Three bot defenses missed most browser-using AI agents, exposing uneven web access controls
A five-system benchmark found that tools effective against scripted automation could fail against agents operating real browsers.
Proof of Human tested five detection systems against scripted browsers, a stealth browser and three AI agents over 89 to 100 evaluable sessions per system; aggregate detection ranged from 9.1% to 99%. hCaptcha and Cloudflare Turnstile caught nearly every scripted session but few agent sessions, while Turnstile challenged none of the three tested agents; enterprise tiers and human false-positive rates were not tested. Publishers and paid-information services therefore face sharply different abilities to identify, meter or block agents, making the access-control vendor a consequential gatekeeper.