---
title: "Why Websites Flag AI Agents as Bots, and How to Fix It"
description: "AI agents get flagged for fingerprint mismatches, automation traces, fixed viewports, shared IPs and robotic input. Learn each signal and the per-profile fix."
url: "https://donutbrowser.com/ru/ai-agent-bot-detection/"
---

1. [Главная](https://donutbrowser.com/ru/)

2. [Блог](https://donutbrowser.com/ru/blog)

3. Why Websites Flag AI Agents as Bots, and How to Fix It

# Why Websites Flag AI Agents as Bots, and How to Fix It

October 14, 2026

ai-agents bot-detection fingerprinting

**Websites flag AI agents when the browser’s signals disagree with each other or with how people behave: a fingerprint that does not fit the IP, automation traces, a fixed viewport, an IP shared by many sessions, and a cursor that jumps to its target. Fix each signal in each profile, and let a person handle logins and sends.**

This guide is for people whose agent keeps hitting CAPTCHAs, “verify you are human” pages or account locks. I make Donut Browser, an anti-detect browser, so the fixes use it. The checks apply to any setup. No setup is undetectable, and each site’s terms still apply.

> **Key Takeaways**

> - Sites check four layers: network, fingerprint, automation and behavior. One weak layer is enough for a challenge.

> - A fingerprint fails on contradictions, such as a timezone that does not match the IP region, more often than on rare values.

> - In the [FP-Agent study](https://arxiv.org/html/2605.01247v1), behavior alone told seven AI agents and humans apart with an F1 score of 0.9994.

> - Give each identity its own profile, fingerprint and proxy, use humanized input, and hand logins and sends to a person.

## How do websites detect AI agents?

Websites detect AI agents by checking several layers of a session and looking for one that does not fit a person on a real device.

The first check is identity. Agents that announce themselves, by user agent or by a signed request, fall into categories that a site owner can allow or block. Agents that run inside a normal browser announce nothing, so the site reads the other layers:

1. The network: IP type, reputation, region and how many sessions share it.

2. The fingerprint: screen, viewport, GPU, fonts, timezone and language, and whether they agree.

3. Automation traces: flags and objects that automation frameworks leave in the page.

4. Behavior: mouse paths, typing rhythm, scrolling and pace.

![Table of four detection layers. Network: agents often use a cloud IP or one IP for every account; fix with a proxy per profile and timezone and language from the exit IP. Fingerprint: fixed viewports and the same device on every account; fix with a separate fingerprint per profile. Automation: launch flags and injected helpers; fix by launching the profile normally and attaching over CDP. Behavior: the cursor jumps to targets; fix with humanized input and a person for logins and sends.](https://donutbrowser.com/img/blog/ai-agent-bot-detection.svg)

## Does Cloudflare block AI agents by default?

For some new sites, yes. Cloudflare’s [changelog of July 1, 2026](https://developers.cloudflare.com/changelog/post/2026-07-01-ai-traffic-options/) split AI traffic into Search, Agent and Training. It defines Agent as “automated activity acting in real time on a person’s behalf, such as chat fetch bots and browser-use agents,” and says:

> “Starting September 15, 2026, new domains onboarding to Cloudflare receive updated defaults: Bots classified as Training or as Agent are blocked on pages that display ads, while Search remains allowed.”

Cloudflare’s [September 15 post](https://blog.cloudflare.com/accountable-mixed-use-ai-crawlers/) describes two presets for new domains. Sites that monetize with ads get Agent set to block on pages with ads. Other sites allow agents. Every owner can change either setting.

The category rule acts on traffic Cloudflare classifies as an agent. A browser agent inside a normal browser is harder to classify. In a case study, the FP-Agent authors write that “FP-Agent detects all seven AI browsing agents, whereas Cloudflare detects only one.” Sites that add behavioral checks can catch what network classification misses. When a site owner blocks agents on purpose, do that task by hand or ask the site for access.

## Why does fingerprint consistency matter more than a rare fingerprint?

A detector checks whether the values in a fingerprint could come from one real device in one place. A rare value can be a real device, and a contradiction cannot.

