How client-side anti-fraud actually works, and what VLM agents change

Most client-side anti-fraud is sold as evidence that a human is present at the other end of the session. What it actually checks is whether the environment producing the request is a coherent, real browser: properties that agree with each other, timers that behave like real hardware, a mouse that moves the way arms and wrists move.

That gap is the whole story. The defence measures the cost of forgery. A bot gets caught because faking a coherent environment is expensive and cheap fakes are incoherent. Every paradigm below is a different way of raising that price.

Point-in-time VM attestation runs a small custom virtual machine inside the browser. It executes obfuscated bytecode that probes the environment, traps debuggers, checks timers, and emits a bearer token. Google BotGuard is the canonical example, and I have published a separate teardown of it, built on public research.

Stateful behavioural telemetry does the opposite: instead of one deep probe it accumulates a shallow profile over weeks. Cookies, storage, navigation cadence, dwell time. Its real weapon is latency: a three-month-old browsing history takes three months to grow, or has to be bought from someone who waited.

Behavioural biometrics and sensor telemetry model the body: mouse velocity and acceleration curves, scroll physics, click timing, touch pressure, accelerometer noise. The cost floor here has historically been human labour. Solving services charged roughly $0.50–$2 per thousand challenges in 2010 (Motoyama et al.), and 2Captcha still lists €0.50–€2.80 per thousand for the common challenge types.

Platform-level anonymous attestation replaces inference with cryptography. In Apple's Private Access Tokens, Apple attests the device and account, and issuers such as Cloudflare and Fastly sign blind tokens that a site can redeem without learning who the user is. Per-device limits on issuance were specified in an IETF draft, but that draft has lapsed, and Apple publishes no limits of its own. Privacy Pass, the protocol underneath, is not hardware-backed by itself: its first deployment used a solved CAPTCHA as the attester.

Hardware-anchored determinism — DBSC, FIDO2, passkeys — binds an enrolled session or credential to a key the device cannot export. It stops cookie theft and credential phishing, not anonymous automation: it applies only once someone has an account and an enrolled device.

For a decade the contest had a clean shape. The defender shipped an obfuscated VM and rotated the compile often. The attacker ran it through symbolic execution and deobfuscation tooling to recover the logic, then forged the answers. The race condition was whether reverse-engineering time stayed below the lifetime of a build.

That framing assumes the attacker inspects the defence. The paper calls this environmental forgery: the bot works inside the browser runtime and has to fake what the runtime reports. Most of the industry's obfuscation effort went into that assumption. It no longer describes every attacker.

I call the new vector operator synthesis. A vision-language model screenshots a real, unmodified browser, decides where to click, and an orchestration layer turns that coordinate into an OS-level mouse event. Nothing is patched. The navigator object, the WebGL renderer and the timers are all genuine. OS-level input is old: xdotool and AutoHotkey long predate any of this. What the model adds is that nobody has to write a script for each site.

This walks around the forgery problem instead of solving it. The VM still runs and still checks everything, and every check passes. Reverse-engineering time at the bytecode level goes to roughly zero, because nobody needs to look at the bytecode.

Two caveats. The model outputs a coordinate, not a trajectory: something else moves the cursor, and naive interpolation still looks like a machine. And industrial scale means containers, which leak — missing system fonts, a WebGL stack that does not match the declared operating system, odd TCP/IP fingerprints. The cognitive half of the problem is solved. The deployment half is not.

One boundary on "AI agent". The commercial computer-use products are built to stop at CAPTCHAs: OpenAI trained Operator to hand control back to the user when it meets one, and Google lists bypassing CAPTCHAs among the high-risk actions that the safety controls of Gemini 2.5 Computer Use block. They do not always stop — in July 2025 ChatGPT agent was reported clicking through Cloudflare Turnstile's checkbox — but the adversary in this piece is a self-hosted open-weight model with no such policy, not the assistant a reader uses at work.

