Most sites still struggle to tell when a visitor is an AI agent. Tools like Muse, Claude in Chrome and ChatGPT agents use real browsers, often in a customer's signed-in session. Attackers can use similar tools with stealth browsers that make their activity look like it's coming from a person.

That uncertainty is already creating problems for businesses. Charles Schwab CEO Rick Wurster recently explained why the bank stops outside AI agents from moving client money dozens of times a week. He asked, “We can't control it, the client can't control it, something could go wrong and who's liable?” JPMorgan Chase also restricts outside agents from acting inside its systems, while Amazon has blocked Meta's Muse, saying the agent didn't identify itself as AI while browsing.

So, if you run security in your organization, you now have three important questions to ask yourself:

Is this visitor a person or an agent?
Where should it go?
And how do you stop the bad ones without slowing down your customers?

You can't answer the second or third until you've answered the first, and that's the one existing bot detection struggles with when an agent looks human. Today we're releasing Resemble Agent Detection-System One also known as RAD-S1, the System One model behind Resemble Agent Detection, built to make that first call by watching how each visitor moves, types and clicks.

Not every automated visitor is the same

Websites need to know what they're dealing with before deciding how to respond. That means distinguishing people from AI agents and understanding what each session is doing.

Agent Detection classifies each visit and identifies the likely type of visitor, from a person or computer-use agent to browser automation or a scripted client. To understand how these visitors differ, it helps to look at two questions: what are they doing, and how do they present themselves?

‍What is it doing? A bot follows a script. It might read content, like a crawler or scraper, or carry out a fixed task such as filling out a form or logging in, often at scale. An AI agent works toward a goal, like booking a flight or completing a purchase, and decides which steps to take as it goes.
How does it present itself? There are three possibilities: ‍‍Declared: It identifies itself in its user agent or a signed header, as in a Poppy session.‍Undeclared: It doesn't identify itself, but doesn't try to hide either. It leaves the usual fingerprints of browser automation tools.‍Disguised: It changes its identity or browser fingerprint to look like a regular visitor.
Declared: It identifies itself in its user agent or a signed header, as in a Poppy session.‍
Undeclared: It doesn't identify itself, but doesn't try to hide either. It leaves the usual fingerprints of browser automation tools.‍
Disguised: It changes its identity or browser fingerprint to look like a regular visitor.

Declared traffic gives you a clear signal about what you're dealing with, so you can decide how to handle it. Undeclared traffic is where traditional bot detection tools tend to be strongest. More automated traffic is designed to look like regular visitors, making disguised sessions harder to identify regardless of who's behind them or what they're trying to do. An agent might use a stealth setup without the person who sent it even knowing. This was the category we are trying to solve with Resemble’s Agent Detection.

How the model works

RAD-S1 combines a behavioral model with a set of rules. The browser only collects signals and all scoring runs on Resemble's servers.

Signals: a small script (about 25 KB) reads how the pointer moves, how clicks happen, how typing flows and how scrolling behaves, along with browser and environment signals such as request headers, automation flags and Web Bot Auth signatures from agents that identify themselves. Keys are logged by type, never the key itself, and it never collects typed text or passwords. The full signal list is in our docs.
Timing: the script sends a small batch every 1.2 seconds. The first check runs after about 5 actions or 50 pointer moves. Each server check takes about 120 ms at the median and 200 ms at the 95th percentile.
Settling: the signals combine into a probability that a person is present, plus a visitor class. Reads repeat until two agree, and the verdict is final for the rest of the visit.
Training data: sessions from Claude, Codex, Grok, ChatGPT, OpenAI Dot, Browser Use, Playwright and Muse, among others.‍
Updates: the model is versioned and updated as new agents and stealth tools appear. There's no fixed retraining schedule.

How we built the benchmark

We sent the same set of agent visits to RAD-S1 and to six widely used bot detection tools: Cloudflare Turnstile, BotD, F5, Google reCAPTCHA, Akamai and Vercel BotID. The test covered more than 2,000 agent visits across 12 website stacks, including Vue, React, Next.js and plain HTML pages.

The agent visits covered:

Commercial agents with humanized mouse movement and typing, including ChatGPT, Claude and Muse
Open-source automation, including Browser Use and Playwright runs
Stealth browsers: Camoufox (a modified Firefox), Patchright (a patched version of Playwright for Chromium) and Stealth Playwright
Session takeover, where a session starts in a clean browser and a bot takes control partway through

We measured how often each tool correctly identified an agent visit, with higher scores indicating better detection. Because every visit in the test came from an agent, the benchmark shows how much agent traffic each tool catches, not how often it mistakenly flags a real person. At its default Balanced setting, RAD-S1 currently flags around 5–6% of human visits as agents. That’s why we recommend labeling traffic before deciding what to block.