Common contradictions in agent setups:

- A timezone of `America/New_York` with an IP in Frankfurt.

- An `Accept-Language` of `en-US` on an IP whose region and timezone point elsewhere.

- A software GPU renderer in a browser that claims to be a desktop with a real graphics card. Cloud machines that run hosted agents often have no GPU.

- A viewport larger than the screen or the window it sits in.

- The same canvas, WebGL and font values on every account, because every account runs on one machine.

The FP-Agent authors collected 418 fingerprint features with FingerprintJS. Fingerprints alone told the agents and humans apart with an F1 score of 0.82, which is weaker than behavior and still useful to a detector. The [browser fingerprinting guide](https://donutbrowser.com/browser-fingerprinting) explains each signal, and the [browser fingerprint tool](https://donutbrowser.com/tools/browser-fingerprint) shows what your current profile reports.

## What does a fixed agent viewport reveal?

A fixed viewport makes every session of an agent report the same window size, whatever screen it runs on. People resize windows, use different laptops and dock to monitors, so their viewports vary.

Aside, an AI browser, documents this choice in its [engineering post](https://aside.com/blog/how-we-built-the-sota-browser-agent-that-outperforms-fable): “We patched Blink so background tabs opened by the agent always render at 1440x900, regardless of the user’s window size.” The reason given is model accuracy: “most Computer Use training data is around this resolution.”

The cost is consistency. On a 13-inch laptop or in a small window, a page can read a 1440x900 viewport inside a window or screen that is smaller. Across many users, the same size on every agent tab is a cluster a detector can count.

When Playwright attaches to an existing browser profile over CDP, it uses the window as it is. If your code calls `setViewportSize` with one value for every profile, it brings the constant back. Keep each profile’s window inside its fingerprint’s screen size, and let sizes differ between profiles.

## Which automation traces do detectors look for?

Detectors look for flags and objects that automation frameworks add to the browser or the page.

The best known is `navigator.webdriver`. [MDN](https://developer.mozilla.org/en-US/docs/Web/API/Navigator/webdriver) says it “indicates whether the user agent is controlled by automation,” and that Chrome sets it when “The `--enable-automation` or `--headless` flag is used, or the `--remote-debugging-port` flag specifying port 0 is used.”

The Chrome DevTools Protocol (CDP) left another trace. Puppeteer and Playwright send `Runtime.enable` to run scripts in a page, and a console trick could detect it. Rebrowser calls it “a pretty old trick to detect open devtools or CDP which was used by Cloudflare, DataDome and many other anti-bot companies” ( [Rebrowser](https://rebrowser.net/blog/how-to-fix-runtime-enable-cdp-detection-of-puppeteer-playwright-and-other-automation-libraries)). In May 2025, two V8 commits stopped that getter from firing ( [Crawlex](https://blog.crawlex.net/blog/detecting-cdp-runtime-enable/)). Detectors moved to driver artifacts, such as Playwright’s init-script bookkeeping, and to timing differences.

Stealth scripts that patch browser functions add their own trace. The [bot detection test](https://donutbrowser.com/tools/bot-detection) flags “Patched native functions,” with the WebDriver flag, automation globals, a software GPU renderer and a zero window size.

The fix is to launch the profile the normal way and attach to it. In Donut Browser, you launch a profile from the app, the local REST API or MCP, and connect Playwright or Puppeteer to its CDP port on 127.0.0.1. The fingerprint is set in the Wayfern engine’s C++ layer, so no script patches the page. Run the bot detection test inside the profile before real work.

## Why do shared IPs get AI agents blocked?

Shared IPs get agents blocked because IP reputation is the cheapest signal a site has. Hosted agents often browse from cloud data centers, whose ranges are public and score as automated. An IP that logs into many accounts in one day links them and raises their risk.

A single good IP is not enough. The IP’s region has to match the profile’s timezone and language, and WebRTC and DNS must not show your real address next to it.

