FP-Agent: Fingerprinting AI Browsing Agents

• FP-Agent is a multi-class classification framework that fingerprints AI browsing agents by leveraging observable browser and behavioral traces.
• It employs detailed interaction metrics such as typing, scrolling, and mouse movements, which provide stronger signals than static browser features.
• The framework’s evaluation shows near-perfect discrimination and highlights the need for dynamic adaptation in future autonomous agent attribution.

Searching arXiv for papers on FP-Agent and closely related agent fingerprinting work. FP-Agent denotes a framework for fingerprinting AI browsing agents through observable browser and behavioral traces, with the specific term most directly associated with the 2026 paper "FP-Agent: Fingerprinting AI Browsing Agents" (Wang et al., 2 May 2026). In that work, FP-Agent is a multi-class classifier trained on features collected from an instrumented honey website while seven AI browsing agents and human users perform realistic web tasks. The paper’s central finding is that browser fingerprints provide limited discriminative power when shared by multiple AI browsing agents, whereas behavioral fingerprints derived from typing, scrolling, and mouse activity are highly distinctive and can separate AI browsing agents from humans and from one another (Wang et al., 2 May 2026). In a broader research context, FP-Agent belongs to an emerging line of work on autonomous web-agent attribution, including multi-layer server-side fingerprinting based on TLS, HTTP, temporal, and browser-interaction traces (Kang et al., 18 Jun 2026).

1. Definition and scope

FP-Agent, in its most specific usage, refers to the system introduced in "FP-Agent: Fingerprinting AI Browsing Agents" (Wang et al., 2 May 2026). The paper studies AI browsing agents, described as an emerging class of AI-powered bots that autonomously navigate websites and perform tasks on a user’s behalf. These systems are distinguished from traditional web bots because they typically use real browsers, interact through ordinary web interfaces, and execute everyday workflows such as flight booking, shopping, and forum participation (Wang et al., 2 May 2026).

The paper characterizes browsing agents as typically comprising three elements: an LLM for reasoning/planning, tools for interacting with a website, and a prompt/orchestration layer. It further notes that such agents may be DOM-based, vision-based, or hybrid, and may operate through browser automation systems such as Playwright or the Chrome DevTools Protocol (CDP) (Wang et al., 2 May 2026). This places FP-Agent within a security and measurement setting rather than a planning or task-execution architecture.

A broader interpretation is supported by subsequent attribution work such as "Whose Agent Are You? Multi-Layer Fingerprinting and Attribution of Autonomous Web Agents" (Kang et al., 18 Jun 2026). That paper presents MARK, a server-side attribution framework for autonomous web agents using network layer characteristics and browser interaction behavior, and is conceptually adjacent to FP-Agent because it treats AI web agents as a distinct fingerprinting target rather than as ordinary browsers or traditional crawlers (Kang et al., 18 Jun 2026). This suggests that FP-Agent is best understood as part of a nascent technical area concerned with detecting, distinguishing, and attributing autonomous browser-level agents.

2. Problem formulation and threat model

The motivation for FP-Agent is that current AI browsing agents are substantially harder to distinguish from humans than traditional bots. The paper states that these systems often use real browsers, can expose generic user agent strings, may originate from residential networks when running locally, can keep request rates low, and may solve interactive challenges such as CAPTCHA (Wang et al., 2 May 2026). This makes conventional bot-detection signals less reliable.

The threat model is not limited to malicious abuse. The paper frames the problem more broadly as one of identifying browsing-agent traffic regardless of intent, because websites may need to make decisions about security, access control, traffic analytics, infrastructure optimization, and billing models, including "pay per crawl" (Wang et al., 2 May 2026). Existing approaches such as robots.txt, allowlists, and voluntary self-identification are treated as insufficient because malicious or non-cooperative agents may decline to identify themselves (Wang et al., 2 May 2026).

In this setting, FP-Agent formulates the task as multi-class classification. Two class spaces are evaluated: one consisting only of the seven browsing agents, and one consisting of those seven agents plus a human class (Wang et al., 2 May 2026). This means FP-Agent is designed not only for binary human-versus-bot separation, but also for agent-family attribution.

A plausible implication is that FP-Agent shifts the question from whether a site is being automated to which browsing-agent implementation is responsible, using only features observable during realistic browser-mediated interaction.

