How to detect AI agents like ChatGPT agent on your website
On this page
To detect AI agents like ChatGPT agent, check four things in order: a Web Bot Auth signature (ChatGPT’s browser agent signs as https://chatgpt.com), the agent’s user-agent token, its operator’s published IP ranges, and finally behavior. Signed agents can be proven, declared ones checked against IP lists, and hidden ones need behavioral detection.
The usual advice says ChatGPT agent has no reliable fingerprint and can only be guessed at. That was true of early agents and is still true of many. It is no longer true of OpenAI’s, and the gap between agents that prove who they are and agents that do not is now the most useful thing to understand about this traffic.
How are AI agents different from AI crawlers?
An AI crawler fetches pages on its own schedule to build a training set or a search index. GPTBot, ClaudeBot and PerplexityBot are crawlers, and our field guide to GPTBot and its siblings covers them. An AI agent is different: it acts for one person, right now, and often drives a full browser that loads your scripts, clicks buttons and fills in forms.
There are really two agent shapes. User-triggered fetchers such as ChatGPT-User and Perplexity-User grab a page when someone asks a question and identify themselves with a simple token. Browser agents (OpenAI’s cloud browser, Perplexity Comet, Claude in Chrome, Meta’s Muse) run a Chromium browser and can look like an ordinary visitor.
Cloudflare’s bot documentation, updated in November 2026, draws a related line between “Direct” bots run by one operator and “Intermediary” agents that many end users drive. As Cloudflare puts it, “you may trust the intermediary operator, but not necessarily every end user driving it.” Verifying an agent proves who built it, not who is steering it.
How much AI agent traffic is there?
Agent traffic is still small in share but growing fast and changing shape monthly. In a September 2026 post, Cloudflare said daily requests from AI agents on its network grew by more than 1,700% over the past year.
HUMAN Security’s State of Agentic Traffic report for September 2026 found that total agentic volume rose 209.7% over August. Meta’s Muse, launched on September 8, took 40.34% of agentic traffic. OpenAI products together took 39.7%, with ChatGPT Agent alone at 28.6%. Perplexity’s Comet fell from 40.7% to 9.4% in a single month, after leading with 47.1% in HUMAN’s July 2026 edition.
Two takeaways matter for detection. First, the mix moves too fast for a hand-maintained list of agent names. Second, agents mostly read: product and search routes accounted for 81% of agentic activity in HUMAN’s September data. On the sign-in, sign-up and checkout flows that bot-defense firm Arkose Labs protects, roughly one in every 5,200 sessions came from a named AI agent in Q3 2026, according to its Agentic AI Trust Report.
Is ChatGPT agent still called ChatGPT agent?
Not inside ChatGPT. OpenAI’s ChatGPT agent help article now says “ChatGPT agent is no longer available” and points users to ChatGPT Work and its Cloud browser for browser tasks. Many AI answers and guides have not caught up.
The rename matters less than what came with it. OpenAI’s Cloud browser allowlisting guide states that the Cloud browser “uses Web Bot Auth to sign outbound HTTP requests, allowing website operators to verify that requests genuinely originate from ChatGPT.” Each request carries Signature, Signature-Input and a Signature-Agent header set to "https://chatgpt.com", and the public keys live at https://chatgpt.com/.well-known/http-message-signatures-directory.
Security vendors kept the old name. The same OpenAI guide says Akamai, HUMAN and Vercel recognize the traffic under their existing “ChatGPT Agent” entry, and Cloudflare under the bot tag chatgpt-agent. So if your WAF or analytics shows “ChatGPT Agent”, that is this signed browser. OpenAI also notes that at launch the Cloud browser “cannot sign in to websites or complete payments.”
How does each AI agent identify itself?
