Skip to content
LR Defender
Book a demo

BOTS AND AI AGENTS

Tell people from scripts. Including AI agents that drive a real browser.

Every identification checks for headless browsers, WebDriver and automation frameworks, and a behavioral model scores pointer movement. Detection for AI agents in a real browser is on by default, and you can switch it off for your account. The bot checks recommend a block for clear automation and a challenge for ambiguous automation.

Book a demoMove your pointer
Sessions / ses_5f1c09 / Bot checksExample data

01Hard signals

  1. navigator.webdriver is true

    fact

  2. Headless browser signals present

    fact

02Model fusion

  1. Pointer movement reads as automated

    model
    behavioral model, joined with the signals above

03Heuristics

  1. Keystrokes arrive at machine-even intervals

    inference

  2. Browser features contradict the user agent

    inference
Two hard signals. A block needs at least one.block
  • Three detection layers
  • A block needs a hard signal
  • Thresholds you can tune
  • Agent detection per account

HOW IT WORKS

Three layers.

  1. 01

    Hard signals.

    WebDriver flags, headless browsers and automation environments. These can block on their own.
  2. 02

    Model fusion.

    A behavioral model scores pointer movement and joins it with the other signals.
  3. 03

    Heuristics.

    Timing and consistency checks that catch what a single signal misses.

A block from the bot layers needs at least one hard signal. Odd movement alone earns a challenge.

AI AGENTS IN A REAL BROWSER

Agents that drive a genuine browser pass the classic checks. Unless you switch this off, we look for the DevTools protocol side channel, WebDriver traces across page realms, synthetic input events, and sessions with no genuine interaction at all. Strong evidence blocks. Ambiguous evidence raises a challenge, so a person with DevTools open is not blocked. Signed agents are checked on every identification: when OpenAI's ChatGPT agent or Google-Agent signs its requests with Web Bot Auth, we verify the signature against the keys the agent publishes, and the verdict names the agent. A signature that does not verify is reported as an unverified agent, never trusted.

Talk to an engineer about it
Sessions / ses_7a93d2 / AI agent checksExample data

  1. DevTools protocol side channel open

    inference

  2. Clicks arrived as synthetic input events

    inference

  3. No genuine interaction in the session

    inference
Strong agent evidence blocks. Ambiguous evidence raises a challenge.block

TYPED OR PASTED

For each form field, we count characters typed versus pasted or dropped. We never read the text itself, and autofill is not flagged. It is useful on sign-up forms and free-text answers.

See it on the survey page
Typed or pasted / this browserLive, this browser

Live demo

Bot checks / your pointerLive, this browser

Spec

Detection layers
3: hard signals, model fusion, heuristics
Actions
Allow, challenge, block
Block rule
At least one hard signal
Thresholds
Tunable per account
AI agent detection
On by default, can be switched off per account
Input integrity
Counts and lengths only, never text

Limits

FAQ

Only if you put one there. We return challenge; your flow decides what the step-up is.

They can trip consistency checks. That is why ambiguous signals earn a challenge, not a block.

Their default setups expose WebDriver and headless signals, which are hard signals. Stealth plugins try to hide them. We publish only the setups we have tested.

Yes, for your account, in the dashboard.

Yes, for your account, under Detection settings in the dashboard. It is on by default, and an engineer can tell you what to watch in the first week.

Keep scripts out of your forms.

Book a demoTalk to an engineer