Autonomous AI browser agents generate a new category of web traffic that operates with sparse, highly economical behavioral telemetry.
Traditional bot detection models fail to evaluate these agents because more than 98% of their requests contain little to no mouse movement.
Akamai developed a proof-of-concept Masked Autoencoder Transformer model that treats mouse telemetry like language tokens to analyze short event sequences.
A lightweight classifier trained on transformer embeddings successfully distinguishes agentic automation from sparse human sessions, achieving high accuracy despite extreme class imbalance.
A new kind of visitor is browsing your website — and it doesn't move the mouse the way you'd expect. Over the past year, a category of AI tools has emerged that doesn't just answer questions: It takes over your browser and acts.
Tools such as Perplexity Comet, OpenAI Atlas, and Claude Chrome Extension that receive a natural-language prompt (such as "Find me a flight to Boston for under $300 and book it.") can then navigate the open web autonomously to complete the task. There are no human hands on the mouse, and no human reading the page — just an AI agent, clicking and typing its way through your site on a human’s behalf.
This automation is also known as “control browser” mode, and it's generating a category of web traffic that is neither traditional bot traffic nor human traffic. Here at Akamai, we wanted to understand what this traffic looks like at the telemetry level and whether we could identify it.
The work described in this blog post — part one of a two-part series — is a proof-of-concept (PoC) research effort; we intend to develop it into a more robust, production-ready capability in the future.
Please note: OpenAI announced the discontinuation of Atlas after we completed our research. Despite that change, our research provides valuable insights into how AI agents can control and navigate browsers.
For years, web security has operated on a binary bot detection model: A request is either human or bot. And bots fall into two categories — the first are simple, low-sophistication crawlers that make no attempt to appear human, and the second are sophisticated mimics that generate synthetic mouse movements, vary their timing, and do everything in their power to look like a human.
Automation-mode agents are in neither of the bot categories. They are not trying to fool anyone; they simply don't operate the way that a human does. When an agent navigates to a web page, it goes directly to its target.
It doesn't move the cursor idly while reading.
It doesn't hover before clicking.
It doesn't scroll to explore.
It clicks precisely, types efficiently, and moves on.
The result is a behavioral fingerprint that is sparse, mechanical, and economical. And that creates a detection problem that existing tools weren't built to solve.
Akamai Bot Manager Premier collects rich behavioral telemetry — sequences of mouse events (movements, clicks, and scrolls) that are transmitted from every instrumented web page. Our existing behavioral models analyze these sequences to distinguish humans from bots. They're good at this. But they have a firm requirement: You need enough events in a sequence to make a meaningful comparison.
Here's what we found when we ran those models against hundreds of sessions collected from Comet and Atlas operating in automation mode:
63.2% of agentic autopost requests contained 0 mouse events
35.8% contained event counts below the minimum threshold
Only 1.0% of requests had enough movement events to be evaluated
The existing mouse movement model flagged less than 1% of total agentic requests as suspicious. The models weren't failing; they were never getting the chance to run. Automation-mode agents don't generate mouse telemetry because they're largely not using a mouse. They navigate programmatically. The telemetry is sparse — not because the agent is evading detection, but because it simply doesn't produce human-like interaction artifacts.
The gap between “evaluated” and “evaluable” was the core problem to solve.
To build a model that works on sparse telemetry, we needed to change our framing.
Think of mouse events the way you'd think about words. A single word tells you very little about who wrote a sentence. But patterns in words — including their rhythm, relative frequencies, and pauses between them — can tell you a great deal. An agent-written sentence is economical and purposeful; there's no wandering, backtracking, or idle filler. A human-written sentence is messier and richer.
This analogy drove our modeling approach. And this analogy is not only metaphorical, but also architectural. Our background fine-tuning large language models (LLMs) suggested a direct parallel: The same attention mechanisms that allow transformers to model relationships between lexical tokens in a sentence could be applied to model relationships between mouse events in a behavioral sequence.
In a transformer's key/query attention blocks, each token attends to every other token, allowing models to learn which tokens are most relevant to another’s meaning regardless of distance. Applied to mouse telemetry, this means a model can learn the relationship between a small number of events. And we found that such transformer models can effectively learn to exploit these relationships even when sequences are short.
Rather than building a model that requires a long sequence of events to evaluate, we trained a model to understand what a short sequence means in order to distinguish an agent's sparse, purposeful mouse “vocabulary” from a human's.