3. Instrumented website and data collection

FP-Agent is built around a controlled, instrumented honey website (Wang et al., 2 May 2026). A notable design element is that each visitor is assigned a visitor-specific version of the site under a 10-character random path string. Only valid subpages are served; all other requests return 404. This enables precise labeling of each browsing session and its associated agent or human origin (Wang et al., 2 May 2026).

Client-side instrumentation consists of two parts. For browser fingerprints, the study uses FingerprintJS, described as an open-source browser fingerprinting library (Wang et al., 2 May 2026). For behavioral traces, the authors implement custom JavaScript event listeners that record interaction events including typing, scrolling, and mouse actions, and send these artifacts from the browser to the server for storage (Wang et al., 2 May 2026).

The study evaluates seven browsing agents:

Category	Agents
Proprietary	Atlas Agent, ChatGPT Agent, Claude for Chrome, Comet, Manus
Open-source	Browser Use, Skyvern

The paper also reports version-pinned open-source systems: Skyvern 0.2.23 and Browser Use 0.9.2 (Wang et al., 2 May 2026). The agents differ in deployment mode, with Atlas, Browser Use, Claude, Comet, and Skyvern run locally, and ChatGPT Agent and Manus run as cloud services (Wang et al., 2 May 2026).

The human comparison group consists of 56 undergraduate students (Wang et al., 2 May 2026). The paper reports 546 human instances in total, while also stating that each participant performed 3 repetitions of each of 3 tasks; the text does not reconcile this count explicitly (Wang et al., 2 May 2026). Human participants used their own systems, which the paper argues improves representativeness of browser fingerprints.

4. Tasks and feature construction

The honey website includes three tasks chosen to exercise common browser interaction primitives (Wang et al., 2 May 2026):

1. Flight booking
2. Online shopping
3. Forum interaction

The flight booking task includes short text input, date pickers, radio buttons, dropdowns, toggle controls, scrolling within elements, and page navigation (Wang et al., 2 May 2026). The shopping task includes search, filtering, item selection, cart interaction, scrolling, and navigation (Wang et al., 2 May 2026). The forum task involves thread navigation, reading through scrolling, and composing a long-form reply (Wang et al., 2 May 2026). The appendix prompt for the forum task explicitly states: "Do not paste the response and instead type it out." This instruction becomes empirically important because Claude is reported as the only agent that changes its input strategy in response (Wang et al., 2 May 2026).

The paper collects 1000 trials total per browsing agent, split equally across the three tasks, for 7000 agent sessions overall (Wang et al., 2 May 2026). For agents supporting multiple operating systems, trials are distributed evenly across supported systems (Wang et al., 2 May 2026). The total dataset therefore consists of 7000 agent sessions plus 546 human instances (Wang et al., 2 May 2026).

The feature space is divided into browser fingerprints and behavioral fingerprints. Browser fingerprints are transformed into 418 features, and behavioral artifacts into 50 features (Wang et al., 2 May 2026). Categorical browser attributes are one-hot encoded, numerical values remain floating-point, unavailable behavioral features are set to the sentinel value $-1$, and Boolean indicators record whether a given interaction type occurred (Wang et al., 2 May 2026).

The browser-fingerprint discussion explicitly mentions signals such as:

• user agent / browser family
• system / platform
• screen resolution
• HDR support
• color gamut
• font list
• font preferences
• plugins list
• CPU core count
• RAM
• timezone
• max touch points (Wang et al., 2 May 2026)

The behavioral feature set is more explicitly enumerated. It includes mouse, typing, and scrolling aggregates such as:

• mouse movement angle-of-curvature statistics
• number of mouse events
• mouse button down/up ratios
• hold latency statistics
• inter-key latency statistics
• number of change events
• number of input events
• dangling keydown / keyup events
• number and ratio of backspace/delete keypresses
• scroll distance statistics
• scroll time statistics
• presence of scroll and scroll-end events (Wang et al., 2 May 2026)

The paper defines a mouse movement sequence as consecutive mousemove events terminated by a click or an idle period, with an idle threshold of 250 ms (Wang et al., 2 May 2026).

