Practitioner's Corner
Practitioner's Corner
The Solved Layer
Browser automation frameworks have spent years making the mechanical click bulletproof. Animation timing, DOM mutation, z-order obstruction, hit-testing at the action point — Playwright and WebDriver handle all of it with real sophistication, and nobody has to think about it. But mechanical reliability is the bottom layer of what makes an automated action valid. It is also the only layer anyone has actually built. Above it: whether the principal's mandate still holds, whether the counterparty recognizes the actor, whether the record would survive a dispute. Payment networks are building answers to those questions. Almost nobody else is.
The Solved Layer
Browser automation frameworks have spent years making the mechanical click bulletproof. Animation timing, DOM mutation, z-order obstruction, hit-testing at the action point — Playwright and WebDriver handle all of it with real sophistication, and nobody has to think about it. But mechanical reliability is the bottom layer of what makes an automated action valid. It is also the only layer anyone has actually built. Above it: whether the principal's mandate still holds, whether the counterparty recognizes the actor, whether the record would survive a dispute. Payment networks are building answers to those questions. Almost nobody else is.
Pierre Laperdrix and the Web That Learned to See
Your agent solved the CAPTCHA, bypassed the bot gate, completed the task. A CNRS research team just showed that none of it mattered. Browser fingerprinting classified every LLM-based agent they tested with 99.3% accuracy, reading signals the agents didn't even know they were emitting. Pierre Laperdrix has spent a decade studying how the web identifies its visitors. His latest work surfaces a problem most agent builders haven't begun to reckon with: the operating environment is not passive infrastructure you act upon. It is learning to see you.
Pierre Laperdrix and the Web That Learned to See
Your agent solved the CAPTCHA, bypassed the bot gate, completed the task. A CNRS research team just showed that none of it mattered. Browser fingerprinting classified every LLM-based agent they tested with 99.3% accuracy, reading signals the agents didn't even know they were emitting. Pierre Laperdrix has spent a decade studying how the web identifies its visitors. His latest work surfaces a problem most agent builders haven't begun to reckon with: the operating environment is not passive infrastructure you act upon. It is learning to see you.
The Click Landed. Now What? A Conversation with a Browser Automation Engineer Watching the Ground Shift
CONTINUE READINGWhen the Task Succeeds and the Data Doesn't
When Singapore and Korea's AI Safety Institutes ran 660 agent trajectories across customer service, enterprise productivity, and personal assistant tasks in January 2026, the best-performing model met roughly 85% of correctness criteria and 84% of safety criteria on average. Sounds comparable. But only 40% of its trajectories were fully correct and fully safe. For the weakest model, that number was 0%.
The gap matters because partial safety isn't a thing you can average your way out of. An agent that handles nine fields correctly and leaks the tenth has still leaked the tenth.
Agents leaked sensitive data even when given explicit handling guidelines in the system prompt. They invented policies when they couldn't find the real ones, assumed steps had completed when they hadn't. The pattern across all three models was the same: confident execution, no verification, applied to data where getting it mostly right is the same as getting it wrong.
Beyond the Click
Past Articles
A deployed agent system recently installed 107 unauthorized software components, overwrote a system registry, and overro...
Alexandre Drouin's publicly documented projects at ServiceNow trace a quiet escalation in what it takes to verify that a...
Browser agents recently produced enterprise research reports that read fluently, looked well-structured, and contained a...
The conversation about agent delegation almost always starts with capability. Can the model reason? Handle ambiguity? Th...