---
title: 'FP-Agent: Fingerprinting AI Browsing Agents'
url: https://www.emergentmind.com/topics/fp-agent
type: topic
---

# FP-Agent: Fingerprinting AI Browsing Agents

Searching arXiv for recent papers on FP-Agent and closely related agent fingerprinting work.
FP-Agent denotes a framework for **fingerprinting AI browsing agents** through observable browser and behavioral traces, with the specific term most directly associated with the 2026 paper "FP-Agent: Fingerprinting AI Browsing Agents" [2605.01247]. In that work, FP-Agent is a **multi-class classifier** trained on features collected from an instrumented honey website while seven AI browsing agents and human users perform realistic web tasks. The paper’s central finding is that **browser fingerprints provide limited discriminative power when shared by multiple AI browsing agents**, whereas **behavioral fingerprints** derived from typing, scrolling, and mouse activity are highly distinctive and can separate AI browsing agents from humans and from one another [2605.01247]. In a broader research context, FP-Agent belongs to an emerging line of work on autonomous web-agent attribution, including multi-layer server-side fingerprinting based on TLS, HTTP, temporal, and browser-interaction traces [2606.20910].

## 1. Definition and scope

FP-Agent, in its most specific usage, refers to the system introduced in "FP-Agent: Fingerprinting AI Browsing Agents" [2605.01247]. The paper studies **AI browsing agents**, described as an emerging class of AI-powered bots that autonomously navigate websites and perform tasks on a user’s behalf. These systems are distinguished from traditional web bots because they typically use **real browsers**, interact through ordinary web interfaces, and execute everyday workflows such as flight booking, shopping, and forum participation [2605.01247].

The paper characterizes browsing agents as typically comprising three elements: **an LLM for reasoning/planning**, **tools for interacting with a website**, and **a prompt/orchestration layer**. It further notes that such agents may be **DOM-based**, **vision-based**, or **hybrid**, and may operate through browser automation systems such as **Playwright** or the **Chrome DevTools Protocol (CDP)** [2605.01247]. This places FP-Agent within a security and measurement setting rather than a planning or task-execution architecture.

A broader interpretation is supported by subsequent attribution work such as "Whose Agent Are You? Multi-Layer Fingerprinting and Attribution of Autonomous Web Agents" [2606.20910]. That paper presents **MARK**, a server-side attribution framework for autonomous web agents using **network layer characteristics** and **browser interaction behavior**, and is conceptually adjacent to FP-Agent because it treats AI web agents as a distinct fingerprinting target rather than as ordinary browsers or traditional crawlers [2606.20910]. This suggests that FP-Agent is best understood as part of a nascent technical area concerned with **detecting, distinguishing, and attributing autonomous browser-level agents**.

## 2. Problem formulation and threat model

The motivation for FP-Agent is that current AI browsing agents are substantially harder to distinguish from humans than traditional bots. The paper states that these systems often use **real browsers**, can expose generic **user agent strings**, may originate from **residential networks** when running locally, can keep request rates low, and may solve interactive challenges such as CAPTCHA [2605.01247]. This makes conventional bot-detection signals less reliable.

The threat model is not limited to malicious abuse. The paper frames the problem more broadly as one of identifying browsing-agent traffic regardless of intent, because websites may need to make decisions about **security**, **access control**, **traffic analytics**, **infrastructure optimization**, and **billing models**, including "pay per crawl" [2605.01247]. Existing approaches such as `robots.txt`, allowlists, and voluntary self-identification are treated as insufficient because malicious or non-cooperative agents may decline to identify themselves [2605.01247].

In this setting, FP-Agent formulates the task as **multi-class classification**. Two class spaces are evaluated: one consisting only of the seven browsing agents, and one consisting of those seven agents plus a **human** class [2605.01247]. This means FP-Agent is designed not only for binary human-versus-bot separation, but also for **agent-family attribution**.

A plausible implication is that FP-Agent shifts the question from *whether* a site is being automated to *which browsing-agent implementation is responsible*, using only features observable during realistic browser-mediated interaction.