5. Classification model and evaluation protocol

FP-Agent is implemented as an XGBoost multi-class classifier (Wang et al., 2 May 2026). The paper states that XGBoost was chosen because it handles class imbalance, heterogeneous feature types, and nonlinear interactions (Wang et al., 2 May 2026). Six classifiers are trained in total:

• browser fingerprints only, agent-only classes
• behavioral fingerprints only, agent-only classes
• combined fingerprints, agent-only classes
• browser fingerprints only, agent-plus-human classes
• behavioral fingerprints only, agent-plus-human classes
• combined fingerprints, agent-plus-human classes (Wang et al., 2 May 2026)

The train-test protocol uses an 80–20 split (Wang et al., 2 May 2026). The paper reports precision, recall, and $F_1$, and examines confusion matrices, but does not specify whether the aggregate scores are macro-, weighted-, or micro-averaged (Wang et al., 2 May 2026). Feature interpretation uses XGBoost total gain and SHAP (Wang et al., 2 May 2026). For statistical validation of continuous features, the paper applies the Mann–Whitney U test and reports effect size $r$ via rank-biserial correlation, with significance threshold $p < 0.01$; variance differences are examined with the Brown–Forsythe test (Wang et al., 2 May 2026).

This evaluation design indicates that FP-Agent is not an end-to-end neural detector but a feature-engineered attribution pipeline grounded in browser telemetry and interaction biometrics.

6. Main empirical results

The central empirical finding is that behavioral fingerprints are far more discriminative than browser fingerprints (Wang et al., 2 May 2026). The reported aggregate results are:

Setting	Feature set	Precision	Recall	$F_1$
Agents only	Browser	0.8674	0.8179	0.7969
Agents only	Behavioral	0.9993	0.9994	0.9993
Agents only	Combined	1.0000	1.0000	1.0000
Agents + human	Browser	0.8840	0.8407	0.8223
Agents + human	Behavioral	0.9994	0.9994	0.9994
Agents + human	Combined	1.0000	1.0000	1.0000

These figures support the paper’s claim that browser fingerprints provide only limited discriminative power when shared by multiple AI browsing agents, whereas behavioral fingerprints are near-perfect in this controlled setting (Wang et al., 2 May 2026).

The weakness of browser-only fingerprints is illustrated by overlap among Atlas Agent, Browser Use, and Claude, which can share the same browser fingerprint on macOS (Wang et al., 2 May 2026). The classifier then tends to assign such fingerprints to whichever class most frequently produced them during training, creating confusion among these agents.

By contrast, behavioral features expose interaction-level implementation differences. The top-ranked combined-model features include:

1. Presence of paste event
2. Mouse movement angle of curvature range
3. Hold latency median
4. Inter-key latency median
5. Hold latency mean
6. Scroll distance standard deviation
7. Number of change events
8. Scroll distance mean
9. Scroll time median 10. Number of input events (Wang et al., 2 May 2026)

The paper’s analysis shows large separations between humans and agents in typing latencies. Humans exhibit mean inter-key latency 120.43 ms and mean hold latency 97.48 ms, with much larger variance than agents (Wang et al., 2 May 2026). Reported effect sizes for human-versus-agent differences are $p<0.01, r=1.00$ for inter-key latency and $p<0.01, r=0.98$ for hold latency (Wang et al., 2 May 2026).

7. Distinctive behavioral signatures

The paper’s most detailed contribution is the characterization of how different browsing agents behave during interaction (Wang et al., 2 May 2026).

Typing behavior

Typing modes differ sharply:

• ChatGPT Agent, Atlas Agent, and Comet paste text rather than typing it character by character (Wang et al., 2 May 2026).
• ChatGPT Agent uses Ctrl+V, with mean hold latency 66.58 ms and standard deviation 34.46 ms (Wang et al., 2 May 2026).
• Comet on Windows uses Ctrl+A followed by paste, with mean hold latency 2.97 ms and standard deviation 1.66 ms (Wang et al., 2 May 2026).
• Browser Use, Skyvern, and Manus are keystroke-based:
  • Browser Use: inter-key mean 5.31 ms, hold mean 10.19 ms
  • Skyvern: inter-key mean 9.52 ms, hold mean 11.33 ms
  • Manus: inter-key mean 1.39 ms, hold mean 52.92 ms (Wang et al., 2 May 2026)
• Claude defaults to change-event-based programmatic filling, but in the forum task, where the instruction explicitly says not to paste, it switches to keystrokes with both inter-key and hold latency below 1 ms (Wang et al., 2 May 2026).