The September 2026 revision of the paper adds a first data point. On a localhost testbed of five simple form pages I ran Playwright, scripted OS-level input, a pure VLM agent, and a hybrid that calls the model only on unfamiliar pages, ten runs per configuration, with small open-weight models. It is a first data point, not a benchmark: synthetic forms, a small sample, one model provider, and vendor test keys that always pass, so no production detector was measured.

Detection followed the injection point, not the model. The navigator.webdriver flag showed up in all twenty Playwright runs, and a hidden decoy button caught the ten that clicked by DOM reference. Neither fired in any of the fifty runs that used OS-level input, whether a script or a VLM chose the clicks. Two kinematic detectors fitted on public human mouse data behaved the same way. A straightness rule flagged every pointer jump from the scripted and the VLM agents alike and missed every textbook smoothed path; a learned classifier caught 35 per cent of the smoothed paths and none of the jumps. Each detected how the pointer was driven, never whether a model picked the target.

What the agent added was generalisation. On nine unseen variants of the form — new labels, some in German, new ids, moved buttons, different input widgets — scripts written for the base form passed at most 18 of 54 runs. The unchanged VLM agent passed 50 of 54. A text-only model given the accessibility tree instead of a screenshot passed all 54, so on labelled forms the generalisation comes from language reasoning, not from vision. Vision matters for where input enters: the text-only agent acts through the browser automation protocol and carries its traces inside the runtime, while the screenshot agent never touches the runtime at all.

The small models were also fast and cheap. Median latency per model call was 0.8–1.5 seconds, and a whole pure-agent run took 26–44 seconds. The cheaper model completed the five-field flow for €0.0019 per success, or €0.0010 as a hybrid, which is within what a human solving service charges for a single CAPTCHA.

The paper sorts the five paradigms into three tiers by how much of their pre-VLM cost survives. Two degrade, one is replaced by a cost the attacker can buy, and two do not care who or what supplies the input.

VM attestation degrades but does not vanish. Its forgery checks mostly stop costing the attacker anything, but the environmental probe still catches container artefacts, and IP reputation remains the main constraint. Timing is a weaker lever than I first assumed. Small open-weight models in my testbed took 0.7–3 seconds per action, which is in the range of human per-field times, so latency offers at most a regularity signal over a multi-step flow, and I have no human baseline to show even that. Microsecond instrumentation detection closes. Slow, reasoning-heavy frontier models remain unmeasured.

Stateful telemetry turns from a wait into a purchase. The model does not create profile age. What it does is operate bought aged profiles, accounts or real long-lived devices without the instrumentation that used to give them away, so ageing becomes a market price rather than a wait. Isolating thousands of cookie jars without cross-contamination is real infrastructure work, but that work can also be bought.

Behavioural biometrics degrade partially. Target selection is solved by the model; kinematics are not, because the model never produces them. In my testbed a straightness rule caught every pointer jump, scripted or VLM-driven, and missed every smoothed path, so against naive detectors the gap is cheap to close. Learned detectors in production remain untested. The surface is narrower than the pre-VLM literature assumed, but not zero.

Hardware-anchored anonymous attestation survives structurally, because the cryptography does not care who moves the mouse. A model driving a real attested device gets valid tokens, so this is not resistance to VLMs: it moves the attacker's cost to acquiring real devices and accounts, bounded by however many tokens the attester issues per device. The cheapest bypass is a farm of real devices, or relaying challenges to genuine ones; compromising devices is a costlier route. SDK-based residential proxy networks do not help here, because they rent out IP reputation, not attestation. A farmed or relayed token is valid and indistinguishable at the attestation layer, so the defender falls back to server-side signals: ASN reputation, IP-to-account cardinality, velocity, cross-session patterns. Software-anchored variants such as PACT do not get this verdict, because the scarce unit becomes a credentialed account (see below).

Hardware-anchored determinism also survives, but it answers a different question. DBSC binds a session cookie to a device key and counters cookie theft; Google made it generally available in Chrome on Windows for Workspace customers in May 2026. Passkeys stop credential phishing. A model driving the enrolled device passes both, and neither says anything about whether a fresh anonymous session is driven by a person or a model. Their ceiling is the device that holds the key: malware or an agent running on it inherits the bound session.