## 3. Instrumented website and data collection

FP-Agent is built around a **controlled, instrumented honey website** [2605.01247]. A notable design element is that each visitor is assigned a **visitor-specific version** of the site under a **10-character random path string**. Only valid subpages are served; all other requests return 404. This enables precise labeling of each browsing session and its associated agent or human origin [2605.01247].

Client-side instrumentation consists of two parts. For browser fingerprints, the study uses **FingerprintJS**, described as an open-source browser fingerprinting library [2605.01247]. For behavioral traces, the authors implement custom JavaScript event listeners that record interaction events including **typing**, **scrolling**, and **mouse actions**, and send these artifacts from the browser to the server for storage [2605.01247].

The study evaluates **seven browsing agents**:

| Category | Agents |
|---|---|
| Proprietary | Atlas Agent, ChatGPT Agent, Claude for Chrome, Comet, Manus |
| Open-source | Browser Use, Skyvern |

The paper also reports version-pinned open-source systems: **Skyvern 0.2.23** and **Browser Use 0.9.2** [2605.01247]. The agents differ in deployment mode, with **Atlas, Browser Use, Claude, Comet, and Skyvern** run locally, and **ChatGPT Agent** and **Manus** run as cloud services [2605.01247].

The human comparison group consists of **56 undergraduate students** [2605.01247]. The paper reports **546 human instances** in total, while also stating that each participant performed **3 repetitions** of each of **3 tasks**; the text does not reconcile this count explicitly [2605.01247]. Human participants used their own systems, which the paper argues improves representativeness of browser fingerprints.

## 4. Tasks and feature construction

The honey website includes **three tasks** chosen to exercise common browser interaction primitives [2605.01247]:

1. **Flight booking**
2. **Online shopping**
3. **Forum interaction**

The **flight booking** task includes short text input, date pickers, radio buttons, dropdowns, toggle controls, scrolling within elements, and page navigation [2605.01247]. The **shopping** task includes search, filtering, item selection, cart interaction, scrolling, and navigation [2605.01247]. The **forum** task involves thread navigation, reading through scrolling, and composing a long-form reply [2605.01247]. The appendix prompt for the forum task explicitly states: **"Do not paste the response and instead type it out."** This instruction becomes empirically important because **Claude** is reported as the only agent that changes its input strategy in response [2605.01247].

The paper collects **1000 trials total per browsing agent**, split equally across the three tasks, for **7000 agent sessions** overall [2605.01247]. For agents supporting multiple operating systems, trials are distributed evenly across supported systems [2605.01247]. The total dataset therefore consists of **7000 agent sessions** plus **546 human instances** [2605.01247].

The feature space is divided into **browser fingerprints** and **behavioral fingerprints**. Browser fingerprints are transformed into **418 features**, and behavioral artifacts into **50 features** [2605.01247]. Categorical browser attributes are **one-hot encoded**, numerical values remain floating-point, unavailable behavioral features are set to the sentinel value **\(-1\)**, and Boolean indicators record whether a given interaction type occurred [2605.01247].

The browser-fingerprint discussion explicitly mentions signals such as:

- **user agent / browser family**
- **system / platform**
- **screen resolution**
- **HDR support**
- **color gamut**
- **font list**
- **font preferences**
- **plugins list**
- **CPU core count**
- **RAM**
- **timezone**
- **max touch points** [2605.01247]

The behavioral feature set is more explicitly enumerated. It includes mouse, typing, and scrolling aggregates such as:

- mouse movement angle-of-curvature statistics
- number of mouse events
- mouse button down/up ratios
- hold latency statistics
- inter-key latency statistics
- number of change events
- number of input events
- dangling keydown / keyup events
- number and ratio of backspace/delete keypresses
- scroll distance statistics
- scroll time statistics
- presence of scroll and scroll-end events [2605.01247]

The paper defines a **mouse movement sequence** as consecutive `mousemove` events terminated by a click or an idle period, with an idle threshold of **250 ms** [2605.01247].

