Identifying Agentic Automation with Behavioral Telemetry
Akamai researchers analyzed behavioral telemetry from autonomous AI browser agents (Perplexity Comet, OpenAI Atlas, Claude Chrome Extension) operating in 'control browser' mode and found that these agents produce sparse or absent mouse-event telemetry, causing existing behavioral bot-detection models to fail to evaluate over 98% of agentic requests. To address this, Akamai developed a proof-of-concept two-stage architecture: a self-supervised Masked Autoencoder Transformer that learns behavioral structure from mouse event sequences treated as tokens, followed by a lightweight MLP classifier that distinguishes agentic sessions from sparse human sessions using the transformer's embeddings. This is presented as detection research rather than an incident or vulnerability disclosure.
Detection / HunterAnthropic
What Happened
New AI tools like OpenAI Atlas and Perplexity Comet can take control of a web browser and complete tasks on a person's behalf, such as booking a flight, without a human touching the mouse. This matters to website owners and security teams because current fraud and bot detection systems rely heavily on watching mouse movement patterns, and these AI agents barely move the mouse at all, so they slip past the checks meant to tell humans apart from bots. Akamai, a web infrastructure and security company, studied this traffic and built an experimental detection model that looks at the timing and pattern of the few mouse actions an AI agent does make, similar to how a language model analyzes word patterns in a sentence. The model showed strong early results in distinguishing AI agent traffic from real human traffic. This is a research prototype, not a finished product, so organizations should watch for a promised follow-up post with more detail before relying on any specific detection capability.
Key Takeaways
- Autonomous AI browser agents such as Perplexity Comet, OpenAI Atlas, and Claude Chrome Extension generate web traffic that does not fit existing human vs. bot detection models because they interact with pages programmatically rather than through mouse movement.
- Akamai found that over 98% of agentic requests had zero or below-threshold mouse events, meaning existing mouse-movement behavioral models could evaluate less than 1% of this traffic.
- Akamai built a proof-of-concept Masked Autoencoder Transformer that treats mouse events as tokens, using cumulative timestamp encoding instead of positional encoding to capture timing patterns from sparse event sequences.
- A shallow MLP classifier trained on the transformer's 64-dimensional embeddings outperformed one-class SVM, Isolation Forest, and VAE approaches, achieving a ROC-AUC of 0.981 despite an 85:1 human-to-agentic session class imbalance.
- This is a research proof-of-concept, not a production detection capability; a second blog post is planned to cover detection metrics and generalization across customer sites.
Affected Systems
- Websites instrumented with Akamai Bot Manager Premier
- Any web property accessed by autonomous AI browser agents (e.g., Perplexity Comet, OpenAI Atlas, Claude Chrome Extension)
Vulnerabilities (CVEs)
None identified.
Attack Chain
N/A - This article describes detection research rather than an attack chain or malicious campaign.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not provide any reproducible detection rules, queries, or signatures. It describes a proprietary proof-of-concept machine learning architecture (Masked Autoencoder Transformer plus MLP classifier) internal to Akamai Bot Manager Premier, without releasing model weights, code, or rule logic.
Detection Engineering Assessment
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | None | This research concerns browser-side behavioral telemetry collected by a web bot management platform, not endpoint activity, so traditional EDR tooling has no relevant visibility into this behavior. |
| Network Visibility | Medium | If an organization has visibility into web application traffic and bot management telemetry (e.g., via a WAF or bot management platform), it may be possible to observe request patterns consistent with automated browser agents, such as direct navigation with minimal interaction events. |
| Detection Difficulty | Hard | Agentic browser traffic does not attempt to evade detection; it simply lacks the interaction artifacts that behavioral models depend on, so standard mouse-movement analysis has almost no data to work with. Distinguishing it from sparse human sessions (e.g., a user who clicks once and leaves) requires a discriminative model rather than simple outlier detection, as described in the article's findings. |
Required Log Sources
- Web application/bot management telemetry (mouse events, click events, scroll events)
- HTTP request logs from instrumented web pages
- Session-level behavioral analytics from a bot detection platform
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider reviewing web sessions with near-zero mouse movement events but successful multi-step task completion (e.g., navigation, form fill, purchase) to identify potential autonomous browser agent activity, consistent with automated interaction with a web application (T1204-adjacent browser automation behavior). | Session-level mouse/click/scroll event counts and timing gaps from web bot management or behavioral analytics telemetry | Initial Access / Execution (automated web interaction) | Medium to High, since genuine human users with minimal engagement (single-click sessions) can produce similarly sparse telemetry |
| Consider examining the timing distribution between recorded interaction events for unusually long, regular pauses that may indicate agent 'thinking' time between programmatic actions rather than human browsing behavior. | Inter-event timestamp deltas within web session telemetry | Execution (automated task completion) | Medium, as slow human users or users multitasking could also produce long pauses |
Control Gaps
- Behavioral bot detection models that rely on a minimum number of mouse movement events cannot evaluate the majority of agentic browser traffic, per the article's finding that ~99% of such requests fall below existing evaluation thresholds.
- Traditional binary human-vs-bot classification frameworks do not account for a third category of traffic that is neither a scripted bot nor a human, and may under-detect or misclassify this traffic.
Key Behavioral Indicators
- Web sessions with zero or near-zero mouse movement events combined with completed multi-step transactions
- Direct, precise navigation to target page elements without idle cursor movement, hovering, or scrolling exploration
- Long, irregular pauses between discrete interaction events inconsistent with typical human browsing rhythm
False Positive Assessment
Medium - The article itself notes that agentic behavior partially overlaps with sparse human sessions (e.g., single-click-and-leave users), meaning any detection approach based on this research risks misclassifying legitimate low-engagement human sessions as automated agent activity.
Recommendations
Immediate Mitigation
- Verify against your organization's incident response runbook and team escalation paths before acting. If your organization uses a bot management or behavioral analytics platform, consider reviewing whether it accounts for sparse-telemetry sessions rather than only flagging sessions with sufficient mouse event volume.
- Consider auditing recent web traffic for sessions with unusually low interaction event counts that still completed sensitive actions such as checkout, login, or account changes.
Infrastructure Hardening
- Evaluate whether your bot detection or WAF platform can incorporate timing-based and sequence-based behavioral signals rather than relying solely on mouse movement volume thresholds.
- If applicable, consider engaging with your bot management vendor to understand their roadmap for detecting agentic AI browser traffic, given this is an emerging and evolving traffic category.
- Consider evaluating rate limiting, step-up authentication, or additional verification for sensitive transactions (e.g., purchases, account changes) that could be completed by automated agents without additional friction.
User Protection
- Consider monitoring for changes in transaction patterns (e.g., purchase completion rates, checkout speed) that may correlate with increased use of autonomous browser agents by legitimate customers.
- If your platform supports it, consider adding optional friction (e.g., CAPTCHA, confirmation steps) for high-value or sensitive actions where automated completion could pose fraud or abuse risk.
Security Awareness
- Consider briefing fraud, risk, and security teams on the emergence of autonomous browser agents as a new traffic category distinct from traditional bots, so alerts and investigations are framed appropriately.
- Consider updating internal documentation and playbooks to reflect that low-interaction sessions are not automatically indicative of malicious bot activity, given legitimate AI agent usage is increasing.
