How to detect Computer-use agents

Computer-use agents built on Claude, OpenAI or Gemini never identify themselves, because the model only returns clicks and keystrokes and the developer's own browser does the browsing, with no user agent token, signature or AI-vendor IP range. You detect them through that browser, since reference setups run Playwright Chromium or a Linux virtual desktop that leaves automation markers and screenshot-paced input. Verisoul returns them as headless_chrome, cdp_automation or webdriver, and flags runs on stealth hosts through bot score.

Detection method

Self-declaredThe agent names itself in its user agent, and Verisoul confirms it with network, device or behavioral data. A user agent alone is never enough. Verisoul names it only in some setups; other sessions are flagged through bot score.

Signals that identify it

DeviceHeadless browser markers, DevTools-protocol automation artifacts or WebDriver flags in the browser, depending on the harness
BehavioralScripted navigation with no human input

Computer-use APIs are model endpoints that look at a screenshot and reply with the next mouse click or keystroke, so a developer's own program can operate a browser or desktop on a user's behalf. Anthropic released computer use in public beta with Claude 3.5 Sonnet on Oct 22, 2024. OpenAI followed on Mar 11, 2025 with its Computer-Using Agent model in the Responses API, and Google released the Gemini 2.5 Computer Use model, tuned for browsers, on Oct 7, 2025.

None of the three vendors publishes usage numbers for these APIs, which makes them hard to size. What we know is that they are paid per token and that the developer supplies and pays for the browser or desktop the model controls. That second part is what matters for detection, because the AI company never touches your site at all.

Developers use them for form filling and data entry, testing user flows, booking and shopping tasks, scraping behind logins and back-office workflows. Any site with a form or a login can see them, and they turn up most on SaaS sign-ups, ecommerce and travel.

How computer-use agents show up on your site

The model only returns actions, and the developer's code carries them out in a browser the developer runs. Anthropic's reference implementation is a Docker container with a virtual Linux desktop and Firefox. OpenAI's samples use Playwright with local Chromium and list Browserbase, Browser Use, Daytona and E2B as hosted partners, while Google's samples use Playwright Chromium at 1440x900. Traffic leaves from the developer's VM, laptop or browser host, not from Anthropic, OpenAI or Google.

Check	What computer-use agents do
User agent	No token. Whatever browser the developer runs
Web Bot Auth signature	None from the model vendors. A host such as Browserbase may sign
IP ranges	No vendor list. Developer's network or browser host
robots.txt	Not documented by any of the three vendors

Why computer-use agents are easy to catch in default setups

The reference setups are built for clarity, not stealth. Playwright Chromium and a virtual Linux desktop in Docker leave automation markers, VM traits and datacenter IPs. Playwright tends to leave globals such as __playwright__binding__ and __pwInitScripts in the page, and WebDriver harnesses built on ChromeDriver leave cdc_ variables in the document, and the way the model works adds its own rhythm: a fixed, round viewport, long pauses while the model reads each screenshot, then a single click with the cursor jumping straight to its target, and text that arrives pasted or perfectly even.

All of that depends on the host. When a developer runs the same model on a stealth browser service with residential proxies, the automation markers disappear and only the pacing remains, while a host that signs, such as Browserbase, which Cloudflare lists as a signed agent, identifies itself instead. That is why the same Claude, OpenAI or Gemini agent can be trivial to catch in one deployment and hard in the next.

How Verisoul detects computer-use agents

Verisoul names the harness rather than the model. Depending on how the developer built it, the browser shows headless markers, DevTools-protocol automation artifacts or WebDriver flags, and the session moves with scripted navigation and no human input. Verisoul returns those as headless_chrome, cdp_automation or webdriver. Runs on a stealth browser host that hides those markers are flagged through bot score, and Verisoul does not name the model behind them.

API response

"agent": {
  "id": "cdp_automation",
  "name": "DevTools automation",
  "provider": "Open source",
  "type": "headless_automation",
  "detection_method": "self_declared",
  "detection_signals": [
    "network",
    "device",
    "behavioral"
  ]
}

id is the rule key, here cdp_automation for a Playwright-driven Chromium; headless_chrome and webdriver cover other harnesses
type is headless_automation, a scripted browser with no person driving it
detection_method is self_declared, because the browser exposed its own automation markers
detection_signals lists the evidence, device for automation artifacts and behavioral for scripted navigation

Agent Atlas covers DevTools automation, Headless Chrome and WebDriver, and the AI agent detection docs explain the response format.

01Model returns a click
02Developer's Playwright script performs it
03Your page loads in a Linux VM
04Next screenshot goes back to the model

How Computer-use agents reaches your site

How to detect computer-use agents step by step

Add the Verisoul SDK to sign-up, login and payout pages following the Verisoul docs
Route headless_chrome, cdp_automation and webdriver to your automation policy
Set a bot score threshold for unnamed sessions to catch agents running on stealth hosts
Allowlist your own testing or partner automation so production rules can stay strict

Should you block computer-use agents?

A computer-use agent may be doing legitimate back-office work for a business, but on your site it is usually an unknown developer's script. Block it at sign-up and payouts, and send it to review at checkout, where model vendors' own guardrails on purchases can be switched off by the developer.

If a partner needs to automate a flow on your site, offer an API or a dedicated path. That keeps the browser flow strict for everyone else.

Questions about Computer-use agents

Can websites tell when Claude computer use is controlling the browser?

Not by name, because Anthropic adds no user agent token or signature. Its reference setup runs Firefox on a virtual Linux desktop in Docker, so sites see a Linux machine with scripted, screenshot-paced input.

Does OpenAI computer use get detected as a bot?

Often, in its default setup. OpenAI's samples drive local Chromium with Playwright, which leaves standard automation markers, while hosted partners change what the site sees.

Can Claude or Gemini computer use solve CAPTCHAs?

Google's sample prompt tells the agent never to solve CAPTCHAs. A widely shared Oct 2025 report of Gemini solving one turned out to be the browser host's built-in solver, which shows the host decides more than the model.

Will websites block AI computer-use agents?

Sites with bot detection catch most default setups, because Playwright and virtual-display browsers leave clear traces. Agents on stealth hosts with residential proxies need behavioral detection.

Is computer use safe for logging into accounts?

Prompt injection is the main risk. Anthropic's docs warn that Claude may follow instructions in page content even when they conflict with the user's request, and Anthropic and Google both add confirmation steps for sensitive actions.

Computer-use agents