Each operator documents a different mix of signals. This table summarizes what the official docs say as of November 2026, and how you can check each claim.
| Agent | Operator | How it identifies itself | How to verify it |
|---|---|---|---|
| Cloud browser (ChatGPT Agent) | OpenAI | Web Bot Auth signature, Signature-Agent: "https://chatgpt.com" |
Verify the signature against chatgpt.com’s key directory |
| ChatGPT-User | OpenAI | ChatGPT-User token in the user-agent |
Source IP in openai.com/chatgpt-user.json |
| Google-Agent | Google-Agent token in a Chrome user-agent |
Source IP in Google’s user-triggered-agents.json; some requests signed as https://agent.bot.goog |
|
| Claude-Agent (Anthropic-hosted browsers) | Anthropic | Real browser user-agent plus a Claude-Agent token |
Source IP listed under Claude-Agent at claude.com/.well-known/sail |
| Claude-User | Anthropic | Claude-User token |
Anthropic’s published bot IP list |
| Perplexity-User | Perplexity | Perplexity-User token |
Source IP in perplexity.ai/perplexity-user.json |
| Comet | Perplexity | Ordinary Chromium browser, no agent token | No per-request identity: behavior only |
| Muse and other personal agents | Meta and others | Usually undeclared | Behavior, plus network context where it helps |
The sources: OpenAI’s crawler overview, Google’s user-triggered fetchers list, Anthropic’s help pages on hosted browsers and crawlers, and Perplexity’s crawler docs. For Comet, HUMAN’s agent profile states that it “does not provide a per-request, verifiable identity signal.” We found no published site-owner identifier for the Claude in Chrome extension, which runs inside the user’s own browser.
Anthropic’s IP list for Claude-Agent uses a draft format, draft-kelley-webbotauth-sail-00, which Anthropic notes “is not yet a standard, so it may evolve over time.” Fetch it on a schedule rather than hardcoding addresses.
How do I verify an AI agent, step by step?
Work down a ladder from the strongest proof to the weakest, and stop at the first rung that gives a clear answer.
- Capture the evidence. Log the full user-agent, the source IP (the real client IP, not your CDN’s) and the
Signature,Signature-InputandSignature-Agentheaders. OpenAI warns that proxies which strip these headers will make legitimate Cloud browser traffic look unsigned. - Check for a Web Bot Auth signature. If
Signature-Agentis present, fetch the operator’s key directory and verify the signature under RFC 9421, checking freshness so a captured header cannot be replayed. A valid signature is cryptographic proof. Our plain-English guide to Web Bot Auth walks through the handshake. - Match the user-agent token to its operator.
ChatGPT-User,Google-Agent,Claude-AgentandPerplexity-Usereach name the operator whose list you check next. Treat the token as a claim only. - Check the published IP ranges. Compare the source IP with the operator’s JSON file. Refresh the files automatically, because operators rotate addresses.
- Use reverse DNS where the operator supports it. Google documents forward-confirmed reverse DNS for its fetchers. How reverse DNS verification works explains the round trip and where it runs out.
- Score behavior for everything left. Unsigned, undeclared sessions get judged on how they act (next section).
- Record a verdict per request. Keep four buckets: verified, declared but unverified, likely agent, and unknown. That turns detection into something you can count and act on.
Steps 2 to 5 run on the server, so they work even when an agent blocks your JavaScript. Step 6 usually needs some client-side signal as well.
How can I tell if traffic claiming to be GPTBot or Googlebot is real?
Do not trust the name. Check the source IP against the operator’s published ranges (openai.com/gptbot.json for GPTBot, Google’s crawler IP files for Googlebot), and for Google, also run forward-confirmed reverse DNS. Anything that fails is an impersonator, whatever its user-agent says. Our step-by-step guide to verifying Googlebot and catching spoofed GPTBot has the commands and a worked example.
The difference with agents is the extra rung at the top. Crawlers like GPTBot and Googlebot are verified by network today. Agents increasingly carry a signature. Google’s Web Bot Auth guide, which it labels experimental, says it is testing signatures “with some AI agents hosted on Google infrastructure,” and adds: “We don’t sign every request of a particular agent.” So an unsigned Google-Agent request is not automatically fake. Fall back to the IP check.
The protocol itself is still moving. The IETF working group’s core draft is draft-ietf-webbotauth-httpsig-protocol-01, on the Standards Track but not yet an RFC.
How do I detect AI agents that do not sign their requests?
