--- title: "The Header That Learned to Lie" canonical: "https://current.tinyfish.ai/issue/44/echoes/article/36453/the-header-that-learned-to-lie" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" author: "Sable Whitford" author_url: "https://current.tinyfish.ai/team/201" issue: 44 section: "echoes" section_name: "Echoes" published: 2026-08-28 word_count: 301 source_links: 4 --- # The Header That Learned to Lie *By [Sable Whitford]()* *August 28, 2026* [Read on the website]() In 1992, HTTP added a field called `User-Agent`. The [spec](https://www.rfc-editor.org/rfc/rfc1945.html) said it was for "statistical purposes" — a voluntary note from the client identifying itself. Unsigned, unverified, totally optional. Then servers started reading it. If the string said "Mozilla," you got the good page. If it didn't, you got the fallback. So Internet Explorer [started claiming](https://webaim.org/blog/user-agent-string-history/) to be Mozilla. Every subsequent browser inherited the lie, stacking another impostor's name into the string just to get past someone else's gate. By the time Chrome shipped, its user-agent string carried four other browsers' names before its own. Nobody designed this. It accreted, one defensive hack at a time. The field was meant for identification. Servers used it for access control. Access control made honesty expensive. So everyone lied, and the string became, in WebAIM's words, "a complete mess, and near useless." Now AI agents browse the web in real Chromium instances. The user-agent says "Chrome" because it *is* Chrome. The string is finally [telling the truth](https://arcjet.com/learn/identify-ai-agents-and-bots), and that's the most misleading thing it's ever done. **A brief history of one header lying about itself:** **1993** — `NCSA_Mosaic/2.0` — honest **1995** — `Mozilla/1.22 (compatible; MSIE 2.0; Windows 95)` — IE claims to be Mozilla **2003** — Safari adds `KHTML, like Gecko` — pretends to be two other rendering engines **2008** — Chrome's string carries Mozilla, AppleWebKit, KHTML, and Safari before finally saying "Chrome" **2015** — Edge adds "Chrome" and "Safari" to its string to avoid being treated like old IE **2025** — ChatGPT's operator agent browses in real Chrome; the string is [technically accurate](https://arcjet.com/learn/identify-ai-agents-and-bots) **Where it stands now:** [RFC 9421](https://www.rfc-editor.org/rfc/rfc9421.html) defines HTTP Message Signatures, letting platforms cryptographically sign requests — proving *who sent it*, though not *who authorized it* or *what they're allowed to do*. Identity without authorization, which is roughly where we started. ## More - [Echoes — Issue 44]() - [Issue 44]() - [Publication guide]()