In Donut Browser, each profile has its own HTTP, HTTPS, SOCKS4 or SOCKS5 proxy, or a WireGuard VPN. DNS goes through the profile’s route, and WebRTC leak protection has three modes. Timezone and language follow the proxy’s exit IP, and the app blocks the launch when they do not match. For account work, use a sticky residential or mobile IP from the account’s region; the [proxy guide](https://donutbrowser.com/proxies-for-anti-detect-browsers) compares the types, and the [WebRTC leak guide](https://donutbrowser.com/webrtc-leak) shows how to test a profile.

## How do websites spot AI agent behavior?

Websites spot agent behavior by measuring how the cursor moves, how keys are pressed and how the page scrolls.

The [FP-Agent paper](https://arxiv.org/html/2605.01247v1) (Wang, Shafiq and Vekaria, UC Davis, May 2026) tested Atlas, ChatGPT Agent, Claude for Chrome, Comet, Manus, Browser Use and Skyvern, plus 546 samples from 56 people. Its findings:

- “Browsing agents do not exhibit any mouse movements and instead directly teleport to the click location.”

- “Humans exhibit much higher inter-key and hold latencies.”

- “Browsing agents exhibit non-continuous scrolling, in which the page position changes in discrete jumps.”

- Behavioral features alone told the seven agents and humans apart with an F1 score of 0.9994. With fingerprint features added, the score was 1.0.

- On tasks the classifier had not seen, the behavior-only F1 fell “by as much as 0.369,” while the combined classifier “degrades negligibly.”

The lesson for operators is that input matters as much as the fingerprint. The [`wayfern` npm package](https://www.npmjs.com/package/wayfern) (MIT) re-exports Playwright and humanizes every click, keystroke and scroll: the cursor travels to its target with optional overshoot, pauses before a click, and types at a set words-per-minute with optional errors ( [Wayfern docs](https://donutbrowser.com/docs/wayfern)).

```
import { chromium } from "wayfern";

// port comes from POST /v1/profiles/{id}/run on the local REST API
const browser = await chromium.connectOverCDP(`http://127.0.0.1:${port}`);
const page = browser.contexts()[0].pages()[0];

await page.goto("https://example.com/login");
await page.click("input[name=email]"); // cursor travels, then pauses
await page.keyboard.type("me@example.com"); // human key timing
```

Humanized input lowers one signal. Pace matters too: a person does not open 40 pages a minute, so add waits between tasks.

## How do you run an AI agent with fewer flags in Donut Browser?

Set up each identity once, connect the agent, and keep a person on the risky steps.

1. Create one profile per identity. Each profile has its own fingerprint, set in the engine. Pro and up can edit fingerprints and create profiles for another operating system.

2. Give each profile its own proxy. Donut matches timezone and language to the exit IP and blocks the launch on a mismatch.

3. Connect your agent. Over [remote MCP](https://donutbrowser.com/docs/remote-mcp), Pro and up get browser control: launch, navigate, click, type, scroll, screenshot and evaluate. Over the local REST API, `POST /v1/profiles/{id}/run` (Pro) returns a CDP port for Playwright, Puppeteer or `wayfern`.

4. Use humanized input for every action the agent takes in a page.

5. Hand sensitive steps to a person. The agent calls `ask_human`, `request_human_help` or `wait_for_human`, you answer on the app’s Agent page, and you can take over the profile or pause the agent. Use this for logins, two-factor codes, CAPTCHAs, payments and messages.

6. Test before real work. Open the [bot detection test](https://donutbrowser.com/tools/bot-detection) and the [fingerprint tool](https://donutbrowser.com/tools/browser-fingerprint) inside the profile, with its proxy on.

7. Keep volume human. Donut’s remote MCP has rate caps and answers `MCP_RATE_LIMITED` when you reach one, and sites have their own limits.

The [AI agents use case](https://donutbrowser.com/use-cases/ai-agents) covers the full setup, and [AI agents for sales](https://donutbrowser.com/use-cases/sales-agents) applies it to prospect research and CRM work. To run one agent across several accounts, read [how to run an AI agent on multiple accounts](https://donutbrowser.com/ai-agent-multiple-accounts).

## What should an AI agent not do when a site blocks it?

An agent should stop and ask, and it should not look for a side door.