Results

The biggest takeaway we found was in detecting agents that hide their automation. Agents that don’t hide leave the usual fingerprints of automation, like automation flags or a telltale browser setup, without claiming to be anything else. All seven tools performed well against them. Detection rates ranged from 94.8% for Vercel BotID to 99.3% or more for BotD, with RAD-S1 at 98.7% or higher.

Agents that hide go out of their way to look like a normal visitor, using stealth browsers, fake browser fingerprints or a real session they’ve taken over. Here the results diverged. RAD-S1 identified 98.8% or more of these visits. The other six tools identified between 3.1% and 14.8%.

The difference comes down to what each tool looks at. Most bot detection relies on network and browser data, which is exactly what these agents are built to fake. RAD-S1 studies behavior: how the visitor moves, clicks, scrolls and types.

Agents hide in different ways, so we also tested three stealth tools and session takeover separately.

Session takeover is particularly revealing because the visit starts in a clean browser and a bot takes control partway through, so the early signals look like a normal visitor’s. The 50.2% at the top of that row is BotD, which caught about half of these visits while the other five tools caught fewer than 15%.

Why behavior is harder to fake

Stealth browsers are built to change what a browser reports about itself: its fingerprint, automation flags and user agent. That’s the information most bot detection tools rely on, so against stealth browsers, their scores drop close to zero.

What a stealth browser doesn’t change is how the visitor moves. RAD-S1 reads that movement and scores it on our servers. The signals it looks at are documented, but how the model weighs and combines them isn’t public, which makes it harder to study and work around.

Behavior can be imitated too, and some agents already try. In our test, several commercial agents, including ChatGPT, Claude and Muse, added human-like mouse movement and typing. Session takeover skips the imitation entirely: the visit starts as a real browser session, and a bot takes control partway through. No behavioral check is impossible to fake. That’s why we update the model as new agents and stealth tools appear, and why we recommend treating a verdict as one strong signal among your other controls.

Scope and known limitations

This is the first release, and we’re continuing to build out further capabilities but in the meantime:

The internal benchmark measures detection on agent visits only. At the default (balanced) setting, the model flags about 5 to 6% of human visits as agents. Sites will be able to adjust sensitivity from the dashboard to fit their needs. A new benchmark aimed at lowering the false positive and unclassified rates is in progress.
Declared agents weren't benchmarked, since they name themselves.
The results reflect 8 website stacks and the agents and stealth tools available at test time. Both change quickly.
RAD-S1 works on websites and web apps in a browser. Native mobile apps are coming soon.

What to do about it

Keep your bot detection, and add a layer for agents that hide. Existing tools handle crawlers and scripts that announce themselves well. Ask how yours performs on stealth browsers and session takeover.
Start with the flows that matter most. Disguised agents are the biggest risk where accounts and money are involved. DataDome found that monthly AI bot traffic to login pages grew more than eightfold in the first half of 2026. Login, signup and checkout are the places to look first.
Don't block every agent. Many agents on your site are your customers' agents doing legitimate work. Label traffic first, then decide page by page whether to allow it, reroute it to your API or MCP server, restrict it from sensitive areas or block destructive actions.

Detection is the first step

Banks and retailers are blocking agents today because they can't yet tell a customer's agent from an attacker's, or either one from a person. Once you can see which sessions are agents, the other two decisions become possible: which agents to welcome, where to send them and which to stop.

Standards like Sierra's Personal Agent Protocol (also known as Poppy) give declared agents a way to identify themselves and act with a customer's approval, and RAD-S1 covers the sessions that don't declare anything. If you can tell the difference, you can let the right agents in and keep the business they bring.

Getting started

Resemble Agent Detection, powered by RAD-S1, is available today and the first 1 million sessions are free. Create a free Resemble AI account and add one script tag to your site, alongside the bot detection you already run.

The dashboard will show how much of your traffic comes from people and AI agents, which pages agents reach and the reasoning behind every verdict. Agent Detection never blocks anyone on its own. Your site receives each verdict as a browser event, so you can reroute, restrict or block agents in your own code.

Try Resemble AI free

Generate with confidence. Verify ownership. Detect deception. Only with Resemble AI.

Get started