The following architecture represents a PoC design. The scale of both training data and model capacity is intentionally modest for an initial investigation; production deployment would warrant larger models and more comprehensive labeled data collection.
Before classifying sessions as agentic or human, we first had to teach our model the underlying structure of normal mouse behavior.
We adapted a Masked Autoencoder Transformer — a self-supervised natural language processing architecture — for behavioral telemetry. The model was trained on approximately 3.5 million unlabeled mouse event sequences from real Bot Manager Premier telemetry. During training, 35% of the events in each sequence were randomly masked for the model to reconstruct from context, requiring zero manual labels.
Lightweight architecture
The architecture is lightweight by design:
44,000 parameters
3 transformer layers
4 attention heads
Fixed 64-dimensional embedding per sequence
Encoding time instead of position
A key design choice involved replacing standard positional encodings (e.g., 1st event, 2nd event) with cumulative timestamps. Applying sinusoidal encoding to elapsed time acts as a Fourier decomposition, projecting each timestamp across multiple frequencies at once.
High-frequency components capture microgaps between rapid events
Low-frequency components capture overall session rhythm
This forces the model to learn timing patterns as a first-class feature. The long, irregular pauses that are typical of AI agents (sometimes several seconds between clicks) become a meaningful signal rather than an artifact of sequence length.
With a pre-trained transformer producing 64-dimensional behavioral embeddings, we trained a small supervised classifier to spot agentic behavior — collecting 2,190 labeled agentic sequences by running Comet, Atlas, and the Claude Chrome Extension against real, Bot Manager Premier–instrumented customer websites.
Our team operated these tools using standardized prompts:
“Navigate to the product page and add item X to the cart.”
“Find the login page.”
“Compare items in category Y.”
We then collected the resulting Bot Manager Premier sessions. Human baseline data was pulled from the same customer properties.
Combining these created a significant class imbalance: roughly 85 human sessions for every one agentic session. We addressed this with class-weighted loss functions and extensive data augmentation on the agentic minority class (Gaussian noise, feature dropout, and random temporal scaling).
The second-stage classifier is a shallow multi-layer perceptron (MLP) — with two hidden layers (64 → 32 units) on top of the 64-dimensional embedding. We compared this against a one-class support vector machine (SVM), Isolation Forest, and a Variational Autoencoder (VAE) approach(Table). The supervised MLP substantially outperformed all alternatives, including the one-class methods typically expected to generalize better on unseen data.
| Approach | ROC-AUC | PR-AUC | Notes |
|---|---|---|---|
| One-class SVM | 0.797 | 0.044 | Trained only on human data |
| Isolation Forest | 0.833 | 0.038 | Near-zero recall at useful thresholds |
| VAE + energy-based loss | 0.882 | 0.410 | Promising but difficult to tune |
| Shallow MLP (final) | 0.981 | 0.661 | Selected approach |
Second-stage classification model comparison demonstrating the shallow MLP’s better performance
Key insight
Agentic behavior isn’t simply “outside” the human distribution; it partially overlaps with sparse human sessions, such as users who make a single direct click and leave. Detecting agents requires learning a discriminative boundary, not just flagging outliers.
When projected onto two-dimensional space, we can observe relatively clear separation between the human and agentic embeddings learned by the transformer mode (Figure). Very simple approaches like using a hyperplane decision boundary with an SVM did not work very well, but a shallow MLP network can learn to distinguish among the classes and generalize reasonably well with limited labeled training data.
Agentic AI browser tools are ushering in a genuinely new era of web traffic — one in which sessions can blend human and artificial telemetry, and existing detection models aren't designed to look.
The architecture described in this post gives us a principled way to reason about even the sparsest mouse sequences: a self-supervised transformer that learns behavioral structure from millions of unlabeled sequences, followed by a lightweight classifier trained on a carefully collected set of labeled agentic sessions.
In part two of this series, we'll put the model to the test. We'll share request-level and session-level detection metrics, show how the behavioral signatures generalize across different customer websites, and visualize what agentic sessions look like compared with human sessions. We'll also discuss what operational precision means in a real-world deployment — and what a path toward a production-ready capability requires.
The research described in this post was conducted by the Akamai Threat Research and Data Science teams. The labeled agentic dataset was collected and anonymized following a standardized protocol using BMP-instrumented customer websites.
© 2026 Akamai Technologies
