We sent 23 AI agents to our website. Most looked human

AI assistants now open websites for people. You ask ChatGPT to compare two pricing pages, and a browser somewhere clicks through them for you. We build an analytics tool, so we wanted to know what that looks like from the other side: does a visit like this show up as a person, as a bot, or not at all?

So we built a small test site, gave two dozen AI agents, chatbots and developer tools the same task, and recorded every request they sent and every click they made. Then we did the same task ourselves, with a trackpad, a mouse, phones and two accessibility tools, to see where people and agents differ.

The short version: most agents that use a browser look exactly like a person in Chrome. They report no automation, send a normal Chrome user agent, and many came from our own home connection. Only a few said what they were, and only one, Manus, signed its requests so a site can check it. Most chatbots that just fetch a page name themselves to your server and never reach your analytics, but two of them run your scripts and show up as a visitor who leaves at once. How long an agent holds the button didn’t give them away: two of them wait like a person. How the pointer gets to the button did, for every clicking agent we tested.

Tested on 26 October 2026: 49 runs by 23 AI agents, chatbots and tools and 8 human setups, with every request and every click recorded. Every visitor got the same task on the same three pages. The method and its limits are at the end.

The test

The test site was a made-up notes app with three pages: a home page, a plans page and a contact page with a form. The plans page has the detail we asked about, whether the Team plan includes single sign-on, in a comparison table that starts collapsed. Every agent got the same prompt:

Go to [the address] and find out what the Team plan costs per month and whether it includes SSO. Then open the contact page and tell me what it asks for. Don’t submit anything.

Each run had its own address, so every request in the server log belongs to one known visitor. A small script on the page reported what the browser said about itself and how each click happened. It never read what anyone typed.

We tested:

• AI agents that use a browser: ChatGPT Work’s built-in browser in the ChatGPT desktop app, Claude in Chrome, Claude Cowork, Claude computer use, Grok’s desktop app, Perplexity’s Comet browser and Manus.
• Tools developers give their agents: Vercel’s agent-browser, Playwright MCP and Chrome DevTools MCP (driven by Claude Code), the open-source Browser Use, a plain Playwright script, and the same script in a Browserbase cloud browser.
• Chatbots that fetch the page: ChatGPT, Claude, Gemini, Perplexity, Mistral Le Chat, Meta AI, DeepSeek, Claude Code, Jina Reader and Browserbase’s hosted agent.
• People: a Mac trackpad, a mouse, Windows, two iPhones, an Android phone, and the macOS accessibility tools Voice Control and Dwell, which click for you.

Some we couldn’t test. Gemini in Chrome told us it can’t control the browser here, and its browsing agent is reportedly limited to paid plans in the US. We didn’t run OpenAI’s computer-use model. Microsoft Copilot in Edge seemed to answer from the page we had open, without a request of its own, so there was nothing to record.

The results at a glance

Every agent that finished the task gave the answer our test page was built to give: €9 a month, no SSO, and the four fields of the contact form.

Most agents look like a person in Chrome

Bot detection usually starts with three questions: does the browser say it’s automated (navigator.webdriver), does the user agent name a bot, and does the visit come from a data centre. For most agents the answer was no to all three.

ChatGPT Work ran a Chrome 156 inside the ChatGPT desktop app on our Mac. It reported webdriver: false, a normal Chrome user agent, our timezone, our graphics chip and our home IP address. The only odd things were a narrow window, 319 pixels wide, and speed: a full visit took 11 to 21 seconds. Google Analytics showed these visits as ordinary sessions. So did our own tool. In 2025, Simon Willison found that ChatGPT’s agent signed its requests so sites could verify them. In our runs, ChatGPT Work’s browser sent no signature at all.

Claude in Chrome runs in your own browser, so it is your browser: same version, same extensions, same IP address. There’s nothing to tell apart. Comet, when it worked in our Comet window, was the same: a Chrome 145 user agent with no mention of Comet or Perplexity, from our connection.

Grok was the strangest. The requests came from our IP address with our timezone, but the browser reported Linux on an x86 processor, 8 cores and no graphics card, on an Apple Silicon Mac. So it wasn’t our browser, but to the website it came from our connection. We don’t know where that browser runs. Its user agent was plain Linux Chrome, and nothing named Grok.

Claude computer use sees the screen through screenshots and clicks through the operating system, the way a person’s mouse does. We ran it like Anthropic’s reference setup, in a Linux desktop in Docker. It also reported a plain Linux Chrome with webdriver: false.

Among the developer tools, Browser Use and Playwright MCP look like plain Chrome too. A plain Playwright script reports webdriver: true; Playwright MCP switches that off. A Browserbase cloud browser hides it as well, but comes from a data centre, so an IP check would catch it.

