Privatrak sent 23 AI agents, chatbots and developer tools to a mock website and found that most browser-using agents looked like ordinary Chrome visitors. They reported no automation signal, used normal browser user-agent strings and, in several cases, reached the site through the testers’ own internet connection.
The analytics vendor published its findings on October 27, 2026, following testing on October 26. Its report describes 49 runs involving those tools, with eight human setups for comparison.
The useful finding is more specific than “bots look human.” A chatbot fetching HTML can appear in server logs without reaching browser analytics. An agent controlling a browser can generate an ordinary analytics session. A signed request can provide verifiable identity, but it cannot establish whether a particular action is authorized.
Those distinctions should shape both measurement and security policy.
What Privatrak Actually Measured
Privatrak built a three-page website for a fictional notes app: a home page, a plans page and a contact page. Each agent received the same assignment: find the Team plan’s monthly price, determine whether it included single sign-on, then describe the contact form without submitting it.
The SSO information appeared in a comparison table that started collapsed. That gave the experiment something more useful than a simple page download: a task involving navigation and potentially page interaction.
Each run received a unique address, allowing the researchers to associate server requests with a known visitor. A page script recorded browser-reported properties and click behavior. Privatrak says it did not read anything people typed.
The tested products included:
- Browser agents: ChatGPT Work’s browser, Claude in Chrome, Claude Cowork, Claude computer use, Grok’s desktop app, Perplexity Comet and Manus.
- Developer tools: Vercel’s agent-browser, Playwright MCP, Chrome DevTools MCP, Browser Use, a plain Playwright script and that script running through Browserbase.
- Page-retrieval tools: ChatGPT, Claude, Gemini, Perplexity, Mistral Le Chat, Meta AI, DeepSeek, Claude Code, Jina Reader and Browserbase’s hosted agent.
- Human comparisons: A trackpad, a mouse, Windows, phones, and macOS Voice Control and Dwell accessibility tools.
This was a vendor-run experiment on one site with a small sample, not an estimate of how much internet traffic comes from agents. Some products could not be assessed, including OpenAI’s computer-use model. Its strongest evidence concerns what these particular configurations exposed during this particular task, as documented in Privatrak’s methodology and results.
Ordinary Browser Signals Missed Many Agents
Websites often inspect three readily available clues: the user-agent string, the browser’s automation flag and the source network.
A user-agent string describes the client making a request. The JavaScript property navigator.webdriver indicates whether a browser reports being controlled through automation. An IP address can suggest a residential connection or a data center.
In Privatrak’s test, those clues frequently failed to distinguish agents from people.
| Tested setup | What Privatrak observed | Practical consequence |
|---|---|---|
| ChatGPT Work | Chrome 156 on the testers’ Mac, no automation signal, their connection | Ordinary browser and network checks offered little separation |
| Claude in Chrome | The testers’ own Chrome browser and connection | The browser identity belonged to the user’s existing environment |
| Comet, running locally | Chrome 145 user agent, no automation signal, their connection | A normal Chrome identity did not reveal the agent |
| agent-browser, Chrome DevTools MCP and local Playwright script | Reported automation through webdriver | The flag helped identify these tested configurations |
| The Playwright script through Browserbase | Linux Chrome, no automation signal, data-center connection | Hosting changed which signals were visible |
| Manus | Reported automation and signed requests | The site received an explicit identity mechanism to verify |
These are reported observations from Privatrak, not independent measurements by Zeniteq.
The local-versus-hosted Playwright comparison is especially useful. The same script reported automation locally but did not do so in the Browserbase setup. That makes a product-wide label such as “Playwright traffic” too coarse for a reliable rule. Runtime configuration matters.
Likewise, a residential IP address cannot be treated as proof of human control when an agent operates through the user’s machine. A browser may accurately report its version, platform and network while software decides what to click.
I’d keep these signals as descriptive fields, but stop treating their absence as a clean bill of human browsing. “No automation flag observed” is a defensible measurement. “Verified human” is a much stronger claim.
Separate Server Requests From Analytics Sessions
Fetch-only clients and browser agents create different measurement problems.
A client that retrieves HTML without executing the site’s analytics JavaScript can appear in access logs while remaining absent from client-side analytics. Privatrak reports that most page-fetching chatbots identified themselves to the server and never reached its analytics.
Browser agents can load scripts, navigate and generate events that resemble ordinary visits. Privatrak’s cross-posted account says ChatGPT Work’s visits appeared as ordinary sessions in both Google Analytics and Privatrak.
There was also an awkward middle category: two page-retrieval tools ran site scripts and appeared as visitors who left immediately, according to the report. That behavior can affect short-session and engagement reporting without looking like a conventional multi-page agent visit.
The practical implication is that server traffic and analytics traffic need separate denominators. A count of identified AI requests in access logs cannot simply be subtracted from browser sessions. Some requests never produced a session, and some browser sessions carried no obvious AI label.
For reporting, I’d distinguish at least three observable groups:
- Identified retrieval traffic: Requests naming an AI client, with no observed client-side analytics execution.
- Identified browser automation: Browser sessions carrying a usable automation or identity signal.
- Unclassified browser traffic: Sessions for which the available evidence cannot establish who or what controlled the browser.
That last label is less satisfying than “human,” but it preserves the uncertainty the experiment exposes.
Click-Hold Duration Was Not a Reliable Divider
Privatrak compared how long visitors held a button and how the pointer reached it. The authors report that two agents held buttons for human-like durations, making button-hold time an unreliable separator.
Pointer movement differed for every clicking agent they tested, according to the report.
These findings concern different parts of an interaction. Button-hold duration measures the interval between pressing and releasing. Pointer telemetry describes movement leading into the action. A plausible delay between press and release says little about how the pointer arrived.
That makes pointer behavior a useful candidate for further measurement, not a ready-made blocking rule. The report’s result does not supply a universal detection threshold or establish accuracy across the wider population of devices, agents and accessibility workflows.
The inclusion of Voice Control and Dwell matters here. People can legitimately interact without conventional mouse movement. A security rule built around an expected pointer path needs to account for those workflows.
A careful deployment would collect limited interaction summaries, evaluate them alongside known traffic, and examine false positives before enforcement. There is little justification for recording form contents to answer this question. Privatrak’s own instrumentation avoided reading typed text.
Signed Requests Answer a Different Question
Manus was the only tested tool that signed its requests, Privatrak reports. That offered the site a way to check the sender’s identity instead of trusting a self-declared user-agent string.
The distinction is important. Anyone implementing a client can choose a descriptive user-agent value. A cryptographic signature, when checked against a trusted key using the relevant verification procedure, provides stronger evidence about the signer and the request components covered by that signature.
But verified identity is not permission.
A site may recognize an agent operator while still needing to determine whether the user authorized an action, whether the account has access, and whether the request exceeds a rate limit. An identifiable agent can make an unwanted request. An unsigned request is not automatically abusive.
For operators, the sensible approach is to support verification where an agent publishes a usable signing mechanism, then attach policy to the verified identity. Keep authentication, account permissions and abuse controls in place.
Privatrak’s finding also needs to remain product-specific: ChatGPT Work’s browser sent no signature in these runs. That observation should not be generalized to every OpenAI browsing product or execution mode.
Frequently Asked Questions
3 questions
1Can Google Analytics Count AI Agents as People?
It can record browser-agent visits as ordinary sessions. Privatrak reported that behavior for ChatGPT Work. Fetch-only clients may never execute the analytics script.
