Share

Digital Body Language

The Way They Move

By Nora Kaplan— July 2, 2026

Feature image for article: The Way They Move

Researchers at UC Davis watched seven commercial browsing agents navigate an instrumented website this spring. A behavioral classifier distinguished all seven from humans with near-perfect accuracy. Cloudflare's bot detection, running simultaneously, caught one. The gap between those numbers reveals a recognition surface that traditional defenses weren't built to read: how an agent types, scrolls, and moves a cursor across a page. If that behavioral layer is as legible as the data suggests, it could become the foundation for reputation, differential treatment, and accountability across the open web.

Digital Body Language

The Way They Move

By Nora Kaplan— July 2, 2026

Researchers at UC Davis watched seven commercial browsing agents navigate an instrumented website this spring. A behavioral classifier distinguished all seven from humans with near-perfect accuracy. Cloudflare's bot detection, running simultaneously, caught one. The gap between those numbers reveals a recognition surface that traditional defenses weren't built to read: how an agent types, scrolls, and moves a cursor across a page. If that behavioral layer is as legible as the data suggests, it could become the foundation for reputation, differential treatment, and accountability across the open web.

Recognition Surface Map

Agents act before the systems around them can identify, bound, or account for what happened. That gap between capability and recognition looks different depending on where you stand.

Some surfaces were designed for simpler questions. The web's defenses assumed visitors were human or script, nothing in between. Enterprise security assumed that logging what software did was the same as understanding why. Protocol designers got connection working and left verification for later.

One domain stands apart. Payments, shaped by decades of disputed-transaction liability, may already have the institutional muscle to enforce agent recognition while everyone else is still drafting proposals. Six surfaces, one pattern: the agents declared independence before the controls were ready.

Recognition Surface Map

Agents act before the systems around them can identify, bound, or account for what happened. That gap between capability and recognition looks different depending on where you stand.

Some surfaces were designed for simpler questions. The web's defenses assumed visitors were human or script, nothing in between. Enterprise security assumed that logging what software did was the same as understanding why. Protocol designers got connection working and left verification for later.

One domain stands apart. Payments, shaped by decades of disputed-transaction liability, may already have the institutional muscle to enforce agent recognition while everyone else is still drafting proposals. Six surfaces, one pattern: the agents declared independence before the controls were ready.

Web Defenses

The Bouncer Doesn't Recognize the New Crowd

A June 2026 study found browsing agents sailed past every tested anti-bot mechanism: robots.txt, CAPTCHAs, proof-of-work, Cloudflare's free tier. They use real browsers doing ordinary things. The web's old binary, human or script, simply doesn't describe who's showing up anymore.

Behavioral Fingerprinting

The Best Detection Signal Sits on the Shelf

FP-Agent identified all seven tested browsing agents from humans by watching how they type, scroll, and move a mouse. Cloudflare's commercial detection caught one. Browser fingerprints barely help because agents share them. The research is solid. The industry hasn't picked it up.

Protocol Identity

Agents Can Connect Before Anyone Checks Credentials

A2A Agent Cards describe identity and capabilities. MCP authorization remains optional, transport-level. Both protocols nail how agents find and reach each other. Neither settles what counts as verified authority or valid delegation. Think of it as a well-designed envelope with no seal.

Payment Authorization

Payments Already Enforce What Others Still Debate

Visa's ChatGPT integration scopes tokenized credentials to specific agents, enforces spending limits before authorization, and monitors fraud in real time. Decades of liability infrastructure around disputed transactions gave payments a head start. Recognition here is institutionally required, not aspirational.

Enterprise Monitoring

Security Sees the What but Misses the Why

Uber built its ADR system, processing over 10,000 agent sessions daily, because traditional endpoint detection catches file writes but not the prompts or reasoning behind them. A compromised agent and a legitimate one look identical in the logs. The blind spot is intent.

Self-Declaration

Agents Announce Themselves but Nobody Checks the ID

A2A Agent Cards and MCP tool descriptions let agents say what they are and what they can do. Authorization logic stays implementation-specific. A well-formed card from a compromised registry is still well-formed. Without independent verification, self-description is etiquette, not security.

Research Landscape

FP-Agent: Fingerprinting AI Browsing Agents

A controlled study of seven browsing agents shows that behavioral signals like typing cadence, scrolling rhythm, and mouse movement reliably separate agents from humans, even when the underlying browser fingerprints are identical across frameworks.

How stark is the gap?

Behavioral fingerprinting caught all seven agents in a Cloudflare case study; Cloudflare's own bot detection flagged one.

So what shifts?

Detection built around how agents interact with pages consistently outperforms detection built around what identity signals they present.

