The short answer

Yes, with caveats that matter. An AI agent cannot act on the web without operating a browser, and operating a browser means generating input events: pointer movement, scrolls, keystrokes, clicks, navigation. Those events carry patterns, and the patterns of synthesized input differ from the patterns of a hand on a mouse or keyboard in ways that are measurable today and hard to fake all at once.

The caveats: detection is probabilistic, so its output is a confidence score rather than a certainty. It is adversarial, so whatever works today will be attacked tomorrow. And it is only defensible when a human reviews the evidence before anything happens to anyone. The rest of this article unpacks each of those clauses.

What an AI agent actually is

Two families of automation matter here, and they overlap.

Browser automation is the older family: scripted and headless browsers driven by automation frameworks. This is the classic bot population: scrapers, form fillers, account-creation scripts. It follows instructions written in advance, executing them the same way every run.

LLM-driven agents are the newer family. A language model reads the page, decides what to do next, and drives the browser to do it: navigate, click, fill, submit. Because the model decides step by step, these agents can carry out open-ended, multi-step tasks that used to require a person, including completing coursework inside a learning platform.

What both families share is the seam that detection works on: a real browser, but synthesized input. However capable the model behind an agent, the movements, scrolls, and keystrokes it emits are generated by code rather than by a person doing the work.

The signals that give agents away

Detection systems read that seam across three layers of signal.

Behavioral signals describe how the session moved. A person steers a cursor in arcs, with hesitation, drift, overshoot, and constant micro-corrections; automation tends to travel in straight lines at a fixed speed. Real reading speeds up, slows down, and stops to re-read; programmatic scrolling advances in uniform increments. Human typing arrives in uneven bursts with pauses and corrections; agent text tends to land all at once, or on a clock that never varies. People hesitate before consequential clicks and wander between elements; agents click immediately and traverse a site systematically, page after page.

Technical signals describe what the browser reveals about itself. Automation frameworks leave fingerprints: debugging-protocol (CDP) artifacts, headless-browser tells, interference from browser extensions, and anomalies in how the browser renders graphics.

Integrity signals describe whether the measurement itself was disturbed. Tampering with a detection script is informative on its own, and honeytraps, page elements that normal use has no reason to touch, catch automation that interacts with everything it finds.

No single signal decides anything; the layers are weighed together into a confidence score for the session. The how NotAI works page puts a person and an agent side by side on each signal, and the pixel install guide documents what one implementation collects and what it deliberately does not.

Why text detection is the wrong layer

The intuitive way to catch AI is to read the output: run finished text through a classifier and ask whether it sounds machine-written. For agent detection, that is the wrong layer twice over.

First, most of what an agent does never produces text. Navigating, clicking, scraping, submitting forms, completing a quiz: a text classifier has nothing to read, so the activity is invisible to it. Second, when an agent does produce text, a style judgment is guesswork with no event behind it. Careful human prose can read as machine-written, generated prose can read as human, and neither error leaves anything a reviewer can check.

The browser session is the layer where an agent has no choice but to act. It can polish its prose; it cannot avoid emitting the events that produced it. That is why process evidence, not style opinion, is the basis for agent detection, and it is the core difference between the tool categories buyers usually weigh, laid out in how the three approaches compare.

The evasion arms race

Can a determined adversary fake human behavior? Partially, yes. Cursor paths can be curved, delays randomized, typing broken into bursts. Any single signal can be imitated, and evasion tooling improves in step with detection.

What stays hard is faking every layer at once, coherently, for a whole session. The imitation has to hold up in the movement and the typing rhythm and the browser internals and the untouched honeytraps, all simultaneously, and effort spent polishing one layer often trips another. Each layer an adversary must fake raises the cost of the attempt, in engineering time and in runtime complexity, and cost is the real currency of this field.

So the claim worth making is not that evasion is impossible; no honest vendor claims that. It is that layered detection makes automation expensive to hide, keeps the cheap and common cases visible, and turns the sophisticated cases into flags a human can weigh. A product that promises more than that is describing a system that does not exist.

What a responsible pipeline does with a flag

Whether agents can be detected is only half the question. The other half is what happens when a system believes it has found one, because a flag lands on a person.

A responsible pipeline treats the flag as the start of a review, not the end of one. The flag should arrive with its evidence: which signals fired, and a session timeline a reviewer can replay to see what was typed, what was pasted, and what the browser reported. A human looks at that record, with context in hand, before anything becomes an accusation.

The context matters because unusual is not the same as automated. Assistive technologies, dictation, remote desktop sessions, and plain slow or unconventional habits can produce signals that overlap with automation. A score alone cannot tell those apart; a person with the whole session and the writer's circumstances usually can. That review step is not overhead on top of detection; it is the part that makes detection usable.

The bottom line

AI agents can be detected in the same sense that spam can be filtered: reliably enough to be worth doing, never so finally that humans leave the loop. Agents must act in a browser, actions generate signals, and the full stack of human behavior is hard to fake at once. Treat every score as the opening of a review, expect the arms race to continue, and judge any vendor, ours included, by whether its flags come with evidence a person can check. For the category fundamentals, start with what behavioral AI detection is.