Detecting AI Agents: Minimal Features Distinguish Bots, Humans, and AI

Current bot detection systems typically categorize web traffic as either human or bot. However, this binary approach fails when AI agents use browser automation, creating a new class of traffic that is neither purely human nor a simple bot. This research proposes a three-class detection framework to accurately differentiate between humans, traditional bots, and these new AI agents. The study demonstrates that existing binary classifiers frequently misidentify AI agents as human due to the lack of an explicit "agent" class. By introducing this third category, the new framework achieves perfect F1 scores for agent detection in controlled benchmarks. The key to this success lies in identifying specific behavioral artifacts of browser automation, such as the absence of raw pointer-move and wheel-delta streams. Through extensive feature analysis, the researchers found that just two behavioral features—mouse event rate and teleport click ratio—are sufficient to robustly detect AI agents, even against sophisticated evasion attempts. Adding a few more features further improves overall classification accuracy across all three traffic types.