In 1992, HTTP added a field called User-Agent. The spec said it was for "statistical purposes" — a voluntary note from the client identifying itself. Unsigned, unverified, totally optional.
Then servers started reading it. If the string said "Mozilla," you got the good page. If it didn't, you got the fallback. So Internet Explorer started claiming to be Mozilla. Every subsequent browser inherited the lie, stacking another impostor's name into the string just to get past someone else's gate. By the time Chrome shipped, its user-agent string carried four other browsers' names before its own.
Nobody designed this. It accreted, one defensive hack at a time. The field was meant for identification. Servers used it for access control. Access control made honesty expensive. So everyone lied, and the string became, in WebAIM's words, "a complete mess, and near useless."
Now AI agents browse the web in real Chromium instances. The user-agent says "Chrome" because it is Chrome. The string is finally telling the truth, and that's the most misleading thing it's ever done.
A brief history of one header lying about itself:
1993 — NCSA_Mosaic/2.0 — honest
1995 — Mozilla/1.22 (compatible; MSIE 2.0; Windows 95) — IE claims to be Mozilla
2003 — Safari adds KHTML, like Gecko — pretends to be two other rendering engines
2008 — Chrome's string carries Mozilla, AppleWebKit, KHTML, and Safari before finally saying "Chrome"
2015 — Edge adds "Chrome" and "Safari" to its string to avoid being treated like old IE
2025 — ChatGPT's operator agent browses in real Chrome; the string is technically accurate
Where it stands now: RFC 9421 defines HTTP Message Signatures, letting platforms cryptographically sign requests — proving who sent it, though not who authorized it or what they're allowed to do. Identity without authorization, which is roughly where we started.