A human types a search query at roughly 120 milliseconds between keystrokes. Claude, when prompted to type rather than paste, manages 0.56 milliseconds. Between those two numbers sits a recognition problem that most web infrastructure hasn't begun to address.
This spring, researchers at UC Davis built an instrumented website and watched seven commercially available browsing agents do ordinary things: book flights, fill out forms, shop. They collected fifty behavioral features and ran a classifier. The result: an F1 score of 0.9994 at distinguishing agents from humans based on movement alone. Cloudflare's standard bot detection, running simultaneously, caught one of the seven.
That gap points to two completely different surfaces for recognizing automated visitors. Traditional detection reads what a visitor presents: headers, TLS fingerprints, browser configuration. Behavioral detection reads how a visitor inhabits the page. And on the evidence so far, the behavioral surface is extraordinarily legible.
The specifics are striking. Three of the seven agents pasted text into form fields in a single clipboard event where a human would have produced dozens of individual keystrokes. The agents that did type held keys for as little as 1 to 11 milliseconds, with one outlier reaching 53, where humans held them for nearly 100. Mouse movement was starker still. Every tested agent produced pointer events only at the moment of clicking. Between clicks, nothing. No cursor drift, no hovering, no idle wandering. Humans leave continuous trails of motion across a page. Agents teleport. Scrolling followed the same pattern: discrete programmatic jumps, sometimes zero-duration, where humans scroll in variable, reading-paced increments.
These signatures appear to be involuntary. A companion study by Fayolle et al., published weeks later, tested agents with stealth modes explicitly enabled and found that evasion features sometimes made agents more conspicuous. Fingerprint overrides created inconsistencies that raised new suspicion. Trying to look human became its own tell. (The FP-Agent agents weren't actively mimicking human motion, so this holds for current defaults. Purpose-built mimicry is a different contest, and the arms race is young.)
Behavioral biometrics as a field has been around for years. Banks use keystroke dynamics and mouse patterns to answer "which human?" The FP-Agent research asks something prior: human at all, and if not, which agent?
Recognition at that resolution is the precondition for everything that comes after. Today the web mostly responds to detected automation in binary: block or allow. Some bot management platforms already return graduated risk scores rather than pass/fail verdicts, and operators can customize responses along a spectrum. The plumbing for differential treatment exists. What's been missing is a recognition layer precise enough to distinguish agents from each other and from humans simultaneously. If behavioral signatures can do that reliably, they begin to function as a reputation surface, a way for an agent's observable conduct to accumulate meaning across interactions the way a merchant's transaction history does.
The FP-Agent research suggests that surface is already readable in the data. Agents, it turns out, have something like involuntary body language. They move through pages with a mechanical texture they can't easily suppress and may not even know they're producing. The web can see it. What happens next is still forming.
- Stealth that backfires: Fayolle et al. found that some agents bypassed all tested anti-bot defenses while others became more detectable with stealth modes enabled, suggesting evasion engineering is far from straightforward.
- Pricing the crawler: Cloudflare's Pay Per Crawl beta lets publishers charge AI crawlers for access using HTTP 402 responses and price headers, an early signal of what differential treatment looks like when recognition meets commerce.
- Enterprise agent security: An Uber-scale deployment of Agentic Detection and Response found that conventional endpoint tools see file writes but miss agent reasoning, prompts, and causal chains, a gap that behavioral signatures alone won't close inside the firewall.
- Governance beyond connection: A recent arXiv paper argues that leading agent protocols like MCP and A2A support identity and tool access but lack primitives for voting, dissent, deliberation, and audit replay needed for governed agent communities.