On the Internet, Nobody Knows You're an LLM Bot: Unmasking Web Agents with Multi-Layer Fingerprinting

Source: arXiv:2606.30119 · Published 2026-06-29 · By Iliana Fayolle, Sihem Bouhenniche, Samuel Pélissier, Pierre Laperdrix, Clémentine Maurice, Walter Rudametkin

TL;DR

This paper examines the problem of detecting a new generation of web bots known as LLM-based Web Agents, which leverage large language models (LLMs) combined with browser automation to perform complex, adaptive tasks on the web. Unlike traditional scrapers or browser automation frameworks, these Web Agents can solve CAPTCHAs, mimic human browsing patterns, and operate both locally and in the cloud, making them difficult to detect and block. The authors conducted an extensive empirical study deploying nine honeysites with varied anti-bot defenses (robots.txt, User-Agent filtering, CAPTCHAs, proof-of-work, Cloudflare commercial solutions) to measure Web Agent evasion ability and fingerprint characteristics across network, HTTP, and browser layers.

The study found that some Web Agents reliably bypass all tested anti-bot protections, indicating limitations of current defenses. However, multi-layer fingerprinting combining network metadata (IP, TLS), HTTP headers, and JavaScript-derived browser fingerprints can consistently differentiate Web Agents from humans and other bot classes. Surprisingly, enabling stealth or anti-detection features often increased the Web Agents' detectability due to artifacts introduced. Finally, the authors released an anonymized multi-month dataset capturing over 1,300 active visits across bots and humans, enabling fine-grained classification with high accuracy.

This work highlights the evolving threat posed by LLM-powered agents and the importance of multi-layer, technical fingerprinting combined with layered defenses, as well as calls attention to the nuanced effectiveness of anti-automation tools in light of these new adversaries.

Key findings

• Some LLM-based Web Agents (e.g., OpenClaw with sonnet-4.5, Claude Chrome sonnet-4.5) successfully bypassed all evaluated anti-bot mechanisms including CAPTCHAs, proof-of-work, and Cloudflare proprietary solutions (Table 3).
• Scrapy, an HTTP scraper honoring robots.txt, was blocked by robots.txt and User-Agent filtering, but other HTTP scrapers ignoring it were not, showing reliance on voluntary compliance (Table 3).
• All evaluated Web Agents exhibit consistent and exclusive fingerprinting patterns at network, HTTP, and browser layers; multi-layer fingerprints achieved high discrimination accuracy between humans, traditional bots, and LLM bots (§7).
• Activating stealth and anti-detection modes in open-source Web Agents like Crawl4AI and BrowserUse generally increased their detectability rather than reducing it (§6.3).
• Combining multiple anti-bot mechanisms (e.g., open-source stack with robots.txt + User-Agent + CAPTCHA + Anubis proof-of-work) improves blocking success but may degrade usability for humans and is not foolproof (§5).
• Web Agents deployed locally generate fingerprints distinguishable from those deployed in cloud environments, enabling classification of deployment mode (§6.2).
• Over 1,383 active visits yielded a rich dataset associating TLS Client Hello fingerprints, HTTP headers, and JavaScript browser fingerprints, facilitating detailed characterization (§4).
• Probability-based metrics combining intra-tool consistency and inter-tool exclusivity effectively identify discriminative fingerprint features beyond entropy metrics (§3.3).

Threat model

The adversary is an operator of advanced LLM-based Web Agents capable of controlling full browser automation stacks, solving anti-bot challenges such as CAPTCHAs and proof-of-work, and employing stealth or anti-detection mechanisms. They may deploy bots either locally on user machines or remotely in cloud environments. The adversary knows the common anti-bot defenses deployed but cannot break cryptographic primitives or fundamentally alter TLS behavior. They aim to bypass automated defenses and mimic legitimate human users to access web content at scale without detection.

