How the old checks work
A bot farm sends thousands of logins a minute. Each request claims to be an ordinary browser: a Chrome user agent, normal headers, no cookies. Every one of those claims is easy to forge.
So defenders stopped reading the claims and started reading the machine. The TLS handshake shows which network stack is talking before the first byte of the page loads. Canvas, WebGL and audio tests make the device do math that real hardware does in its own way. When the claims say Windows and the hardware says a Linux network stack and an Apple chip, the bot gives itself away.
Why AI agents break this
An AI agent does not need to fake a browser. It can drive a real one, on a real machine, with a real network stack. The user agent says Chrome because it is Chrome. The handshake matches because it is the real handshake. The hardware tests pass because the hardware is real.
Every layer agrees, so a check built to find disagreement finds nothing. The question stops being what is this device? and becomes who, or what, is driving it?
What we are working on
DVC is building for that second question: telling a person from an agent, and one agent from a coordinated swarm of them, when every individual session looks clean.
If your team already sees traffic that passes every check and still does not behave like people, we want to hear what you see.
Want to know more?
Talk to us. Thirty minutes, no slides: you describe the traffic you see, and we tell you what we would look at first.