Anthropic Computer Use. OpenAI Operator. browser-use, Cline, Skyvern, Manus, BrowserBase. They drive real browsers, on residential proxies, with real cookies. Burein names them anyway.
CAPTCHAs and headless tells were tuned against scripted bots from 2018. The class of attacker that matters in 2026 is an LLM driving a real Chrome window through a real residential ISP, with a real cookie jar, doing tasks indistinguishable from a careful user — except in how they do them. Burein focuses on the how.
LLMs that drive UIs follow a screenshot → reason → small action → screenshot loop. Burein measures the cadence between user-visible state changes and the next action. Real humans are bursty; agents are metronomic.
Synthetic typing inherits the LLM's token boundaries: chunks of 3–6 chars emitted at near-constant intervals, with no typos and no backspaces. We measure inter-keystroke entropy and error-correction frequency.
Cursors that move in straight Manhattan paths, that teleport, that arrive precisely on the centroid of a button — no human hand produces these trajectories. Burein scores each path against a kinematics model.
Playwright, Puppeteer, Puppeteer-extra-stealth, Selenium, CDP, browser-use, BrowserBase, Skyvern — each leaves environment, header, JS-global, and timing tells. We track ~90 of them.
| Threat ID | What it is | Severity |
|---|---|---|
AGENTIC_COMPUTER_USE | Anthropic Computer Use cadence and display-server pattern. | Critical |
AGENTIC_OPERATOR | OpenAI Operator action-cadence + browser environment. | Critical |
AGENTIC_BROWSER_USE | browser-use Python library signatures. | Critical |
AGENTIC_SKYVERN | Skyvern automation harness. | High |
AGENTIC_MANUS | Manus task agent. | High |
AGENTIC_BROWSERBASE | BrowserBase remote browser session tells. | High |
PLAYWRIGHT_DETECTED | Playwright runtime hooks & env. | High |
PUPPETEER_DETECTED | Puppeteer & Puppeteer-extra-stealth bypass detection. | High |
AI_SYNTHETIC_TYPING | Token-boundary cadence with no error-correction. | High |
AI_SYNTHETIC_MOUSE | Kinematically implausible trajectories. | High |
HEADLESS_CHROME | Headless Chrome inconsistency triad. | High |
CDP_PRESENT | Chrome DevTools Protocol attached. | High |
ANTI_DETECT_BROWSER | Multilogin / Kameleo / AdsPower / Dolphin / GoLogin. | High |
Talk to us about your fraud and integrity goals — we'll show you the signals that matter for your stack.