Methodology — deep read

The authors study the detection and fingerprinting of LLM-based Web Agents under different anti-bot defenses. Their threat model considers advanced Web Agents leveraging LLMs that can interact with pages autonomously, solve CAPTCHAs and other challenges, mimic humans, and deploy stealth techniques. The adversary may operate bots locally or in the cloud, with knowledge of common anti-bot methods but cannot violate fundamental cryptographic assumptions.

Data were collected via nine honeysites deployed on HTTPS nginx servers with various anti-bot mechanisms: robots.txt, User-Agent blocking, Google reCAPTCHA v3, Prosopo CAPTCHA, Anubis proof-of-work, Cloudflare Turnstile, Bot Fight Mode, and Block AI Bots. Honeysites combined static & dynamic content with interactive HTML forms (requiring correct cookie and page_id submission) to verify successful bot interaction. Domains were randomized to prevent accidental human visits.

Visits included manual human browsing via Chrome and Firefox, HTTP scrapers (cURL, wget, scrapy), browser automation (Selenium, Puppeteer, Playwright), and six popular LLM-based Web Agents (including OpenClaw, Claude for Chrome, Crawl4AI, BrowserUse, ChatGPT Agent, Skyvern), deployed locally or in the cloud. Web Agents and automation frameworks were instructed to perform predefined interaction tasks, with special prompt variants tested for anti-bot evasion. Stealth/undetected modes were enabled when supported to evaluate detectability impact.

Three layers of fingerprints per visit were collected and correlated: (1) network-level (IP, TLS Client Hello via JA3 fingerprinting tool), (2) HTTP headers from Nginx logs, and (3) browser fingerprints extracted via JavaScript attributes inspired by AmIUnique and FingerprintJS. A multi-step linking process matched visits across these data streams using page_id, cookie_id, IP, and temporal windows.

Fingerprint attributes were analyzed using probability-based metrics quantifying intra-tool stability (how consistently an attribute value appears for a tool), inter-tool exclusivity (how uniquely it identifies the tool), combined into V-score and aggregated into A-score for overall discriminative power.

Bot detection success rates under different anti-bot configurations were recorded, comparing isolated and combined defenses. Stability and distinctiveness of fingerprint features were evaluated per bot class (Web Agents, scrapers, automation frameworks, humans). The ability to distinguish local vs cloud-based Web Agents was also assessed.

Evaluation spanned January to May 2026 with 1,383 associated active visits after filtering failed attempts. Experiments were automated for local agents; cloud-based agents were monitored manually due to API limitations. The authors released anonymized datasets and experimental artifacts for reproducibility. Some details (e.g., exact hyperparameters of Web Agents) are private or undocumented.

A concrete example: the honeysites served a dynamic JavaScript page with a clock and unique page_id, requiring the visiting bot to submit a POST form containing page_id and a session cookie. The Web Agent OpenClaw running locally with sonnet-4.5 successfully passed all anti-bot checks by correctly interacting with the page, submitting the form, and evading CAPTCHAs and proof-of-work challenges. The data collected from this visit included a JA3 TLS fingerprint, specific HTTP headers, and browser attributes revealing static or unique values indicative of that Web Agent, enabling its identification in the dataset.

Technical innovations

• Comprehensive multi-layer fingerprinting methodology integrating network-level TLS JA3, HTTP header analysis, and JavaScript-based browser fingerprints to detect and differentiate LLM-based Web Agents.
• Empirical large-scale evaluation of state-of-the-art commercial and open-source anti-bot defenses against modern LLM bots operating both locally and in the cloud.
• Use of probability-based metrics combining intra-tool value stability and inter-tool value exclusivity (V-score and A-score) for robust fingerprint attribute selection beyond traditional entropy measures.
• Demonstration that stealth and anti-detection modes in Web Agents often increase detectability due to distinctive artifacts in fingerprints rather than decreasing it.