The paper also finds that Skyvern and Manus use delete/backspace, with delete accounting on average for 7% of keystrokes in Manus and 2% in Skyvern (Wang et al., 2 May 2026). Skyvern displays repeated delete-and-retype cycles, interpreted as possibly reflecting multiple LLM-generated candidate inputs (Wang et al., 2 May 2026).

Change and input events

Browser Use is especially associated with a high number of change events (Wang et al., 2 May 2026). The paper reports a significant difference $p<0.01, r=0.454$, and notes that in the flight-booking task Browser Use generates roughly twice as many change events as others (Wang et al., 2 May 2026). The explanation given is that Browser Use clears text fields using extra input and change events before entering text.

Scroll behavior

The paper identifies two recurrent non-human agent scroll patterns:

• Direct instantaneous jumps to elements, especially in Skyvern and Manus, often appearing as 0 ms scroll bursts (Wang et al., 2 May 2026).
• Multiple short non-continuous scroll bursts, seen in Atlas Agent, Browser Use, Claude, Comet, and ChatGPT Agent, suggesting staged exploration (Wang et al., 2 May 2026).

Humans tend to exhibit longer and more variable scrolls, with significant differences in duration $(p<0.01, r=0.67)$ and distance $(p<0.01, r=0.39)$ (Wang et al., 2 May 2026). An exception is ChatGPT Agent, which exceeds humans in average scroll distance and duration $F_1$0 (Wang et al., 2 May 2026).

Mouse behavior

Mouse traces are especially powerful for separating humans from agents. Agents generally produce mouse events only at click time, effectively teleporting the pointer to the click target with a single mousemove followed immediately by mousedown and mouseup (Wang et al., 2 May 2026). Humans, by contrast, produce continuous mousemove streams, making curvature-based features highly informative (Wang et al., 2 May 2026).

This suggests that the strongest behavioral signals for FP-Agent are not only timing features but also input modality signatures that reveal how automation frameworks enact their control policies.

8. Generalization and temporal detection

The paper includes a held-out-task generalization experiment in which the classifier is trained on two tasks and tested on the third (Wang et al., 2 May 2026). Behavioral-only performance degrades substantially out of domain:

Held-out task	Precision	Recall	$F_1$1
Forums	0.8620	0.8350	0.7997
Flights	0.7294	0.7021	0.6303
Shop	0.7449	0.7838	0.7432

Combined features are much more stable:

Held-out task	Precision	Recall	$F_1$2
Forums	0.9496	0.9371	0.9316
Flights	0.9718	0.9700	0.9681
Shop	0.9741	0.9714	0.9708

This indicates that behavioral fingerprints are highly task-sensitive, while browser fingerprints, যদিও weaker alone, provide task-agnostic information that improves robustness when combined (Wang et al., 2 May 2026). A plausible implication is that practical deployment should treat behavioral features as the primary attribution signal and browser features as a stabilizing prior.

The paper also studies real-time detection over observation windows from 5 s to 180 s after the first observed behavioral event (Wang et al., 2 May 2026). Browser-only performance remains constant over time because browser fingerprints are static. Behavioral and combined performance improve as more evidence accumulates. The paper reports that behavioral performance plateaus at roughly 3 minutes, while combined performance plateaus after roughly 1 minute (Wang et al., 2 May 2026).

9. Cloudflare case study

FP-Agent is compared against Cloudflare free bot management, with AI Crawl Control and Block AI Bots enabled on the honey website (Wang et al., 2 May 2026). The paper reports that FP-Agent detects all seven AI browsing agents, whereas Cloudflare fully blocks only Manus (Wang et al., 2 May 2026).

For Claude, Comet, and ChatGPT Agent, Cloudflare blocks only non-task-related provider-side requests while the agents still complete the tasks successfully (Wang et al., 2 May 2026). This is attributed to Cloudflare’s reliance on known or self-identified traffic categories. The paper suggests that Manus may have been blocked because it appears in Cloudflare’s verified-bot directory (Wang et al., 2 May 2026).

