FlagThis

Abstract

is either _malicious_ (e.g., engaging in security exploits, credential stuffing, fraud, spam, or content theft [14, 67, 104]) or simply _unwanted_ (e.g., consuming server resources, inflating bandwidth costs, and crowding out genuine user traffic [30]). Approximately 14% of total web traffic is attributed to so-called _bad bots_ [54]. As a result, web administrators need to selectively block certain categories of bots while preserving access for legitimate bots and actual visitors. Since 2023, a new class of bots has emerged: Web Agents. They can automate complex tasks on the Web, going beyond traditional browser automation tools such as _Selenium_ , _Puppeteer_ , or _Playwright_ . Leveraging _large language models_ (LLMs), these agents are capable of solving anti-bot mechanisms, mimicking human behavior, and, in some cases, operating directly from the local machine of the user configuring them. As a result, it is becoming increasingly difficult for website administrators to detect and block these LLMbased bots. Modern Web Agents commonly integrate stealth and anti-detection techniques, while numerous proprietary and opensource anti-bot mechanisms have emerged recently, specifically to block them. However, despite their growing prevalence, there is little evaluation of the effectiveness of state-of-the-art anti-bot mechanisms against these LLM-based bots and their stealth capabilities. Likewise, no prior work has comprehensively studied how to characterize and distinguish Web Agents deployed either in the cloud or locally. This dynamic explains the ongoing arms race between bot operators and web administrators. The most basic countermeasure, the Robots Exclusion Protocol (commonly known as robots.txt [44]), allows web administrators to declare which paths crawlers should avoid. However, since robots.txt is merely advisory, many bots, including some of those operated by AI companies, ignore it entirely and scrape content regardless [2, 67]. Moreover, non-expert web administrators, such as artists, hobbyists, or beginners are often unaware of this convention or are unable to modify the file due to restrictions imposed by their hosting provider [67]. More direct enforcement mechanisms, such as server-side rules [40] and useragent blocking, shift control from the bot to the server but remain trivially bypassed via user-agent spoofing [59, 66, 73]. Hence, more sophisticated techniques have been developed, including challengebased methods (e.g., CAPTCHAs [47, 90], proof-of-work [112], browser [8, 124, 125] and TLS fingerprinting [66, 88], which aim to identify bots more reliably regardless of the identity they claim. This paper addresses these open questions by deploying multiple honeysites protected by one or more anti-bot mechanisms (e.g., robots.txt, CAPTCHAs, proof-of-work, and Cloudflares free proprietary solutions). We integrated network-, HTTP-, and browser-level fingerprinting techniques, and prompted six LLMbased Web Agents to visit the deployed honeysites. Our analysis reveals three main findings: **(i)** some Web Agents were able to bypass all evaluated anti-bot mechanisms; **(ii)** all evaluated Web Agents can be distinguished both from humans and from one another using multi-layer fingerprinting techniques across network, HTTP and browser layers; **(iii)** stealth and anti-detection mechanisms often increase detectability rather than decrease it.