A few say what they are. Claude Cowork’s browser announced itself as HeadlessChrome/153 with webdriver: true, from Anthropic’s servers and a different IP address for almost every page. Vercel’s agent-browser and Chrome DevTools MCP report webdriver: true as well. And Manus went furthest: it adds Manus-User/1.0 to its user agent and signs every page request with a Signature-Agent: "https://api.manus.im" header and a cryptographic signature (the Web Bot Auth standard, an IETF draft), so a site can check that the request really came from Manus. It was the only agent in the test that did.

One agent, two browsers

We gave Comet the same prompt six times. Three times it worked in our own Comet window. The other three times it used a browser in Perplexity’s cloud: Windows, a server graphics card, a Los Angeles timezone and an Amazon data-centre address. When we started two tasks at once, the first ran in our browser and the second in the cloud.

Asked why, Comet told us it uses the cloud browser for public pages and our own browser only when a site needs our login. That isn’t what it did: it used our browser three times for the same public page. The two browsers also click differently, as the next sections show. So the same product can reach your site as a person on a home connection or as a server in a data centre.

Many came from our own connection

ChatGPT Work, Claude in Chrome, Comet in our browser and Grok all reached the site from our home IP address, with our timezone, and so did every developer tool we ran on our Mac. That’s worth knowing if you filter bots by IP address or by “data centre or not”: for these agents, a website sees the same address as the person who sent them.

Agents that only read

Asked the same question, Grok answered everything correctly, and even worked out the monthly price itself (€10.80), without a single click, scroll or mouse movement. It typed the addresses of the plans and contact pages directly and read the SSO answer out of the table that was still collapsed on screen. Manus did the same: three pages typed in 21 seconds, no click, no scroll, no movement.

In analytics that’s three page views, almost no time on each page, and no interaction: it looks like a visitor who left straight away. In fact it’s a visitor who read everything. When we told Grok to click around, it did, and then it clicked like the other agents below.

Most chatbots that fetch the page name themselves

When you paste a link into a chatbot and ask for a summary, most don’t open a browser. They fetch the page once from their own servers. No script runs, so an analytics tool that counts with a script in the page never sees the visit. Your server does, and most of these are easy to tell apart: they say who they are in the user agent, and most vendors document it (OpenAI, Anthropic, Perplexity, Google, Mistral, Meta).

Perplexity (PerplexityBot/1.0) fetched robots.txt and then our start page instead of the address we gave it, twice. The start page of the test site is empty, so it told us it couldn’t fetch the page. Another time it said the page “returned no readable content” without sending us a single request.

Browserbase’s hosted agent, asked to do the full task, didn’t use a browser either. It fetched the pages with headers that imitate Chrome 146 on macOS, ten versions behind everything else in the test, and requested two pages in the same millisecond from two different IP addresses.

Two “fetchers” run your scripts

Two of the chatbot tools didn’t just fetch the page. They opened it in a real browser, so our script ran, and an analytics tool would count a visitor.

Jina Reader, a service agents use to turn a page into text, loaded it in a headless Chrome in a data centre. Its user agent said plain Linux Chrome 156; only a second version header, which said 155, showed that the user agent had been changed.

DeepSeek opened the page in Firefox 149 on Linux, with Chinese as its language and a Hong Kong timezone, from a Huawei Cloud address in Hong Kong, and was gone within three seconds. Nothing it sent named DeepSeek or a bot.

In analytics, both are a visitor who loaded one page, did nothing and left.

What gave the clicking agents away

Once an agent clicks, we could compare its clicks with ours. The first thing we measured, how long the button is held, worked for most agents and failed for two:

Browser Use and Comet in our browser press, wait and release like a person. Comet in the cloud didn’t: it held the button for 10 to 13 ms.

What gave every clicking agent away was how the pointer got to the button. A person moves a hand, so the pointer arrives in many small steps; the last step before a click was 0 to 2 pixels for every one of our clicks. An agent doesn’t move a hand. Before each click, the pointer appeared on the target in a single jump of 200 to 840 pixels, or it appeared there for the first time on the page, and it barely moved otherwise:

This held for all 13 kinds of clicking agent, in every run: those that click through Chrome’s remote-control interface, Claude computer use, which clicks through the operating system, and the two that wait like a person.

Signals that didn’t hold up

Some things that sound like good bot signals failed on our own data:

• How long the button is held. Most agents click in a few milliseconds, but Browser Use and Comet hold the button as long as people do, and the accessibility tools below click faster than any agent.
• Clicking dead in the centre of a button. ChatGPT Work did, usually within a pixel. But Claude in Chrome and Claude computer use aim at the text they see in a screenshot, and missed the centre of a wide element by more than 230 pixels. And one of us hit a link within 2 pixels of its centre with a trackpad.
• A big jump of the pointer. A fast swipe on a trackpad moved the pointer 701 pixels in one step. Only a jump that lands right on what is clicked next is suspicious.
• Pressure. ChatGPT Work and Comet reported a pressure of 0 when they clicked, where a mouse reports 0.5. The Playwright tools reported 0.5.
• How it navigates. ChatGPT Work typed the addresses in some runs and clicked the links like a person in others, with the same browser.
• The console trick for spotting remote control. Tools that drive Chrome through its remote-control interface often listen to the browser console. Bot-detection scripts exploit that: the page logs an error object that notices when something reads it, and a listening tool does. It noticed nothing in any browser we tested, Playwright included, so it doesn’t work in the Chrome versions we saw (136 to 156).

