Now that AI agents are browsing the web at consumer volume, can you actually tell one apart from a human by watching what it does? We tested five agents, and the answer was inconsistent by design: none hid at every layer, and none was honest at every layer either. Each picked a different layer to fake, and no two agents picked the same one.
Our last post argued that the standalone agentic browser lost the adoption fight, and that agentic traffic is moving into two other shapes instead: personal AI agents that never touch a browser you'd recognize, and browser extensions riding on top of Chrome itself. Our CEO Kevin Gosschalk covered one side of that shift directly when Meta shipped Muse, in a post he called “Population Two Arrives.” Population Two, in this framework, is a fast-growing share of agent traffic that’s autonomous, unidentified, and acting on behalf of a real, consenting customer. It has just started arriving at consumer volume for the first time.
We wanted to see what that traffic actually looks like on the wire, not just the browser you're told to imagine, but every layer underneath it. The Arkose Cyber Threat Intelligence (ACTIR) team ran the same test across four agents built on genuinely different architectures, Meta's Muse, Spear Street's Instinct, and Manus, plus Anthropic's Claude for Chrome extension and Perplexity's Comet for comparison, and asked the same question at four separate layers: what an agent says it is, how it moves a mouse, what it leaves behind in the page, and where its traffic actually comes from.
No agent hid at all four. Here's how each of the five agents broke down, layer by layer:
- Muse: Identity: accurate Chromium/Linux UA, but never discloses it's Muse or an agent. Mouse movement: human-looking curved bursts, but machine-regular step count and spacing. Network origin: ordinary CDN infrastructure (flags as hosted, automated traffic).
- Instinct: Identity: fabricates a Windows/Chrome UA its own behavior doesn't back up. Mouse movement: no mouse events at all (interactions injected directly), yet human-level click dwell time. Network origin: rotating residential proxies (e.g., a Texas ISP).
- Manus: Identity: correctly identifies itself, no disguise. Mouse movement: two teleporting moves, machine-flat dwell times. Network origin: rotating residential proxies across countries (Mexico, then Kenya, separate runs).
- Claude for Chrome: Identity: no identity of its own, inherits the host browser's UA. Mouse movement: hybrid human/agent input inside a browser the person is actively using. Network origin: runs on the user's own browser and connection, nothing to fake.
- Comet: Identity: standard Chrome identity, no disguise. Mouse movement: hybrid human/agent input inside a browser the person is actively using. Network origin: runs on the user's own browser and connection, nothing to fake.
How honest is each agent’s identity?
Of the group, Manus is the only one that correctly identifies itself in its user agent string, no disguise involved. Muse tells a partial truth: its user agent accurately reports Chromium on Linux, it just never says Muse, or that it's an agent at all. Instinct is the one caught outright fabricating: its user agent claims Windows and Chrome, a fingerprint the rest of its behavior doesn't back up. Claude for Chrome isn't hiding anything at this layer so much as it never had its own identity to disclose: as a browser extension, it simply inherits whatever user agent the browser it's riding inside already presents.
None of the four try to prove their identity cryptographically through Web Bot Auth, the closest thing to an industry standard for this, which we've noted elsewhere is still short of formal adoption. That absence is itself consistent with Kevin's framing: this is Population Two traffic, legitimate, unidentified, and with no operator-controlled signature to check even if a site asked for one.
Do AI agents move the mouse like humans?
Muse's cursor movement is the most deliberately human-looking of the group: dozens of small, curved-looking moves broken into short bursts (a burst is one continuous stretch of movement before the cursor pauses), roughly the shape a real hand makes reaching for a link. Look closer, though, and it's too consistent to be one: every hop lands in the same number of steps, spaced with machine-grade regularity, with a little overshoot-and-correct wobble tacked onto the landing, the kind of detail a script adds because it was told humans do that, not because it naturally would.
Manus barely bothers: two teleporting mouse moves and machine-flat dwell times, doing the minimum required to operate the page rather than attempting to pass as a person.
Instinct is the strangest case of the four. It emits no mouse events at all, it injects interactions directly into the page, yet it still produces human-level click dwell time. An agent with no mouse movement and human-like clicking isn't more convincing for the mismatch; it's a different tell than the ones a cursor plot would catch.
For reference, a real person completing the same task produces 769 moves across 7 bursts, continuous and curved, wandering up to 84 pixels off a straight line between points.
Comet and Claude for Chrome complicate this further: both run inside a browser the person might be actively using at the same time. That hybrid pattern, human and agent input mixed together, is exactly what a biometrics model built to sort one person from one bot has the hardest time with.
What do AI agents leave in the DOM?
Claude for Chrome is the clearest illustration of a different signal entirely: the DOM itself. To show a user what it's doing, the extension injects visible page elements, a glow border, a phantom cursor, a stop control, and continuously rewrites those elements' style properties to animate them, sometimes well over a hundred small changes in a single session, all visible to anyone who opens the browser's developer tools while it's running.
The pattern generalizes beyond this one example. A browser extension has a real usability reason to modify the page: the person using it needs to see what the agent is doing. A remote or standalone agent has no such obligation, and can be quieter at this layer even while it's noisier somewhere else.
Where does each agent’s traffic actually originate?
Manus and Instinct both route through rotating residential proxies, IP addresses that resolve to home internet connections rather than server infrastructure, to look like ordinary end users. In one test run, Manus's traffic resolved to a residential connection in Mexico; a separate run resolved to one in Kenya. Instinct's resolved to a residential ISP in Texas. None of those connections belong to the person actually operating the agent, and that's the real story here, not the specific country or how often it changes. Borrowing a stranger's home connection to pass as an ordinary user is a tactic malicious actors have relied on for years, and it's also a thriving gray-market business among AI companies, buying access to residential networks so their own traffic blends in. Muse doesn't bother: its egress runs through ordinary CDN infrastructure, the kind of address that would flag it as hosted, automated traffic to any system doing basic IP classification. Claude for Chrome and Comet don't need to fake anything at this layer at all, since both run inside the user's own browser on the user's own connection.
Is one vendor more honest than another?
None of this resolves into a clean story where personal agents hide and browser extensions don't, or where one vendor is simply more honest than another. Manus tells the truth about what it is and lies about where it's coming from. Muse does close to the reverse. Instinct fakes an identity its own behavior doesn't support.
That's the same point Kevin made when he wrote that population isn't a label you get to attach to a product: Muse can be Population One at a payment rail and Population Two at a login form, in the same session, ten seconds apart. What this testing adds is why that's true at a technical level, not just a policy one. Every one of these agents is a different mix of honest and dishonest, layer by layer, and the only way to know which population a given session actually belongs to is to check all four layers, rather than assume the answer from whichever vendor's name is attached to it.
Takeaways
- Manus: honest about its identity, dishonest about its origin — traffic rotates across countries with no matching customer travel.
- Muse: honest about the kind of infrastructure it runs on, but conceals its own identity and overcorrects on human-like cursor movement.
- Instinct: fabricates its user agent and never moves a mouse, yet still fakes human-like click timing.
- Claude for Chrome: has no identity to fake and runs on the user's own connection, but leaves the most visible DOM footprint of the group.
- Comet: shares Claude for Chrome's hybrid human/agent movement pattern — the hardest case for biometric detection to sort cleanly.
That layered view, not any single tell in isolation, is the kind of signal our own detection work is built around.
This is the second of two posts on how agentic browsing is actually shaped today. If you're catching up, it follows “The Standalone Agentic Browser Didn't Win. The Agent Did.”
