What happens when an AI agent opens a protected page.
We point today's AI browser agents at our own demo bank, CRM and insurance portal, each protected by NanoTarget, and give them a real task inside a signed-in session. This page lists every result, including the one that gets through. We say what happened, not how we detect it.
0wrong decisions in 15 full signed-in sessions of people and agents
4 of 4AI agent products we tested were caught, before or at their first action
88%of people cleared at their very first click, with nothing to confirm
1known way through, and what stops it. Listed below.
AI agents you can use today
| Agent | What we ran | Result | When it is caught |
|---|---|---|---|
| Claude in ChromeAnthropic, browser extension | 21-task session in a signed-in bank page | Caught 37 of 37 steps | As it takes over the tab, before its first click |
| Claude desktop appAnthropic, built-in browser | Tasks in the demo bank | Caught 10 of 10 clicks | At its first click |
| Codex, Chrome extensionOpenAI | 21-task session | Caught 36 of 36 steps | As it takes over the tab, before its first click |
| Codex, built-in browserOpenAI | Two 21-task sessions, two app versions | Caught 75 of 75 steps | At its first click. One version removed every sign of the product; its behaviour still gave it away. |
Scripts and bots
| Automation | What we ran | Result | When it is caught |
|---|---|---|---|
| Plain Puppeteer or Playwrightthe usual scraping script | Live runs against the demo bank | Caught 12 of 12 | At its first click |
| Script that reads the page firsthow general AI agents work | Hidden browser, human-like cursor, reads before acting | Caught 12 of 12 | When it reads the page |
| “Human-like cursor” librariescurved, slowed, jittered mouse paths | 600 generated paths in six styles. A lab simulation, not a live browser. | Caught 99% of paths | At the click |
| Agents that sign their requestsWeb Bot Auth standard | Signed requests with a test operator key | Identified | Every request, by cryptographic signature. No public operator has been tested live yet. |
| Stealth script written for one siteknows the layout, never reads the page, imitates hardware input | Live runs against the demo bank, visible browser | Gets through 16 of 16 passed as a person | Behaviour alone cannot separate it from a real person without blocking real people. What stops it: a passkey on the actions you mark as critical, which a script cannot produce. |
Not measured yet
| Agent | Status |
|---|---|
| Perplexity Comet | Not tested |
| ChatGPT Atlas and ChatGPT agent mode | Not tested |
| Browser Use cloud | Not tested |
We add a row when we have run it, not before. Want your agent or your site tested? Write to the address in SECURITY.md.
People
| Who | What we ran | Result |
|---|---|---|
| People on Chrome, Safari and Windowsmouse, trackpad and touch | 397 clicks | Let through 395 of 397 clicks read as human. The other 2 were misread as automated at that click. Where it matters, the policy asks a person for a passkey instead of blocking. |
| Full signed-in sessionspeople and agents, start to finish | 15 sessions, 25 to 38 steps each | 0 wrong decisions |
How to read this
- Where does this run?
- On our public demo apps, with the same engine you install from npm. Every agent got a real task inside a signed-in session, like a customer would give it.
- Why publish what gets through?
- Because a security team will find it anyway. A script hand-built for one site can imitate a person closely enough that no behaviour check stops it without also stopping real customers. That is why NanoTarget pairs detection with passkey confirmation on the actions that matter, and signs every decision so you can prove afterwards who did what.
- How fresh is it?
- Agents change every week. One product removed its identifying signs between two of our runs. We re-run this scorecard as agents change and date every run.
- What do you not publish?
- How each agent is recognised. Publishing the signals would help agent authors hide, and would not help you decide.