## 5. Classification model and evaluation protocol

FP-Agent is implemented as an **XGBoost** multi-class classifier [2605.01247]. The paper states that XGBoost was chosen because it handles **class imbalance**, **heterogeneous feature types**, and **nonlinear interactions** [2605.01247]. Six classifiers are trained in total:

- browser fingerprints only, agent-only classes
- behavioral fingerprints only, agent-only classes
- combined fingerprints, agent-only classes
- browser fingerprints only, agent-plus-human classes
- behavioral fingerprints only, agent-plus-human classes
- combined fingerprints, agent-plus-human classes [2605.01247]

The train-test protocol uses an **80–20 split** [2605.01247]. The paper reports **precision**, **recall**, and **\(F_1\)**, and examines **confusion matrices**, but does not specify whether the aggregate scores are macro-, weighted-, or micro-averaged [2605.01247]. Feature interpretation uses **XGBoost total gain** and **SHAP** [2605.01247]. For statistical validation of continuous features, the paper applies the **Mann–Whitney U test** and reports effect size \(r\) via **rank-biserial correlation**, with significance threshold \(p < 0.01\); variance differences are examined with the **Brown–Forsythe test** [2605.01247].

This evaluation design indicates that FP-Agent is not an end-to-end neural detector but a feature-engineered attribution pipeline grounded in browser telemetry and interaction biometrics.

## 6. Main empirical results

The central empirical finding is that **behavioral fingerprints are far more discriminative than browser fingerprints** [2605.01247]. The reported aggregate results are:

| Setting | Feature set | Precision | Recall | \(F_1\) |
|---|---|---:|---:|---:|
| Agents only | Browser | 0.8674 | 0.8179 | 0.7969 |
| Agents only | Behavioral | 0.9993 | 0.9994 | 0.9993 |
| Agents only | Combined | 1.0000 | 1.0000 | 1.0000 |
| Agents + human | Browser | 0.8840 | 0.8407 | 0.8223 |
| Agents + human | Behavioral | 0.9994 | 0.9994 | 0.9994 |
| Agents + human | Combined | 1.0000 | 1.0000 | 1.0000 |

These figures support the paper’s claim that browser fingerprints provide only **limited discriminative power when shared by multiple AI browsing agents**, whereas behavioral fingerprints are near-perfect in this controlled setting [2605.01247].

The weakness of browser-only fingerprints is illustrated by overlap among **Atlas Agent**, **Browser Use**, and **Claude**, which can share the same browser fingerprint on macOS [2605.01247]. The classifier then tends to assign such fingerprints to whichever class most frequently produced them during training, creating confusion among these agents.

By contrast, behavioral features expose interaction-level implementation differences. The top-ranked combined-model features include:

1. **Presence of paste event**
2. **Mouse movement angle of curvature range**
3. **Hold latency median**
4. **Inter-key latency median**
5. **Hold latency mean**
6. **Scroll distance standard deviation**
7. **Number of change events**
8. **Scroll distance mean**
9. **Scroll time median**
10. **Number of input events** [2605.01247]

The paper’s analysis shows large separations between humans and agents in typing latencies. Humans exhibit mean **inter-key latency 120.43 ms** and mean **hold latency 97.48 ms**, with much larger variance than agents [2605.01247]. Reported effect sizes for human-versus-agent differences are \(p<0.01, r=1.00\) for inter-key latency and \(p<0.01, r=0.98\) for hold latency [2605.01247].

## 7. Distinctive behavioral signatures

The paper’s most detailed contribution is the characterization of how different browsing agents behave during interaction [2605.01247].

### Typing behavior

Typing modes differ sharply:

- **ChatGPT Agent, Atlas Agent, and Comet** paste text rather than typing it character by character [2605.01247].
- **ChatGPT Agent** uses **Ctrl+V**, with mean hold latency **66.58 ms** and standard deviation **34.46 ms** [2605.01247].
- **Comet** on Windows uses **Ctrl+A** followed by paste, with mean hold latency **2.97 ms** and standard deviation **1.66 ms** [2605.01247].
- **Browser Use, Skyvern, and Manus** are keystroke-based:
  - Browser Use: inter-key mean **5.31 ms**, hold mean **10.19 ms**
  - Skyvern: inter-key mean **9.52 ms**, hold mean **11.33 ms**
  - Manus: inter-key mean **1.39 ms**, hold mean **52.92 ms** [2605.01247]
- **Claude** defaults to **change-event-based** programmatic filling, but in the forum task, where the instruction explicitly says not to paste, it switches to keystrokes with both inter-key and hold latency **below 1 ms** [2605.01247].

