Topic
Methods for identifying automated or abusive activity online, using behavioral patterns, content similarity, and other signals to flag bots and spam.
Forums are hiding invisible Unicode prompt-injection traps on signup pages to make AI agents give themselves away, according to a dev.to post. Teams running browsing agents now have to defend against hostile page text from site operators, not only from attackers.
Reality
OpenAI is selling Dots, a cartoon agent that runs apps on a virtual machine, first to top-tier accounts like the $100-a-month Pro plan. Its errands for The Verge kept ending in human takeovers, so desk work in a team's own apps is the case to test.
Reality
FingerprintJS is adding four products that verify AI agents from five named platforms and flag automation that only claims to be one. Sites still have to write the rule for what a verified agent may do on each page.
Reality
Seven variations of the old ytInitialPlayerResponse scrape returned zero bytes from a clean residential IP on 2026-09-21. Getting text back now costs either a maintained library or a headless browser per request.
Reality
Meta's Muse started hitting a Conditions of Use popup on Amazon.com on Sunday evening, and the next day Amazon filed a 41-page amended complaint against Perplexity. Anyone shipping a buying agent now needs the store's permission first.
Reality
Amazon stopped Meta's agent at its own website on September 20, citing conditions of use that speak about robots and data gathering tools. Its court case against Perplexity's shopping agent had already been set back on appeal.
Reality
Plain requests, a spoofed Chrome TLS fingerprint and headless Chrome all failed on mobile.de, and the first failure came back as 200 OK. Driving an ordinary Chrome over the DevTools protocol returned 64 listings.
Reality
Instinct and Meta's Muse are shipping to consumers, but the retailers holding the price and product feeds have their own plans, and the only conversion figure on the record is Walmart's unhappy one.
Reality
A dev.to audit of browser fingerprinting in 2026 rates canvas as still working on about 80% of browsers, while the signals Chrome's Privacy Sandbox froze are mostly declarative fields that automation frameworks already set by hand.
Reality
A dev.to walkthrough shows how a bot detector can score 99.7% accuracy while getting nearly one bot verdict in five wrong, and why only per-route counts of challenged known-human sessions show where the blocking lands.
Reality
A practitioner who builds an automation browser argues bot detection fires in a fixed order, starting at the TLS handshake. The Bamberg crawl he cites found 75% of blocks on headless Chromium needed only HTTP headers.
Reality
A document-analytics team published its bot-scoring weights after finding that two pieces of evidence a human read the file summed to exactly the score for no evidence at all.
Reality
Log2-bucketed gap entropy on live Nostr data separates two humans from a clockwork poster by 4x. Against a burst spammer, the same metric lands almost inside human range.
Reality