Datasets

• Active visits dataset — ~1,383 visits from Jan–Feb 2026 — from multi-layer honeysites with label annotations on bot type and anti-bot success — anonymized and partially open
• Passive traffic dataset — (details in appendix, passive observations not main focus) — collected in parallel — restricted access

Baselines vs proposed

• Human baseline: >95% success rate and low detectability (treated as control group).
• Scrapy: blocked by robots.txt and User-Agent filtering (0% success) vs other HTTP scrapers: ~100% success bypassing rule-based defenses.
• OpenClaw sonnet-4.5: 100% success bypassing all anti-bot defenses vs OpenClaw opus-4.5: failed CAPTCHA click action.
• Crawl4AI gpt-4o-mini with stealth off: partial blocking success (~50%) vs stealth mode: reduced blocking but increased fingerprint detectability.
• BrowserUse cloud version with stealth: partially blocked (lower success than local) vs non-stealth mode: more blocked but less fingerprintable.
• Combination of robots.txt + User-Agent + CAPTCHA + Anubis proof-of-work blocks majority of traditional bots but not advanced Web Agents.

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2606.30119.

Fig 1: Data collection infrastructure for the deployment and instrumentation of honeysites.

Fig 2 (page 5).

Fig 3 (page 5).

Fig 4 (page 5).

Fig 5 (page 5).

Fig 6 (page 5).

Fig 7 (page 5).

Fig 8 (page 5).

Limitations

• Study excludes general-purpose LLM assistants like ChatGPT, Perplexity, Gemini due to their reliance on simplified HTTP scraping rather than full agentic browsing.
• Limited cloud-based evaluation due to manual monitoring of cloud agents (lack of automation APIs) potentially affecting scale and repeatability.
• Stealth mode implementation details are undocumented or proprietary, limiting interpretability of causes for increased detectability.
• Fingerprinting and detection rely on single-request, technical-layer observations rather than longer behavioral analysis or interaction sequences.
• Potential dataset bias from experimental honeysite design and randomized domain names, which might differ from real-world production sites.
• No explicit adversarial evaluation where Web Agents adapt dynamically to fingerprinting or anti-bot feedback in real time.

Open questions / follow-ons

• How can adaptive fingerprinting defenses evolve to counter emerging stealth techniques that inadvertently increase detectability?
• Can multi-request behavioral analysis complement multi-layer fingerprinting to improve detection under adversarial conditions?
• What specific design tradeoffs cause stealth modes to increase detectability, and how can Web Agents mitigate these artifacts?
• How generalizable are these findings across diverse real-world websites with heterogeneous content and anti-bot setups?

Why it matters for bot defense

This study highlights that LLM-powered Web Agents represent a new, more challenging class of automated clients that can surpass traditional anti-bot defenses including CAPTCHAs and proof-of-work. For bot-defense engineers working on CAPTCHA and other challenge-response mechanisms, the findings underscore the importance of layered defenses combining rule-based blocking with robust multi-layer fingerprinting at network, HTTP, and browser attributes.

Crucially, stealth and anti-detection approaches common in these Web Agents may unintuitively increase fingerprintability, suggesting that captchas and challenge designs should consider unintended fingerprint artifacts beyond just challenge difficulty. Further, distinguishing locally executed vs cloud-based agents allows for targeted mitigation strategies. These insights can inform future CAPTCHA designs and bot detection pipelines to better handle the evolving threat landscape posed by LLM-driven bots.

Cite

@article{arxiv2606_30119,
  title={ On the Internet, Nobody Knows You're an LLM Bot: Unmasking Web Agents with Multi-Layer Fingerprinting },
  author={ Iliana Fayolle and Sihem Bouhenniche and Samuel Pélissier and Pierre Laperdrix and Clémentine Maurice and Walter Rudametkin },
  journal={arXiv preprint arXiv:2606.30119},
  year={ 2026 },
  url={https://arxiv.org/abs/2606.30119}
}

Read the full paper

• arXiv:2606.30119 (abstract)
• arXiv:2606.30119 (PDF)