full browser control, allowing them to navigate pages, fill forms, and extract data in a human‑like manner. The rise of such agents creates three intertwined challenges:

• Privacy leakage: Unchecked scraping can harvest personal data, violating regulations like GDPR.
• Intellectual‑property theft: Proprietary articles, product specifications, or pricing tables can be harvested at scale.
• Security evasion: Traditional defenses—robots.txt, CAPTCHAs, IP‑rate limiting—are either ignored or easily bypassed by programmable agents.

Existing defenses suffer from two fundamental weaknesses:

1. Static nature: Robots.txt is a voluntary contract; autonomous agents can simply disregard it.
2. Surface‑level detection: Bot‑blocking services focus on user‑agent strings, request frequency, or simple JavaScript challenges, which LLM‑driven agents can mimic or solve using headless browsers.

Consequently, web operators lack a robust, low‑overhead method to differentiate genuine human traffic from sophisticated AI agents, especially when those agents deliberately mask their identity.

What the Researchers Propose

The authors present a Multi‑Layer Fingerprinting (MLF) framework that fuses two orthogonal observation planes:

• Network‑layer fingerprint: Characteristics extracted from the TLS handshake (cipher suites, elliptic‑curve choices), HTTP/2 framing, and header ordering.
• Browser‑interaction fingerprint: Timing of DOM events, mouse‑move trajectories, scroll patterns, and the sequence of JavaScript‑initiated network calls.

By treating each observation as a feature vector, the framework feeds the combined data into a lightweight decision‑tree classifier. The classifier learns to map subtle, architecture‑specific quirks—such as how AutoGen re‑uses a single TLS session across multiple tabs—to a label that identifies the originating agent framework.

Key components of the proposal include:

1. Instrumentation layer: A server‑side logging module that captures TLS metadata and HTTP headers without modifying client code.
2. Browser shim: A thin JavaScript payload injected into pages to record interaction events and send them back to the logging backend.
3. Feature aggregator: A pipeline that normalizes raw signals, aligns timestamps, and constructs the final feature set for classification.

How It Works in Practice

The end‑to‑end workflow can be visualized as a three‑stage pipeline:

1. Connection capture: When a client initiates a TLS handshake, the server logs the chosen cipher suite, elliptic‑curve group, and session ticket details. Simultaneously, the HTTP request line and header ordering are recorded.
2. Interaction logging: After the page loads, the injected JavaScript begins streaming event data (mouse moves, clicks, scroll offsets, and timing of AJAX calls) to a dedicated endpoint. The payload is deliberately lightweight to avoid performance penalties.
3. Classification & response: The feature aggregator merges network and interaction data, runs the decision‑tree model, and returns a confidence score. If the score exceeds a configurable threshold, the server can trigger a policy action—such as serving a CAPTCHA, throttling the session, or logging the incident for forensic review.

What sets this approach apart is its cross‑layer resilience. Even if an agent spoofs its user‑agent string or mimics human mouse movements, the underlying TLS handshake often reveals implementation‑specific defaults (e.g., OpenSSL version, ALPN negotiation order) that are difficult to alter without breaking the agent’s stability. Conversely, network‑only detection would miss agents that deliberately randomize TLS parameters, but their browser‑level behavior still betrays their automated nature.

Evaluation & Results

The researchers deployed the MLF framework on a live, instrumented domain and collected traffic from six widely used autonomous agent frameworks:

• AutoGen
• Browser Use
• Claude
• Gemini
• Operator
• Skyvern

For comparison, they also gathered baseline traffic from:

• Human browsers (Chrome, Firefox, Safari)
• Legacy crawlers (Googlebot, Bingbot)

Key evaluation steps included:

1. Feature extraction: Over 120 distinct attributes spanning TLS, HTTP/2, and interaction timing were harvested.
2. Model training: A CART decision‑tree was trained on 70% of the dataset, with the remaining 30% reserved for hold‑out testing.
3. Robustness checks: The authors introduced adversarial modifications—randomized cipher suites, injected artificial mouse jitter—to assess evasion resistance.

The results were striking:

• Overall accuracy: 97% correct identification of the originating agent framework.
• Human vs. agent separation: 99.2% true‑negative rate, meaning genuine users were rarely misclassified.
• Evasion resilience: Even when agents altered TLS parameters, the combined fingerprint retained >94% accuracy, confirming the benefit of cross‑layer data.

These findings demonstrate that a relatively simple, interpretable model can achieve near‑perfect discrimination without resorting to heavyweight deep‑learning classifiers, making the solution practical for real‑time deployment.

Why This Matters for AI Systems and Agents

For organizations that expose valuable content or run mission‑critical web services, the ability to reliably flag autonomous agents opens new defensive possibilities:

• Dynamic policy enforcement: Sites can automatically downgrade or block traffic from identified agents, protecting APIs and pricing pages from mass scraping.
• Compliance auditing: Detailed logs of agent fingerprints provide evidence for regulatory reporting on data‑access attempts.
• Agent‑aware design: Developers of AI agents can use the fingerprinting signals as a feedback loop, hardening their tools against detection when legitimate use cases require stealth.

Beyond security, the framework can inform UBOS platform overview features that need to differentiate between human‑driven workflows and automated bots. For example, the Workflow automation studio could embed fingerprint checks before triggering downstream actions, ensuring that only verified human inputs drive critical business processes.

Marketing teams building AI marketing agents can also benefit: by recognizing when a competitor’s scraper is probing their landing pages, they can adapt content delivery or invoke the ChatGPT and Telegram integration to alert security operators in real time.

What Comes Next

While the study proves the concept, several avenues remain open for refinement:

• Broader agent ecosystem: Extending the dataset to include emerging open‑source agents and custom‑built bots will improve generalization.
• Adaptive learning: Incorporating online learning techniques could allow the classifier to evolve as agents adopt new evasion tactics.
• Privacy‑preserving logging: Designing the instrumentation to comply with privacy regulations (e.g., differential privacy) will ease adoption for privacy‑sensitive sites.
• Integration with existing security stacks: Embedding the fingerprinting service into Web Application Firewalls (WAFs) or CDN edge nodes could provide near‑instant mitigation.

Future research might also explore how multi‑layer fingerprints interact with OpenAI ChatGPT integration scenarios, where a conversational AI directly drives a browser session. Understanding whether conversational context leaks additional signals could further tighten detection.

Finally, the authors encourage the community to release open datasets of agent traffic, fostering a collaborative defense ecosystem that stays ahead of the rapid innovation cycle in autonomous web agents.

For a deeper dive into the methodology and raw results, consult the original arXiv paper.

Andrii Bidochko

CTO UBOS

Andrii Bidochko is an AI entrepreneur and researcher focused on AI agents, reinforcement learning, and autonomous systems. He writes about the technologies shaping the future of machine intelligence, from frontier models and agent architectures to real-world AI applications.