Loading today’s stories
Build1 distinct publisher3 min readPublished
CHEQ and Cloudflare both published their detection methods this year. Read next to the anti-detect vendor blogs, they show that a buyer outside the vendor can falsify about two things and has to take the rest on trust.
The Engineer · Build desk
Compiled by The EngineerSomething wrong?How this is made
Follow any of these and your For You feed starts watching them — no settings page required.
build
Cloudflare's agent browser makes a cost argument and skips the cost1 distinct publisher
build
Route leak prevention moves into the protocol, and two Tier-1s are stripping the signal1 distinct publisher
build
wkhtmltopdf has been read-only since 2023, and your scanner will only accept migration1 distinct publisher
build
Anthropic's Browser Use hands Claude element refs, and hands you the browser1 distinct publisher
The console check works because a patch has to leave a body somewhere. In a clean browser, `HTMLCanvasElement.prototype.toDataURL.toString()` returns `function toDataURL() { [native code] }` [17]. A wrapped implementation returns the wrapper body instead, or a re-faked native-code string that is subtly wrong [18]. The dev.to write-up suggests walking the same test across `toDataURL`, `getImageData`, `WebGLRenderingContext.prototype.getParameter`, `AudioContext` and `Function.prototype.toString` itself, on the grounds that a thorough implementation patches the function you would use to inspect it [19]. Which means a clean result is consistent with a clean browser and also with a very good patch. That is the whole problem, shrunk down to fit in a console.
CHEQ's second technique is the one a buyer can rebuild. Recursively enumerate everything reachable on `window` and the DOM, then diff it against a known-good snapshot of the browser and version the client claims to be, looking for properties that should exist and do not, properties that should not exist and do, and functions that should be native but contain wrappers, polyfills or instrumentation [13]. Two machines and a diff script get you a usable version of it. The first technique is cheaper still from the buyer's side: search the on-disk binary for product names, automation keywords and vendor identifiers against a baseline of clean builds, and dump process memory where the strings are encoded [12]. You can run that against the executable you were sold before you deploy it.
The third technique is the one no buyer can run, and it is where the marketing has the most room. CHEQ hooks every function it can find, logs path, arguments and call stack, then compares which functions fire during the same flow in a real browser against the target, treating calls that appear only in the instrumented environment as signals [14]. Then it drives the same page with Playwright, Puppeteer and Selenium, records which APIs fire in which order, and converts the ordering into a signature, so a live session that matches the pattern a Playwright mouse move produces gets flagged with no automation framework anywhere near the protected site [15]. You cannot test a browser against a signature set nobody publishes. The write-up's conclusion is the honest one: most of what these products are sold on cannot be verified by anyone outside the vendor [4].
The traffic number wants the same scrutiny. Cloudflare Radar covers roughly a fifth of all websites, and put automated requests at 57.5% of HTML traffic against 42.5% from humans [6], a gap of 15 points, or about 1.35 automated requests per human one [1]. For that ratio to describe your properties, your visitor mix would have to resemble the sites Cloudflare fronts, and you would have to accept Cloudflare's automated-versus-human labelling as yours. The direction still holds, and it arrived early: the same CEO predicted the crossover at SXSW in March 2026 and expected it by the end of 2027 [7], roughly 19 months after it actually landed, and three months before it did [2].
Cloudflare's stated premise for Precursor is that modern automation already runs in real browser environments and passes individual CAPTCHAs without raising suspicion, and that consistent human behavior over time stays hard to fake [10]. Against that, the artifact I would ask a vendor for is the property diff against a stated browser build, published, with the misses listed. Nobody is offering it, and the search results are still page after page of the same fingerprinting explainer ending at the same product [1].
Ranked by verification strength, evidence, and original report placement.
CHEQ's threat intelligence team published a write-up in February 2026 describing how they detect anti-detect browsers, including a named case study.
Cloudflare shipped a behavioral detection product in July 2026 and published the reasoning behind it.
In a clean browser, HTMLCanvasElement.prototype.toDataURL.toString() returns the string "function toDataURL() { [native code] }".
A wrapped implementation of a native API returns the wrapper body when stringified, or a re-faked [native code] string that is subtly wrong.
On June 3, 2026, Cloudflare's CEO posted that automated traffic had passed human traffic for the first time.
The write-up recommends running the stringification check across toDataURL, getImageData, WebGLRenderingContext.prototype.getParameter, AudioContext and Function.prototype.toString itself, because a thorough implementation patches the thing you would use to inspect it.
Distinct publishers with included, body-backed reporting in this cluster.
dev.to
1 article · September 1, 2026
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
One relay, one thing you can check yourself
Everything factual here passes through a single post. CHEQ's February research and Cloudflare's July announcement are dated, quoted in places and argued from, but never put in front of the reader — so the three techniques, the AntBrowser strings and the 57.5% split are all dev.to's account of documents we cannot open. What keeps this well clear of hearsay is the console test: the expected native-code string and the APIs to repeat it on are falsifiable in your own browser in a minute, which is a stronger footing than most single-source reporting can offer.
Shipped on the detection side, uncounted on the other
What has a date and a mechanism belongs to the defenders: Precursor announced and injecting session-wide signals, Radar's traffic split measured on roughly a fifth of the web, CHEQ's techniques described as working practice. On the side the piece is actually advising buyers about, there is nothing to count — no installs, no revenue, no sense of how many anti-detect products fail the string check. AntBrowser, the only product named, appears solely as someone else's case study.
Packaging oversells a body that undersells
The promise is checks a buyer can run in thirty seconds; what they actually separate is careful patching from sloppy patching, which dev.to concedes in its own last line of that section. That is the whole of the overreach. Read past the headline and the piece works the other way — it deflates a category built on an unmeasurable property, and the inflation it corrects belongs to the vendors on page one of the search, not to the writer. A small net positive, sitting almost entirely in the framing.
Everyone in the frame is selling
CHEQ and Cloudflare publish detection methodology because detection is the product; the anti-detect blogs publish fingerprinting explainers for the mirror-image reason. Cloudflare in particular forecast the crossover, measured it on its own network, and announced the countermeasure six weeks later — prediction, scoreboard and remedy from one house. dev.to turns this lens on the vendor blogs but not on its sources, and its own final section is heading into free tiers, entry prices and platform coverage when it cuts off, which is the shape of comparison content that earns on referral.
Specific enough to be wrong in public
Dates, percentages, product names and exact API paths are all concrete, and the central test is self-checking — this is not a story hiding behind vagueness. What holds the number down is structural: one voice, two primary documents summarised rather than shown, an unquantified claim that the automated majority is mostly agents, a case-study finding nobody outside CHEQ has reproduced, and a post that stops mid-word before its conclusions arrive.