Most agent traffic is in this group. In Arkose Labs’ Q3 2026 data, only 2.3% of legitimate AI agent sessions presented a verified Web Bot Auth signature. ChatGPT agent signed 78.4% of its sessions, “the only agent that signed at scale.” Arkose puts Muse, Instinct and Comet in the group that does not declare itself, and says of them: “What gives them away is how they behave, not where their traffic comes from.” Note the scope: those figures cover protected actions only (login, registration, checkout, password reset and one-time passcodes), July to September 2026.
HUMAN’s research on AI agent signals, published April 2026, found that every agent it analyzed relies on Selenium, Playwright or Puppeteer, most commonly Playwright. That means classic automation checks still work: navigator.webdriver set to true, missing or altered browser properties, and scripts injected by the framework. Some agents leave their own markers. HUMAN found Genspark injects a div#genspark-float-bar into every page it opens, “an easy DOM fingerprint to log and alert on.”
Network context helps for cloud agents and fails for local ones. Arkose found 59% of Muse sessions came from hosting or data-center IPs, against 4.3% for people. Instinct, which routes through home and mobile networks, came from data-center IPs in just 0.2% of sessions. A data-center check catches the first and misses the second.
In your own logs, look for sessions that move with machine precision: steady request timing, systematic page order, dense form activity with no idle time. Our guide to spotting bot traffic in server logs covers those request-level signals.
Should I block AI agents once I detect them?
Usually not by default. Arkose classified 77.4% of AI agent sessions as legitimate, compared with 7.9% of known bot sessions. An agent that looks automated is often a customer running an errand. Arkose also found Instinct’s sessions looked medium or high risk 96.8% of the time, yet none was linked to an attack.
Detection should feed a policy, not replace one. Let verified agents read, rate-limit declared ones, and judge undeclared sessions on what they try to do, with tighter rules on sign-in and checkout. A signature tells you who an agent is. It does not tell you the request is harmless. If you do block, check which rule actually fires, because a CDN policy can block more than you intended.
This is how Lume handles agent traffic. Lume verifies agents with Web Bot Auth signatures, forward-confirmed reverse DNS and published IP ranges, records a verdict for each request, and labels anything it cannot prove as unverified rather than marking it verified. The agent verification feature shows which visitors are genuine and which only claim a trusted name, and the Web Bot Auth explainer covers how signatures are checked.
Frequently asked questions
Can I detect ChatGPT agent with its user-agent string?
Not reliably. OpenAI’s browser agent runs a real Chromium browser, so its user-agent can look like ordinary Chrome. The dependable signal is its Web Bot Auth signature: a Signature-Agent header of "https://chatgpt.com" that you verify against the keys at chatgpt.com/.well-known/http-message-signatures-directory.
What is the difference between ChatGPT-User and ChatGPT agent?
ChatGPT-User is a fetcher that grabs a page when someone asks ChatGPT a question, and it identifies itself with a user-agent token and published IP ranges. ChatGPT agent, now the Cloud browser in ChatGPT Work, drives a full browser to complete tasks and proves itself with a cryptographic signature instead.
Do all AI agents sign their requests with Web Bot Auth?
No. OpenAI signs, Google signs some Google-Agent requests experimentally, and platforms in Cloudflare’s signed agents directory sign. Many personal agents and agentic browsers, including Comet, do not. Arkose Labs found only 2.3% of legitimate agent sessions on protected flows carried a verified signature in Q3 2026.
Can Google Analytics detect AI agents?
Only partly. Browser agents can run your analytics script, so some show up as ordinary visits, while simple fetchers like ChatGPT-User typically do not run JavaScript. Neither path labels the session as an agent. You need server-side signals (signatures, user-agent tokens, IP ranges) to identify them.
Is a verified AI agent safe to allow?
Verification proves identity, not intent. A signed agent is genuinely from the operator it names, but an intermediary agent can be driven by any of its users. Allow verified agents to read, and keep your normal controls on sign-in, account changes and checkout.
How do I verify Claude’s browser agent?
Anthropic-hosted browsers add a Claude-Agent token to a normal browser user-agent. Match on that token, then confirm the source IP is listed under Claude-Agent at claude.com/.well-known/sail. Anthropic notes anyone can send the same user-agent, so the IP check is what makes it genuine.
