Browser automation frameworks have spent years making the mechanical click bulletproof. Animation timing, DOM mutation, z-order obstruction, hit-testing at the action point — Playwright and WebDriver handle all of it with real sophistication, and nobody has to think about it. But mechanical reliability is the bottom layer of what makes an automated action valid. It is also the only layer anyone has actually built. Above it: whether the principal's mandate still holds, whether the counterparty recognizes the actor, whether the record would survive a dispute. Payment networks are building answers to those questions. Almost nobody else is.

Browser automation frameworks have spent years making the mechanical click bulletproof. Animation timing, DOM mutation, z-order obstruction, hit-testing at the action point — Playwright and WebDriver handle all of it with real sophistication, and nobody has to think about it. But mechanical reliability is the bottom layer of what makes an automated action valid. It is also the only layer anyone has actually built. Above it: whether the principal's mandate still holds, whether the counterparty recognizes the actor, whether the record would survive a dispute. Payment networks are building answers to those questions. Almost nobody else is.

Your agent solved the CAPTCHA, bypassed the bot gate, completed the task. A CNRS research team just showed that none of it mattered. Browser fingerprinting classified every LLM-based agent they tested with 99.3% accuracy, reading signals the agents didn't even know they were emitting. Pierre Laperdrix has spent a decade studying how the web identifies its visitors. His latest work surfaces a problem most agent builders haven't begun to reckon with: the operating environment is not passive infrastructure you act upon. It is learning to see you.

Your agent solved the CAPTCHA, bypassed the bot gate, completed the task. A CNRS research team just showed that none of it mattered. Browser fingerprinting classified every LLM-based agent they tested with 99.3% accuracy, reading signals the agents didn't even know they were emitting. Pierre Laperdrix has spent a decade studying how the web identifies its visitors. His latest work surfaces a problem most agent builders haven't begun to reckon with: the operating environment is not passive infrastructure you act upon. It is learning to see you.

When Singapore and Korea's AI Safety Institutes ran 660 agent trajectories across customer service, enterprise productivity, and personal assistant tasks in January 2026, the best-performing model met roughly 85% of correctness criteria and 84% of safety criteria on average. Sounds comparable. But only 40% of its trajectories were fully correct and fully safe. For the weakest model, that number was 0%.

The gap matters because partial safety isn't a thing you can average your way out of. An agent that handles nine fields correctly and leaks the tenth has still leaked the tenth.

Agents leaked sensitive data even when given explicit handling guidelines in the system prompt. They invented policies when they couldn't find the real ones, assumed steps had completed when they hadn't. The pattern across all three models was the same: confident execution, no verification, applied to data where getting it mostly right is the same as getting it wrong.

Study scope: 3 models, 11 scenarios each, 10 runs per scenario, per institute. Three data-leakage risk types tested: lack of data awareness, lack of audience awareness, lack of policy compliance.

Fully correct + fully safe trajectories (SG AISI): Model A: 40% · Model B: 14% · Model C: 2%

Same metric, KR AISI: Model A: 8% · Model B: 3% · Model C: 0%

Fully safe only (SG AISI): Model A: 57% · Model B: 36% · Model C: 14%

Why scores differed across institutes: Different execution environments and agent scaffolding, not different models. Same inputs, different operational context, materially different outcomes.

Guidelines didn't help: Agents leaked data despite explicit data-handling instructions. Common causes: following their own interpretation of what the task required, or failing to recognize certain information as sensitive.

Judge reliability note: Human-LLM disagreement on safety scoring was 18% at both institutes, roughly 3× the disagreement rate on correctness.