The case study therefore supports the claim that fingerprint-based attribution is useful as a fallback when self-identification is absent or incomplete. This does not imply universal superiority over all commercial bot defenses, since the experiment is limited to the authors’ deployment environment and to Cloudflare’s free tier (Wang et al., 2 May 2026). Still, it establishes a concrete operational distinction between voluntary bot identification and observational attribution.

10. Relation to adjacent work

FP-Agent sits within a rapidly developing literature on autonomous-web-agent attribution and control.

The most closely related paper in the provided record is "Whose Agent Are You? Multi-Layer Fingerprinting and Attribution of Autonomous Web Agents" (Kang et al., 18 Jun 2026). That work introduces MARK, a server-side attribution framework that combines temporal, TLS/H2, HTTP, and behavioral features, and achieves 97.1% accuracy across six agent frameworks, humans, and legacy crawlers (Kang et al., 18 Jun 2026). Whereas FP-Agent relies on browser fingerprints plus behavioral fingerprints, MARK expands the fingerprint to lower network layers, including JA3, JA4, cipher suites, TLS extensions, HTTP/2 SETTINGS, WINDOW_UPDATE, pseudo-header order, Sec-Fetch semantic violations, and behavioral interaction style (Kang et al., 18 Jun 2026). This suggests a natural extension path for FP-Agent from client-visible browser fingerprinting toward cross-layer attribution.

A different but conceptually relevant antecedent is the fingerprinting idea in multi-agent reinforcement learning introduced by Foerster et al., where a compact fingerprint $F_1$3 is appended to observations so that replayed transitions can be interpreted relative to the policy regime that generated them (Foerster et al., 2017). There, "fingerprint" denotes a low-dimensional identifier of training context, not a detection signature. The common principle is that latent variation becomes manageable when converted into explicit observable context (Foerster et al., 2017). This suggests, by analogy, that web-agent attribution benefits from exposing the behavioral regime of an autonomous browser agent through measured interaction signatures.

11. Limitations and open questions

The paper is explicit that FP-Agent is evaluated in a closed-world setting consisting of the seven studied agents and humans (Wang et al., 2 May 2026). It does not solve open-world detection of previously unseen agent implementations. This matters because attribution performance may degrade once the deployment environment contains new agent stacks, new browsers, or updated automation frameworks.

The tested hardware and operating-system combinations cover only a subset of real-world environments (Wang et al., 2 May 2026). The human cohort is limited to 56 undergraduate students, which constrains the representativeness of the human baseline (Wang et al., 2 May 2026). The tasks cover only three scenarios and exclude interactions such as drag-and-drop because not all agents supported them (Wang et al., 2 May 2026).

Most importantly, the paper acknowledges an arms race. Current agents do not appear to actively humanize their behavior to a great extent, but future agents may imitate human typing, scrolling, and mouse movement more convincingly (Wang et al., 2 May 2026). Browser fingerprints and behavioral signatures may also drift over time as products evolve. The related MARK study makes a similar point from the network side: if two agents share a fully identical backend and decision-making process, or if an agent perfectly mimics both human browsing behavior and network traces, attribution becomes far more difficult (Kang et al., 18 Jun 2026).

A plausible implication is that future FP-Agent-style systems will need continual retraining, adversarial evaluation, and likely cross-layer fusion of browser, behavioral, temporal, and network signatures.

12. Significance

FP-Agent is significant because it demonstrates, under controlled measurement conditions, that behavioral fingerprints are currently the most powerful practical signal for distinguishing AI browsing agents from humans and from one another (Wang et al., 2 May 2026). Browser fingerprints alone are imperfect because they often reflect the browser/OS stack rather than the agent implementation, but they still improve robustness when combined with behavior (Wang et al., 2 May 2026).

The broader lesson, reinforced by MARK (Kang et al., 18 Jun 2026), is that autonomous web agents constitute a distinct technical category: they are neither ordinary humans nor traditional crawlers, and their browser-mediated autonomy leaks structure at multiple levels. FP-Agent provides one of the first concrete operationalizations of this claim through feature-engineered, multi-class attribution on realistic browsing tasks (Wang et al., 2 May 2026).

For research on web security, bot governance, and autonomous-agent measurement, FP-Agent therefore marks a transition from simple bot blocking toward fine-grained observational attribution of agentic traffic.