The Visitor That Moves No Mouse

Machines have been visiting websites for thirty years. What is new is that one kind of them now looks indistinguishable from a person – not because it disguises itself, but because it genuinely drives a browser.

Machine traffic therefore splits into two halves with nothing in common but the word. One never appears in an analytics report and can be governed with a text file. The other appears in every report and cannot be governed with that text file at all.

Why the crawler never appears in the report

The older kind of machine fetches the delivered HTML and reads it. It executes no JavaScript, loads no container and consequently fires no event. To an analytics tool measuring through a script in the browser, that visit never happened. It becomes visible only in the web server’s access log.

This holds for the known collectors of the language-model providers as much as for search engine crawlers. They generally identify themselves by name in the user agent, respect robots.txt, and are governable for precisely that reason: something that executes nothing also circumvents nothing.

Why the agentic browser always appears in it

The newer kind is a complete Chromium-based browser driven by a language model. It renders like Chrome because it uses the same Blink and V8 machinery. It executes the container, sets cookies, fires events and ends a session. What stands in the report afterwards is a session, a device, an origin and a list of events – all of it genuine.

This is why the usual filters do not catch it. An exclusion list of known bots works off the user agent, and that user agent is an ordinary Chrome. A check for absent JavaScript finds nothing, because JavaScript runs. A check for missing screen dimensions finds nothing, because a window exists.

What robots.txt does not do here

The file addresses programs that collect on their own initiative. An agentic browser, however, acts on behalf of a person who has just asked a question, and the prevailing reading among providers is that such a fetch is not crawling. Whether that reading convinces is an open question. What decides the matter in practice is that a rule there would have no effect anyway, because the request does not come from a named collector.

An uncomfortable symmetry follows. The machines that can be governed through robots.txt appear in no metric. The machines that affect every metric cannot be governed there.

How an agent can still be recognised

What remains is behaviour. A driven sequence moves the pointer along straight runs between elements instead of wandering past them. It reads the page tree in bursts rather than while scrolling. It fires events at even intervals, because what lies between them is not deliberation but a step in a procedure. And it frequently acts without having scrolled first, which practically never happens with a person.

Server-side, technical traces are added, such as artefacts of the remote-control interface or discrepancies between a browser’s claimed and actual capabilities. Both routes share one catch: they need the raw events. A reporting interface that counts only sessions and events contains none of these details.

Where each kind of machine becomes visible

  training crawler       access log            yes
                         analytics report      no   (no JavaScript)
                         robots.txt governs    yes

  agentic browser        access log            yes, as Chrome
                         analytics report      yes, as a session
                         robots.txt governs    no

  distinguishing features exist only in the raw data:
    event spacing, action without scrolling,
    straight pointer runs, remote-control artefacts

The identity that can be signed

On the provider side an answer to the recognition problem is taking shape. Web Bot Auth builds on HTTP message signatures per RFC 9421: the operator of an agent generates an Ed25519 key pair, publishes the public half at a fixed path on a domain it controls, and signs every outgoing request. A site can verify the signature and then knows with certainty which operator the request came from.

The status deserves an honest description, though. An IETF working group has been dealing with it since early 2026, and no adopted document exists so far. Several large network and security providers verify the signatures in production regardless. Relying on it today means relying on a draft with broad support – and even that only helps against agents that want to be recognised.

What this means for a number

The widely quoted market figures on the share of agentic traffic come from security vendors that sell detection. That does not make them wrong, but it does make them something other than a neutral finding, and they describe other people’s sites in any case. For one’s own data the only defensible figure is the one measured locally.

In practice that means three things. First, the raw data belongs somewhere that spacing and ordering can be analysed – an interface of finished reports does not suffice. Second, the question is worth asking before the next anomaly rather than after it, because an unexplained jump will otherwise be attributed to whichever campaign happened to be running. Third, the honest answer to the question of how large the share is, for most sites right now, is: unknown – and that is a better answer than a borrowed percentage.