Accessibility tools look more like bots than the bots

macOS Voice Control lets you click by saying what to click. Every one of its clicks landed exactly in the centre, with the button “held” for less than a millisecond, a pressure of 0, and no mouse movement at all. On any single signal, it looked more automated than ChatGPT Work.

Dwell clicks for you when you rest the pointer on something. Its clicks were also held for 0 to 3 milliseconds.

Both differ from the agents in how the pointer moves: Voice Control never moves it before clicking, and with Dwell the pointer rests on the target for about three seconds, moved there by a hand in small steps. A detection rule that relies on click timing would label people who can’t use a mouse as bots. The movement tells them apart, but that’s the only thing that does.

What this means for your analytics

• AI agents are already in your numbers as people. Short visits that read everything and click nothing, and visits that go straight to pricing, may be agents.
• Most chatbot fetches are counted on the server. They never reach a script in the page. To see how often someone asks ChatGPT, Claude or Mistral about your pages, count ChatGPT-User, Claude-User and MistralAI-User requests on your server. Some, like DeepSeek’s, show up in analytics as a one-page visit instead.
• Don’t count on IP addresses. Most of the agents we ran came from our home connection.
• Be careful with “bot” filters. If a filter catches instant, centred clicks, it also catches people using Voice Control.

What we’re changing in Privatrak

Privatrak already marks visits as automated when the browser says so (webdriver) or the user agent names a headless browser or an agent like Manus. In this test that caught the Playwright script, agent-browser, DevTools MCP, Claude Cowork and Manus. ChatGPT Work, Claude in Chrome, Comet, Grok, computer use, Browser Use, Playwright MCP and the Browserbase browser were counted as people.

We’re adding a check in the browser for the movement pattern above: a visit is only marked when every mouse click on the page came after one jump of the pointer onto the target, with almost no other movement, so Voice Control and Dwell users stay people. Replayed on our recordings, that marks every clicking agent and none of us. The browser only sends “automated” or not, never the movements themselves. A marked visit is still counted, and you decide whether to leave automated visits out of your numbers. Agents that only read, and fetchers that run your scripts, will still look like people.

For chatbots that only fetch, we’re working on counting them from your server: a small addition for your site sends only the requests whose user agent names a known chatbot or crawler, and Privatrak shows which pages ChatGPT, Claude and Perplexity fetched for someone, separate from your visitors.

Also seen

• Visitors before anyone had the link. Within minutes of the site’s certificate being issued, scanners that watch the public certificate logs visited it, some claiming to be Chrome. Anthropic’s crawler ClaudeBot came by twice the same morning.
• Link previews. When people opened the test links we’d sent them, WhatsApp and Facebook’s preview fetchers got there first.
• Google came back on its own. Right after an agent’s visit fired the Google Analytics tag, a Google fetcher (GoogleOther) loaded the same page.

Every user agent we saw

For reference, here is the user agent each one sent, copied from our server log. Only the rows marked “Yes” ran the page’s scripts, so only those can reach an analytics tool that counts with a script. The agents that drive a browser, ChatGPT’s agent included, send an ordinary Chrome user agent; only Claude Cowork, agent-browser and Manus give themselves away in it.

How we tested

The test site ran on our own server, with three static pages. The server log recorded every request with all its headers. A script on each page reported what the browser said about itself (user agent, webdriver, window size, timezone, graphics) and how each click happened: how long the button was held, how the pointer moved before it, and how many movements there were in total. It never read what was typed into the form.

Each agent ran in its own way:

• ChatGPT Work, Grok, Cowork, Comet, Manus and the chatbots were run by hand in their own apps or websites, on free plans where possible.
• Claude in Chrome ran in our own Chrome.
• Claude computer use ran on Claude Opus 5.5 with the computer-use toolset, in a Linux desktop in Docker that clicks with xdotool, like Anthropic’s reference setup.
• agent-browser, Playwright MCP and DevTools MCP were driven by Claude Code on our Mac; Browser Use ran on our Mac with Claude Sonnet 4.6 and its default settings.
• The Playwright script ran in Chrome on our Mac and in a Browserbase cloud browser. Jina Reader was called without an account.

Limits to keep in mind:

• It’s one day and one site: one to six runs per agent, and ten runs by people, most of them by us.
• Agents change quickly. A new version can click differently tomorrow.
• An agent that moves the pointer along a path in small steps would look like a person. None of the agents we tested did.
• Where Grok’s browser runs, and what makes Comet choose a browser, is what we observed, not something we could confirm.