Aside’s engineering post describes one side door: “Sometimes, Aside reverse-engineers the site’s API. If the page blocks the normal path, it captures network requests, figures out the internal API, and uses that as a workaround.” Calling a site’s internal API outside its interface can breach its terms. LinkedIn’s [User Agreement](https://www.linkedin.com/legal/user-agreement), for example, forbids using “bots or other unauthorized automated methods to access the Services, add or download contacts, send or redirect messages.” The [Aside alternative](https://donutbrowser.com/alternatives/aside) page compares the two browsers’ approaches.

When a block appears, hand the step to a person in the same profile. If the site blocks agents on purpose, do that task by hand or ask the site for API access.

## Frequently asked questions

### Why is my AI agent detected as a bot?

**Sites check four layers: the network, the browser fingerprint, automation traces and behavior.** Agents often fail on a cloud or shared IP, a timezone or screen that does not fit, a flag such as [`navigator.webdriver`](https://developer.mozilla.org/en-US/docs/Web/API/Navigator/webdriver), and input with no mouse path. One weak layer can trigger a challenge.

### Does Cloudflare block AI agents by default?

**For some new sites, yes.** Since September 15, 2026, new domains that monetize with ads get a preset that blocks the [Agent category](https://developers.cloudflare.com/changelog/post/2026-07-01-ai-traffic-options/) on pages that show ads. Other new sites allow agents, and every owner can change the setting.

### Can websites detect AI agents by their behavior?

**Yes.** The [FP-Agent study](https://arxiv.org/html/2605.01247v1) told seven AI browsing agents and 56 people apart with an F1 score of 0.9994 from behavior alone. Agents moved the cursor straight to the target and typed with shorter key intervals than people.

### Can an AI agent be undetectable?

**No setup is undetectable.** Detection vendors combine many signals and update them. You can remove clear mismatches, such as a timezone that does not fit the IP or an automation flag, and see fewer challenges. Some sites block agents on purpose, and their terms apply.

### What should my agent do at a CAPTCHA or login check?

**Hand the step to a person.** In Donut Browser, the agent calls a human-in-the-loop tool such as `request_human_help`, you solve the check in the same profile, and the agent continues. Use the same handoff for payments, sent messages and password changes.

## Sources

[FP-Agent: Fingerprinting AI Browsing Agents (arXiv 2605.01247)](https://arxiv.org/html/2605.01247v1) · [Cloudflare: New options to manage AI traffic](https://developers.cloudflare.com/changelog/post/2026-07-01-ai-traffic-options/) · [Cloudflare: Have it both ways](https://blog.cloudflare.com/accountable-mixed-use-ai-crawlers/) · [MDN: Navigator.webdriver](https://developer.mozilla.org/en-US/docs/Web/API/Navigator/webdriver) · [Rebrowser: Runtime.Enable CDP detection](https://rebrowser.net/blog/how-to-fix-runtime-enable-cdp-detection-of-puppeteer-playwright-and-other-automation-libraries) · [Crawlex: Detecting CDP in the wild](https://blog.crawlex.net/blog/detecting-cdp-runtime-enable/) · [Aside: How we built a browser agent](https://aside.com/blog/how-we-built-the-sota-browser-agent-that-outperforms-fable) · [LinkedIn User Agreement](https://www.linkedin.com/legal/user-agreement) · [wayfern on npm](https://www.npmjs.com/package/wayfern). All retrieved 2026-10-14.

## On this page

- How do websites detect AI agents?

- Does Cloudflare block AI agents by default?

- Why does fingerprint consistency matter more than a rare fingerprint?

- What does a fixed agent viewport reveal?

- Which automation traces do detectors look for?

- Why do shared IPs get AI agents blocked?

- How do websites spot AI agent behavior?

- How do you run an AI agent with fewer flags in Donut Browser?

- What should an AI agent not do when a site blocks it?

- Frequently asked questions

- Why is my AI agent detected as a bot?

- Does Cloudflare block AI agents by default?

- Can websites detect AI agents by their behavior?

- Can an AI agent be undetectable?

- What should my agent do at a CAPTCHA or login check?

- Sources