On the Internet, Nobody Knows You're an LLM Bot

Tests web agents against production anti-bot defenses and finds some sailed past every layer: robots.txt, CAPTCHAs, proof-of-work, commercial solutions. Yet multi-layer fingerprinting still distinguished every evaluated agent from human traffic.

Where do current defenses stand?

Porous against today's agents, though behavioral fingerprinting at the right layer still reliably tells agents apart from humans.

What does recognition actually require?

An infrastructure investment in behavioral instrumentation, not a policy update or a vendor upgrade.

Research Landscape

FP-Agent: Fingerprinting AI Browsing Agents

A controlled study of seven browsing agents shows that behavioral signals like typing cadence, scrolling rhythm, and mouse movement reliably separate agents from humans, even when the underlying browser fingerprints are identical across frameworks.

How stark is the gap?

Behavioral fingerprinting caught all seven agents in a Cloudflare case study; Cloudflare's own bot detection flagged one.

So what shifts?

Detection built around how agents interact with pages consistently outperforms detection built around what identity signals they present.

Research Landscape

On the Internet, Nobody Knows You're an LLM Bot

Tests web agents against production anti-bot defenses and finds some sailed past every layer: robots.txt, CAPTCHAs, proof-of-work, commercial solutions. Yet multi-layer fingerprinting still distinguished every evaluated agent from human traffic.

Where do current defenses stand?

Porous against today's agents, though behavioral fingerprinting at the right layer still reliably tells agents apart from humans.

What does recognition actually require?

An infrastructure investment in behavioral instrumentation, not a policy update or a vendor upgrade.

Recognition Turned Inward

You Deployed the Agent. Can You See What It's Doing?

When an employee writes a file, endpoint detection logs the write. If something goes wrong, you can ask the employee what they were thinking. When an agent writes a file, endpoint detection still logs the write. But the reasoning that produced it, the prompt that initiated it, the sequence of tool calls between intent and action: none of that shows up in traditional security tooling.

A recent paper out of Uber's deployment makes this concrete. Across 7,200+ hosts running 10,000+ daily agent sessions, the company discovered hundreds of credential exposures from developers using coding agents as intended. The agents did plausible work and, in the process, surfaced credentials in ways nobody could see through existing monitoring.

The paper's proposed fix captures what EDR misses: user prompts, agent reasoning steps, tool invocations, environmental context. Four dimensions that reconstruct the causal chain from "what was asked" to "what happened." Without them, a configuration file save and a credential exfiltration look identical.

Enterprise security was built for a world where intent was carried by humans. On a long holiday weekend, with skeleton crews watching dashboards, that gap feels especially worth sitting with.

Recognition Turned Inward

You Deployed the Agent. Can You See What It's Doing?

When an employee writes a file, endpoint detection logs the write. If something goes wrong, you can ask the employee what they were thinking. When an agent writes a file, endpoint detection still logs the write. But the reasoning that produced it, the prompt that initiated it, the sequence of tool calls between intent and action: none of that shows up in traditional security tooling.

A recent paper out of Uber's deployment makes this concrete. Across 7,200+ hosts running 10,000+ daily agent sessions, the company discovered hundreds of credential exposures from developers using coding agents as intended. The agents did plausible work and, in the process, surfaced credentials in ways nobody could see through existing monitoring.

The paper's proposed fix captures what EDR misses: user prompts, agent reasoning steps, tool invocations, environmental context. Four dimensions that reconstruct the causal chain from "what was asked" to "what happened." Without them, a configuration file save and a credential exfiltration look identical.

Enterprise security was built for a world where intent was carried by humans. On a long holiday weekend, with skeleton crews watching dashboards, that gap feels especially worth sitting with.

The gap: EDR sees file writes, network calls, process execution. It does not see prompts, reasoning chains, or which tools an agent invoked and why.

Uber scale: 7,200+ hosts, 10,000+ daily agent sessions, monitored for 10+ months

What surfaced: Hundreds of credential exposures across 26 categories, all inadvertent. Agents doing assigned work, leaking credentials sideways.

Detection cost: $0.024 per task using a two-tier architecture. Fast triage handles ~41% of sessions cheaply, escalating only higher-risk cases to LLM-based reasoning.

Drift in practice: A user asks an agent to "summarize this Jira ticket." The agent reads SSH keys and makes an HTTP request. Traditional tooling sees the HTTP request. Only causal-chain capture reveals the deviation from intent.

Precision: A prevention layer built on these findings blocked credential leaks at 97.2% precision

Market Pulse

Market Pulse

The Way They Move

The Way They Move

FP-Agent: Fingerprinting AI Browsing Agents

On the Internet, Nobody Knows You're an LLM Bot

FP-Agent: Fingerprinting AI Browsing Agents

On the Internet, Nobody Knows You're an LLM Bot