Every click your AI agent makes—its speed, rhythm, and pauses—silently reveals which LLM powers it. And it cannot be disguised.
Researchers at the University of Oxford found that the behavioral traces LLM browser agents leave on web pages—how they click, where they click, and how long they wait between actions—are enough to identify the underlying model with up to 96% F1. Fourteen frontier models, including GPT-5.4, Claude Opus 4.6, Gemini 3.1, and Qwen3.5-VL, were all identifiable.
More unsettling: the identification is passive, real-time, and invisible to the agent. Any website can embed a small piece of JavaScript and quietly determine which family of agent is visiting.
1. Setup: websites "see through" agents with zero cooperation
The authors drove a single browser-agent framework (Midscene.js) with 14 different LLMs, performing information retrieval and shopping tasks—researching on Wikipedia, buying on Amazon.
A lightweight JavaScript listener on each page simply recorded the agent's actions: click coordinates, scroll direction and magnitude, keystrokes, and most importantly the inter-event interval (IEI) between actions. No conversation content, no screenshots, no HTTP headers—behavior only.
An XGBoost classifier trained on these traces achieved F1 above 70% for most models, peaking near 96% (the 14-class random baseline is ~7%).
2. Why it works: every model has its own "behavioral tempo"
SHAP analysis shows temporal features matter most: the standard deviation of inter-action intervals, mean click intervals, and time-to-first-action far outperform content features like *what* was clicked.
Models differ widely in their "thinking speed" on a page—some click decisively after one glance, others hesitate, others bounce around before deciding. These patterns form a unique interaction rhythm per model.
Crucially: even when random delays were injected to disrupt temporal features, the classifier recovered its performance, because models also have distinctive patterns in *what they do* (click positions, page-flipping frequency, key patterns).
> What remains unclear: how much would behavior shift if users configured custom system prompts or different temperature settings? The paper uses uniform settings (no system prompt, fixed temperature). Real deployments vary, and this distribution shift was not tested.
3. Speed: no need to wait for the task to finish
Two further findings: less than one-third of the trace data suffices to train a near-optimal classifier, and after observing roughly 40% of an agent's actions, the classifier identifies the model with high confidence.
4. Why it matters
Once an agent is fingerprinted, several attack surfaces open:
1. Model-specific prompt injection. Different models vary in injection resistance; knowing the model lets attackers pick the most effective payload.
2. Adversarial cost inflation (sponge attacks). For token-billed models (e.g., Claude Opus 4.6 or GPT-5.4), sites can serve content demanding verbose reasoning, sharply raising costs.
3. Model-specific access control. A site can show benign content to one model's checker while serving crafted injection traps to another's agent.
5. Commentary
The truly unsettling part is not the 96% figure but what it reveals: the security assumptions of the entire agent ecosystem have not yet been established. As the paper argues:
> "For next-generation agent-aware web infrastructure, the question is no longer 'is the client human or automated,' but 'which model is producing this behavior.' Agent-to-agent attribution should be the axis around which defense and coordination protocols are designed."
Open questions the author raises:
- Framework confounds. All agents used one browser framework; different frameworks (native Playwright, Browser Use, etc.) have distinct latency profiles. Does identification reflect the model or the framework? The paper does not disentangle this.
- Multi-agent architectures. With a planner deciding strategy and a worker executing, traces may reflect the architecture rather than the underlying model.
- Effective defenses. Random delays were tested and found insufficient; no fundamental fix is offered—possibly because agent-browser interaction itself leaks information by design.
- Title: *Known By Their Actions: Fingerprinting LLM Browser Agents via UI Traces*
- Authors: William Lugoloobi, Samuelle Marro, Jabez Magomere, Joss Wright, Chris Russell (University of Oxford)
- Preprint: arXiv:2605.14786 (cs.CR), submitted May 14, 2026
- Contribution: First demonstration that LLM browser agents can be passively identified from UI behavioral traces alone, reaching 96% F1 across 14 frontier models
- Paper: https://arxiv.org/abs/2605.14786
- Code: https://github.com/KabakaWilliam/known_actions
Still, this is an important paper. On the eve of mass agent deployment, it is a timely reminder: every second your agent works on your behalf, it is revealing its identity through its own pace.
Paper information
References
1. Lugoloobi, W., et al. (2026). Known By Their Actions. arXiv:2605.14786. 2. Pasquini, D., et al. (2024). LLMmap: Fingerprinting for Large Language Models. 3. Yao, S., et al. (2023). ReAct: Synergizing Reasoning and Acting in Language Models. 4. Zhou, S., et al. (2023). WebArena. 5. Lapid, R., et al. (2024). "Do Anything Now": Jailbreak Prompts on LLMs.