AI agents now browse the web, fill forms, create accounts and click buttons — at scale, around the clock, increasingly well. CAPTCHAs can't tell them apart anymore; modern models solve puzzles cheaply. useHUMA answers the question that matters in the agentic era: is there an actual human behind this session? — from behavior alone, in one API call, with zero PII.
| Defense | Why it used to work | Why an AI agent walks through it |
|---|---|---|
| User-agent and headers | Scripts announced themselves. A curl request looked like a curl request. | Agents drive a real browser, so the headers are real because the browser is real. |
| IP and ASN reputation | Abuse arrived from datacenter ranges you could block wholesale. | Residential proxies are cheap, and plenty of agents run on the user's own machine. |
| CAPTCHA and puzzles | The puzzle was harder for a machine than for a person. | That stopped being true. Vision models clear image and text challenges faster than your customers do. |
| Honeypot fields | Naive scripts filled in every input they could find in the HTML. | An agent reads the rendered page. A field nobody can see is a field it does not fill. |
| Rate limits | Abuse showed up fast, in volume, from one place. | One agent, working at human pace from one address, never trips a threshold. |
| Device fingerprints | A repeat offender carried the same fingerprint between attempts. | Fresh profile per run, and the fingerprint is whatever the agent decides it is. |
Most AI agents drive a real browser through Selenium, Playwright or Puppeteer — which is exactly why they slip past traditional bot defenses built to spot fake browsers and bad IP ranges. useHUMA doesn't care which framework is at the wheel: it scores the behavior itself. A Playwright session moving with robotic precision looks like what it is — and a framework nobody has invented yet gets caught by the same physics.
On Pro and Enterprise plans, every verification returns a separate agent block alongside the human score — your three-way signal: human, authorized agent, or malicious bot. The decision stays yours.
POST /api/v1/verify →
{
"human": false,
"confidence": 0.5,
"token": "h_verified_...",
"pii_stored": false,
"agent": {
"is_agent": true,
"agent_confidence": 1.0,
"signals": ["webdriver_flag", "automation_globals",
"instant_action", "headless_hints"]
}
}Honest by design: no detector catches a perfectly throttled agent with certainty. useHUMA gives you a transparent confidence score and raises the cost of automation dramatically — we never claim "untouchable." Available on Pro & Enterprise →
Stop agent-driven fake accounts before they hit your database, burn your email quota, or farm your free tier.
Keep autonomous spam out of contact forms, waitlists and surveys — without making humans solve puzzles.
Detect credential stuffing and hijacked sessions with continuous post-login monitoring, not just a gate at the door.
Research panels, reviews and UGC platforms certify that responses come from people — not synthetic respondents.