What Does It Take to Detect an AI Agent? Minimal Feature Sets for Behavioral Detection under Browser Automation

核心亮点：研究人员发现，只需两个极简的行为特征，就能在AI代理伪装成人类浏览网页时精准识破它，准确率接近100%。通俗解读：以前网站区分访客只有两种标签：真人或机器人。但现在AI代理能自动操作浏览器，既不像人也不像传统机器人，旧系统常常把它误认为真用户。研究团队测试后发现，AI代理在模拟鼠标操作时，会漏掉真人移动鼠标时产生的细微轨迹和滚动数据，这种“缺陷”反而成了识别指纹。更神奇的是，只要盯住“鼠标操作频率”和“瞬移点击比例”这两个指标，就算AI精心模仿真人轨迹，也照样被一眼看穿。实际影响：这意味着网站可以更精准地拦截AI代理解读数据或刷票，保护内容版权和交易安全。但对普通用户来说，如果你用AI助手自动填表、抢购或浏览网页，可能会被网站拒绝服务。未来浏览器和AI工具的兼容性，可能也需要重新设计，而你的网上行为是否被AI“代劳”，也将更透明地被区分开来。

arXiv:2607.26935v1 Announce Type: new Abstract: Bot detectors deployed at scale treat traffic as binary: human or bot. This assumption breaks when AI agents browse the web through browser automation, a traffic class that is neither and that binary classifiers structurally cannot represent. We present a three-class detection framework distinguishing humans, bots, and AI agents, and show that the binary-vs-agent confusion is architectural: a binary human-vs-bot detector misroutes agent sessions because its label space lacks an agent class. On our controlled benchmark, an MLP binary classifier misclassifies 39.1% of real AI agents as human and a SAINT binary transformer misclassifies 34.5%; adding an explicit agent class yields per-class agent F1 = 1.000 in all 30 runs (3 model families $\times$ 10 seeds). To measure evasion resistance, we construct a five-level evasion ladder spanning passive observation, GAN-generated trajectories, and replay of real human cursor data ($n = 2299$ evasion sessions). Across 10 seeds and 3 model families we observe zero agent misses in 22990 per-seed predictions. The discriminative signal is a browser-automation artifact, not evidence of agent reasoning: Playwright does not emit the raw pointer-move and wheel-delta streams a physical input device produces, and this absence signature survives trajectory manipulation. Exhaustive search over all feature subsets of size 1-5 (9401 GBMs) shows that two behavioral features (mouse_event_rate, teleport_click_ratio) give 100% observed agent recall at every evasion level with agent precision 0.994; five features lift macro-F1 to 0.991. The signal is redundantly encoded: removing teleport_click_ratio leaves agent detection at 100%. The single-feature regime is degenerate, flagging every agent only by collapsing the classifier to always predict "agent". Two features robustly isolate agents; five separate all three traffic classes at macro-F1 $\geq 0.99$.