Pierre Laperdrix and the Web That Learned to See

Your agent bypassed the CAPTCHA. It solved the proof-of-work challenge. It navigated Cloudflare's bot protections, filled out the form, submitted the request. Task complete. And the website knew, the whole time, that it wasn't talking to a person.

A June 2026 study from CNRS and Inria threw six LLM-based web agents at layered defenses. Two of them reliably punched through everything. Then the researchers turned to browser fingerprinting, collecting signals across network, TLS, and JavaScript layers simultaneously. Classification accuracy: 99.3%. Every single agent was distinguishable from a human visitor. Not most. All.

If you are building agents that touch production websites, this should be the number that keeps you up tonight. The surface your agent operates on is watching, classifying, and getting better at both faster than your agents are getting better at hiding.

Pierre Laperdrix is a CNRS researcher, and his career traces the arc of this capability. Browser fingerprinting started as a privacy problem: could websites identify individual users by the unique stew of their browser settings, screen dimensions, installed fonts, and hardware? Laperdrix's early research on 120,000 fingerprints, which won the CNIL-Inria privacy prize, established that yes, they absolutely could. AmIUnique, the public platform he built, let anyone see how identifiable their own configuration was. The harder question followed naturally: could fingerprinting distinguish categories of visitors, not just individuals? His 2020 "Web Runner 2049" evaluation of commercial anti-bot services found that gate-based defenses stopped basic scrapers but whiffed entirely on unusual browser configurations. Fingerprinting caught what the gates missed, because it operated on a completely different surface. The accumulated texture of how a client presents itself to the world, not whether it passed a challenge.

The 2026 paper pushes this into territory that would have been absurd a few years ago: LLM agents driving real browsers, reasoning about page layouts, solving CAPTCHAs by actually looking at them. And they are still recognizable. One agent advertised itself through custom HTTP headers. Another reported 32 CPU cores. A third spoofed its user-agent string but left the JavaScript-side userAgentData untouched, creating a mismatch that made it more identifiable, not less.

That third case deserves attention. Stealth modes designed to make agents look human often increased detectability. Laperdrix's colleague Walter Rudametkin has demonstrated the same dynamic in privacy research: anti-fingerprinting measures can make a device more unique than a stock configuration. Partial evasion creates signal. You are not blending in. You are wearing a costume in a room full of people who aren't.

None of this is permanent. The agents that solved every CAPTCHA and bypassed every bot gate prove the other side of this race is moving fast. The paper's own authors note their findings may not generalize to future agents, because both the tools and the defenses evolve rapidly. What fingerprinting reveals today is the shape of a co-evolutionary contest that is nowhere near settled.

But the detection side has a decade head start. The web was built on an assumption so obvious nobody bothered to write it down: a human body was present at the keyboard. Laperdrix's work documents what happens when that assumption hardens into measurable infrastructure. For anyone building agents that interact with production websites, the implication is uncomfortable and concrete: task completion rates that ignore detection rates are measuring the wrong thing. Your agent did not succeed if it finished the task and got classified as a bot. It succeeded if it finished the task and the environment accepted the result. That is a different metric. Most teams aren't tracking it yet.