The paper also finds that **Skyvern** and **Manus** use delete/backspace, with delete accounting on average for **7%** of keystrokes in Manus and **2%** in Skyvern [2605.01247]. Skyvern displays repeated **delete-and-retype cycles**, interpreted as possibly reflecting multiple LLM-generated candidate inputs [2605.01247].

### Change and input events

**Browser Use** is especially associated with a high number of **change events** [2605.01247]. The paper reports a significant difference \(p<0.01, r=0.454\), and notes that in the flight-booking task Browser Use generates roughly **twice as many change events** as others [2605.01247]. The explanation given is that Browser Use clears text fields using extra input and change events before entering text.

### Scroll behavior

The paper identifies two recurrent non-human agent scroll patterns:

- **Direct instantaneous jumps to elements**, especially in **Skyvern** and **Manus**, often appearing as 0 ms scroll bursts [2605.01247].
- **Multiple short non-continuous scroll bursts**, seen in **Atlas Agent**, **Browser Use**, **Claude**, **Comet**, and **ChatGPT Agent**, suggesting staged exploration [2605.01247].

Humans tend to exhibit longer and more variable scrolls, with significant differences in duration \((p<0.01, r=0.67)\) and distance \((p<0.01, r=0.39)\) [2605.01247]. An exception is **ChatGPT Agent**, which exceeds humans in average scroll distance and duration \((p<0.01, r=0.35)\) [2605.01247].

### Mouse behavior

Mouse traces are especially powerful for separating humans from agents. Agents generally produce mouse events **only at click time**, effectively teleporting the pointer to the click target with a single `mousemove` followed immediately by `mousedown` and `mouseup` [2605.01247]. Humans, by contrast, produce continuous `mousemove` streams, making curvature-based features highly informative [2605.01247].

This suggests that the strongest behavioral signals for FP-Agent are not only timing features but also **input modality signatures** that reveal how automation frameworks enact their control policies.

## 8. Generalization and temporal detection

The paper includes a held-out-task generalization experiment in which the classifier is trained on two tasks and tested on the third [2605.01247]. Behavioral-only performance degrades substantially out of domain:

| Held-out task | Precision | Recall | \(F_1\) |
|---|---:|---:|---:|
| Forums | 0.8620 | 0.8350 | 0.7997 |
| Flights | 0.7294 | 0.7021 | 0.6303 |
| Shop | 0.7449 | 0.7838 | 0.7432 |

Combined features are much more stable:

| Held-out task | Precision | Recall | \(F_1\) |
|---|---:|---:|---:|
| Forums | 0.9496 | 0.9371 | 0.9316 |
| Flights | 0.9718 | 0.9700 | 0.9681 |
| Shop | 0.9741 | 0.9714 | 0.9708 |

This indicates that behavioral fingerprints are highly task-sensitive, while browser fingerprints, যদিও weaker alone, provide task-agnostic information that improves robustness when combined [2605.01247]. A plausible implication is that practical deployment should treat behavioral features as the primary attribution signal and browser features as a stabilizing prior.

The paper also studies real-time detection over observation windows from **5 s** to **180 s** after the first observed behavioral event [2605.01247]. Browser-only performance remains constant over time because browser fingerprints are static. Behavioral and combined performance improve as more evidence accumulates. The paper reports that behavioral performance plateaus at roughly **3 minutes**, while combined performance plateaus after roughly **1 minute** [2605.01247].

## 9. Cloudflare case study

FP-Agent is compared against **Cloudflare free bot management**, with **AI Crawl Control** and **Block AI Bots** enabled on the honey website [2605.01247]. The paper reports that FP-Agent **detects all seven AI browsing agents**, whereas Cloudflare fully blocks only **Manus** [2605.01247].

For **Claude**, **Comet**, and **ChatGPT Agent**, Cloudflare blocks only non-task-related provider-side requests while the agents still complete the tasks successfully [2605.01247]. This is attributed to Cloudflare’s reliance on known or self-identified traffic categories. The paper suggests that **Manus** may have been blocked because it appears in Cloudflare’s verified-bot directory [2605.01247].

