Bot detection benchmark 2026: rates from 9% to 99% across AI agents and stealth browsers
A bot detection benchmark was revisited in 2026 with stealth browsers and modern AI agents, finding detection rates ranging from 9% to 99%. A year prior, five leading bot detection systems were evaluated against automated browsers programmed to complete predefined tasks; detection rates then varied from 33% to 87%. Systems that incorporated behavioral signals alongside device-level signals generally outperformed those relying on device information alone. Since browser automation has advanced considerably, the benchmark was re-run with an expanded set of adversaries including conventional browser automation, stealth browsers, and AI-powered browsing agents, testing similar detection systems: Proof of Human, Google reCAPTCHA v3, hCaptcha, Cloudflare Turnstile, and Cloudflare Bot Management. The results reveal similarly wide variation in detection performance.
How detection systems signal automated activity
Each detection system in the benchmark uses a distinct combination of signals to identify automated activity. Proof of Human employs a machine-learning model that classifies sessions as human or automated based on both behavioral and device signals, including typing patterns, mouse movements, clicks, and scrolling. Google reCAPTCHA v3 assigns each session a score from 0 to 1 indicating the likelihood the user is human; it operates without a visible challenge and considers browser-integrity and Google-side reputation signals, with the site itself determining the threshold for accepting a session. hCaptcha presents an "I am human" checkbox and evaluates the browser's risk profile; depending on the result, it either verifies the session immediately or presents an image-based challenge that must be completed. Cloudflare Turnstile performs browser-integrity checks in the background and issues a verification token when a session passes; it generally operates without a puzzle but may request user interaction when signals are ambiguous. Cloudflare Bot Management evaluates requests using heuristics and machine-learning models trained on traffic across Cloudflare's network; the full system assigns scores from 1 (automated) to 99 (human), while the Pro-tier implementation returns broader classifications such as likely_human, likely_automated, automated, or verified_bot.
Adversary types: from scripted browsers to AI-powered agents
The set of adversaries covered increasingly sophisticated forms of automation. Chromium represents a standard Chromium browser automated through Playwright and the Chrome DevTools Protocol without stealth modifications; it retains common indicators of automation such as navigator.webdriver and CDP-related artifacts, serving as the baseline "obvious bot." CloakBrowser is a stealth-focused Chromium fork that modifies browser fingerprints at the source-code level, including GPU, canvas, WebGL, audio, fonts, user-agent, and TLS signals; it was run through a residential proxy with optional humanization features for mouse and keyboard input. Browser Use is an open-source AI-agent framework that uses an LLM (Claude Opus in the setup) and visual page information to plan actions and operate an unmodified browser from cloud infrastructure. Perplexity Comet Uses is Perplexity's AI-powered browser, which uses an LLM and visual information to navigate webpages and complete tasks. Grok is xAI's browser-use agent, which uses an LLM and visual information to navigate and complete web tasks.
Performance variation across systems and adversary types
Detection performance varied substantially across systems. Aggregated across all adversaries, Proof of Human identified 99% of automated sessions, followed by reCAPTCHA v3 at 69.4%, hCaptcha at 44.3%, Cloudflare Turnstile at 42.1%, and Cloudflare Bot Management at 9.1%. Performance differed considerably by adversary. The clearest split was between scripted browsers and AI agents. hCaptcha and Cloudflare Turnstile caught nearly every scripted Chromium and CloakBrowser session but few of the AI-agent sessions. reCAPTCHA v3 showed the opposite pattern, identifying most agent sessions but none from CloakBrowser. Cloudflare Bot Management caught few sessions from any adversary, while Proof of Human detected at least 95% of sessions overall.
As most detection systems are black-box, the authors could not directly determine which signals produced each result. However, the systems' observed behavior, together with publicly available documentation, suggests several likely sources for this failure. hCaptcha and Turnstile rely heavily on browser fingerprinting and risk profiles that stealth browsers like CloakBrowser are designed to conceal. reCAPTCHA v3's dependence on Google-side reputation signals may explain its ability to identify AI-agent sessions while failing on CloakBrowser, which routes traffic through residential proxies. Cloudflare Bot Management's low detection rates across all adversary types suggest its heuristics and models, trained on broader Cloudflare network traffic, may not capture the specific patterns generated by the benchmark's adversaries.
Limitations and interpretive considerations
Several limitations should be considered when interpreting these results. The task used a five-question survey combining multiple-choice items with open-ended responses; each of the five adversaries attempted the survey 20 times, yielding up to 100 sessions per detection system. Some detection systems failed or crashed before session completion, leaving between 89 and 100 evaluable sessions for each system. The authors note that as most detection systems are black-box, the internal workings remain opaque. Observed behavior and public documentation were used to infer likely sources of failure rather than providing definitive answers.
What the results suggest about bot detection's next phase
The results suggest that bot detection is entering a new phase. Traditional automation signals remain effective against scripted browsers, but they are less reliable against AI agents that operate in genuine browser environments intelligently. Interactive challenges may offer limited protection when vision-capable agents can interpret and complete them. And as browser-level indicators become easier to avoid, the way a user behaves throughout a session becomes increasingly important for distinguishing human activity from automation. Future benchmarks should test larger volumes of traffic, include human participants to measure false-positive rates, and evaluate more complex tasks and emerging agents. At Proof of Human, the team will continue tracking these changes and developing methods in this evolving threat landscape. To test Proof of Human on your own application, visit poh.org.