Three costs, roughly. Inference: at September 2026 frontier list prices one screen capture plus one action selection costs about 0.4 to 1.5 cents, so a ten-step flow runs four to fifteen cents per attempt. The small open-weight models in my testbed were 7 to 320 times cheaper per success, and a rational attacker uses them, or scripts the routine steps and calls the model only where it needs to see. Failure rates multiply the cost: a sixty per cent success rate is a 1.67x multiplier, forty per cent is 2.5x. Proxies: session continuity pushes the attacker off the commodity tier ($2.50–$8 per gigabyte) onto less elastic premium supply. State orchestration: containers, isolated profiles and rotation infrastructure, which replace the anti-detect browser licence.

The important asymmetry is direction. Proxy prices and human labour rates are roughly floor-stable. VLM list prices have fallen repeatedly since 2023; GPT-5 launched at half GPT-4o's input price. A defence priced against today's inference cost is priced against a number that has so far moved only one way.

Be precise about the status of these numbers. This is an accounting exercise, not an economic model: it tallies costs, it does not derive equilibria or predict behaviour. There are no published measurements of agent-driven attack throughput at scale. Machine-learning CAPTCHA solvers are well documented — Plesner, Vontobel and Wattenhofer solved 100 per cent of reCAPTCHA v2 image challenges in 2024 — but they solve one challenge, not a whole flow. My own testbed (September 2026, ten runs per configuration) is a first data point, not a benchmark. There is still no reliable data on proxy supply elasticity under this demand and no longitudinal study of inference deflation; closing that gap is the first item on the paper's research agenda.

Follow the argument to its end and it points somewhere uncomfortable. If probabilistic detection degrades against the top of the capability distribution, the defences that still impose cost on anonymous traffic are hardware-anchored tokens, and those require a platform-level root of trust. For anonymous web tokens today that is effectively Apple, the only deployed Private Access Token attester; I found none for Android or Windows. Google holds adjacent roots, Play Integrity for apps and the gate on which issuers Chrome accepts for Private State Tokens, after dropping its Web Environment Integrity proposal for the web in 2023. The passkey-sync providers hold another. A handful of companies decide which clients count as legitimate, at what rate and for which origins, and their incentives need not match those of the site consuming the attestation.

PACT, which Cloudflare announced on 22 June 2026 with Mozilla, Google, Microsoft and Shopify, tries a different anchor: instead of device hardware, an issuer vouches for a user based on account standing, a subscription or a first-party relationship. That widens the issuer set, and the Sybil problem moves with it. Scarcity becomes a credentialed account, and bulk registration, credential stuffing and cheap subscriptions are automatable upstream of the protocol. PACT is a proposal with no deployment timeline. As proposed in the W3C Anti-Fraud Community Group, it has no accreditation model or audit requirement for the parties that vouch, and scoring them is still only a sketch.

Bob Rudis has described the ratchet in this that nobody has to decide on. Tokens start as optional friction reducers. Tokened traffic passes cleanly, untokened traffic is challenged harder, thresholds recalibrate, and a class of legitimate traffic with no issuer relationship — scanners, archival crawlers, RSS readers, Tor users, alternative browsers — becomes structurally suspect. PACT's designers intend today's challenges as the fallback, but tokens can become mandatory without any single actor deciding it.

The opposite direction is already being built for agents that want to be recognised. Cloudflare's Web Bot Auth (May 2025) and its signed-agents programme (August 2025, with ChatGPT agent and Browserbase in the first cohort) let a well-behaved agent sign its requests, and the IETF has chartered a Web Bot Auth working group. That helps sites admit good bots. It does nothing about agents that choose not to sign, and it adds one more party deciding which automation counts as legitimate.

That is why I consider this the defining open question rather than detection. The anonymous authentication gap has been technically narrowed. What replaced it is a centralization gap: who gets to vouch, and who decides that, is a governance question the cryptography does not answer.