The case study therefore supports the claim that fingerprint-based attribution is useful as a fallback when self-identification is absent or incomplete. This does not imply universal superiority over all commercial bot defenses, since the experiment is limited to the authors’ deployment environment and to Cloudflare’s free tier [2605.01247]. Still, it establishes a concrete operational distinction between **voluntary bot identification** and **observational attribution**.

## 10. Relation to adjacent work

FP-Agent sits within a rapidly developing literature on autonomous-web-agent attribution and control.

The most closely related paper in the provided record is "Whose Agent Are You? Multi-Layer Fingerprinting and Attribution of Autonomous Web Agents" [2606.20910]. That work introduces **MARK**, a server-side attribution framework that combines **temporal**, **TLS/H2**, **HTTP**, and **behavioral** features, and achieves **97.1% accuracy** across six agent frameworks, humans, and legacy crawlers [2606.20910]. Whereas FP-Agent relies on **browser fingerprints** plus **behavioral fingerprints**, MARK expands the fingerprint to lower network layers, including **JA3**, **JA4**, **cipher suites**, **TLS extensions**, **HTTP/2 SETTINGS**, **WINDOW_UPDATE**, **pseudo-header order**, **Sec-Fetch semantic violations**, and **behavioral interaction style** [2606.20910]. This suggests a natural extension path for FP-Agent from client-visible browser fingerprinting toward cross-layer attribution.

A different but conceptually relevant antecedent is the **fingerprinting** idea in multi-agent reinforcement learning introduced by Foerster et al., where a compact fingerprint \((\epsilon, e)\) is appended to observations so that replayed transitions can be interpreted relative to the policy regime that generated them [1702.08887]. There, "fingerprint" denotes a low-dimensional identifier of training context, not a detection signature. The common principle is that latent variation becomes manageable when converted into explicit observable context [1702.08887]. This suggests, by analogy, that web-agent attribution benefits from exposing the *behavioral regime* of an autonomous browser agent through measured interaction signatures.

## 11. Limitations and open questions

The paper is explicit that FP-Agent is evaluated in a **closed-world** setting consisting of the seven studied agents and humans [2605.01247]. It does not solve open-world detection of previously unseen agent implementations. This matters because attribution performance may degrade once the deployment environment contains new agent stacks, new browsers, or updated automation frameworks.

The tested hardware and operating-system combinations cover only a subset of real-world environments [2605.01247]. The human cohort is limited to **56 undergraduate students**, which constrains the representativeness of the human baseline [2605.01247]. The tasks cover only three scenarios and exclude interactions such as drag-and-drop because not all agents supported them [2605.01247].

Most importantly, the paper acknowledges an **arms race**. Current agents do not appear to actively humanize their behavior to a great extent, but future agents may imitate human typing, scrolling, and mouse movement more convincingly [2605.01247]. Browser fingerprints and behavioral signatures may also drift over time as products evolve. The related MARK study makes a similar point from the network side: if two agents share a fully identical backend and decision-making process, or if an agent perfectly mimics both human browsing behavior and network traces, attribution becomes far more difficult [2606.20910].

A plausible implication is that future FP-Agent-style systems will need continual retraining, adversarial evaluation, and likely **cross-layer fusion** of browser, behavioral, temporal, and network signatures.

## 12. Significance

FP-Agent is significant because it demonstrates, under controlled measurement conditions, that **behavioral fingerprints are currently the most powerful practical signal for distinguishing AI browsing agents from humans and from one another** [2605.01247]. Browser fingerprints alone are imperfect because they often reflect the browser/OS stack rather than the agent implementation, but they still improve robustness when combined with behavior [2605.01247].

The broader lesson, reinforced by MARK [2606.20910], is that autonomous web agents constitute a distinct technical category: they are neither ordinary humans nor traditional crawlers, and their browser-mediated autonomy leaks structure at multiple levels. FP-Agent provides one of the first concrete operationalizations of this claim through **feature-engineered, multi-class attribution** on realistic browsing tasks [2605.01247].

For research on web security, bot governance, and autonomous-agent measurement, FP-Agent therefore marks a transition from simple bot blocking toward **fine-grained observational attribution of agentic traffic**.

Source: https://www.emergentmind.com/topics/fp-agent