I tested how detectable 23 browser agents are from the website's side. Only one signs its requests

If you build or use browser agents, this might be useful: I gave ChatGPT's agent, Claude in Chrome, Cowork, computer use, Comet, Grok, Manus, Browser Use, Playwright MCP, DevTools MCP, Vercel's agent-browser and a few chatbots the same task on a test site, and logged what the site sees. (I build an analytics tool, which is why I wanted to know). - `navigator.webdriver` is false for most of them. Playwright MCP turns it off; a plain Playwright script, agent-browser and DevTools MCP leave it on. - Manus is the only one that identifies itself properly: Manus-User in the UA plus a Web Bot Auth signature on every request. In 2025 ChatGPT's agent signed its requests too; in our runs its browser sent no signature. - Comet sometimes runs in your browser and sometimes in a cloud browser on Windows/AWS, for the same public page. It told us it only uses your browser when a site needs your login, which isn't what it did. - Grok's browser came from my own IP and timezone but reported Linux x86, 8 cores and no GPU, on an Apple Silicon Mac. No idea where it actually runs. - Click timing doesn't separate agents from people: Browser Use and Comet hold the button 80–450 ms. What gave every clicking agent away is that the pointer jumps onto the target in one step instead of arriving in many small moves. - The old "console.log an error object and see if CDP reads it" trick detected nothing in Chrome 136–156, Playwright included. Full write-up with every user agent is in the comments. If there's an agent I missed, tell me and I'll run it if it's feasable.