TL;DR: OpenClaw plus Scrapling stealth bypass of Cloudflare and PerimeterX
- Edge WAF is not enough: Everyone wants to declare AI agents blocked at the edge, but OpenClaw paired with Scrapling's StealthyFetcher spins up headless Chrome that solves Turnstile, hides WebRTC leaks, and randomizes canvas noise so each session looks like a fresh human. Your edge WAF is not the answer.
- By the numbers: Cloudflare reported that user-action AI bots (form fills, posts, profile edits) grew over 15x through 2025, the Merchant Risk Council reported 83% of merchants hit by first-party misuse or ATO or refund abuse last year, and cside's fingerprinting reads 250+ passive signals per session.
- Bottom line: If your control point is IP reputation and CAPTCHAs, you have already lost the sessions that matter. Instrument what runs inside the browser, or keep sending clean chargeback reports while agentic scrapers walk your checkout at their own pace.
Short on time? See cside's AI-agent detection. It covers everything below in one deployment.
The open-source AI agent OpenClaw is everywhere. It manages calendars, clears inboxes, and automates daily tasks. But attackers are also using it to scrape protected content, test stolen credit cards, and create fake accounts at scale.
To do this, they are pairing OpenClaw with specialized headless browser tools like Scrapling. These tools are designed specifically to bypass traditional anti-bot systems like Cloudflare and PerimeterX. They spoof TLS fingerprints, randomize canvas rendering, and rotate user agents to make automated scripts look exactly like human shoppers.
If your security stack relies on IP reputation or basic JavaScript challenges, these agents are already slipping through. Defending against this new wave of agentic fraud requires looking deeper into the browser.
The Mechanics of an Agentic Bypass
When an AI agent visits a website, traditional bot detection systems look for obvious signs of automation. They check if the IP address belongs to a known data center, if the user agent string matches a real browser, and if the session can solve a background CAPTCHA challenge.
Tools like Scrapling automate the evasion of these checks. When an OpenClaw user instructs their agent to scrape a protected site, the agent spins up a headless Chrome instance using a "StealthyFetcher" mode.
This mode automatically solves Cloudflare Turnstile challenges. It blocks WebRTC leaks that might expose the agent's real IP address. It even adds random noise to canvas rendering operations, so the browser's graphical fingerprint changes on every request. To the legacy bot detection system, the automated agent looks like a unique, legitimate human user on a standard device.
Why Legacy Anti-Fraud Suites Are Failing
The bot detection industry was built to stop mechanical scripts that execute tasks with perfect timing and uniform scroll speeds. AI agents do not behave like mechanical scripts.
According to Cloudflare, "user action" AI bots, agents that fill out forms, make posts, or edit profile information, increased by over 15x throughout 2025. These agents use reasoning to navigate complex workflows. They space out their requests, rotate through residential proxies, and mimic human interaction patterns.
When these agents are weaponized for fraud, the financial impact is severe. The Merchant Risk Council reports that 83% of merchants experienced first-party misuse, account takeover fraud, or refund abuse last year. Payment fraud now costs e-commerce merchants over $48 billion annually.
Detecting Stealth Agents with Browser Fingerprinting
You cannot stop an AI agent by asking it to click on pictures of traffic lights. You stop it by analyzing the environment it runs in.
cside Fingerprinting collects over 250 network, device, and behavioral signals passively during normal page loads. Instead of relying on a single point of failure like a TLS fingerprint or an IP address, cside builds a persistent visitor identity that holds across sessions, incognito modes, and VPNs.
When an OpenClaw agent attempts to hide behind a residential proxy or randomize its canvas output, cside detects the underlying anomalies. The platform identifies the telltale signs of virtual machines, headless browsers, and automated frameworks that indicate fraudulent activity.
This deep browser-layer visibility allows security teams to spot suspicious sessions before they reach the checkout page or the account creation form.
Six Browser Signals That Expose Stealth AI Agents
Stealth tooling can patch individual signals. Combining the six categories below makes evasion harder, but each needs testing against known human sessions and the automation configurations you expect.
1. Headless browser indicators. Compare navigator properties, plugins, languages, and reported platform details for inconsistencies. Privacy settings and unusual hardware can also explain missing values.
2. Virtual machine and emulator traces. GPU renderer strings, WebGL identifiers, and hardware concurrency can reveal virtualized environments. Legitimate users also use virtual machines, so this adds context rather than proving fraud.
3. Canvas and WebGL inconsistencies. Some evasion tools alter rendering output. Compare measurements across a session and with the claimed browser environment, accounting for privacy features that intentionally perturb fingerprints.
4. WebRTC and TLS irregularities. WebRTC availability varies with browser and privacy settings. Correlate it with TLS fingerprints where your server or edge exposes them; page JavaScript does not directly read the TLS handshake. Neither missing WebRTC candidates nor a TLS mismatch proves automation.
5. Behavioral timing and interaction patterns. Repeated navigation paths, scroll patterns, and limited editing can indicate automation. Model inference, autofill, and accessibility tools affect these patterns, so evaluate them together.
6. Residential proxy anomalies. Device continuity across rapid IP or location changes can expose suspicious activity. VPNs, mobile networks, and shared devices also change the relationship between IP and device, so corroborate the result.
No single signal is decisive. Combine browser observations, network context, and visitor continuity to make evasion harder without treating an unusual configuration as fraud. See headless browser detection and stealth browsers and anti-detect tools explained for technical background.
How to Respond When You Detect an Agent Bypass Attempt
Accurate detection only converts into a blocked attack if your response layer can act on the signal before the session reaches a sensitive flow. Three practical steps to close the gap:
Step 1: Add browser context to sensitive-flow decisions. Keep WAF rules and rate limits, and combine them with browser observations. Have your backend act on the risk verdict at account creation, login, and payment endpoints; a client-side check alone is not authorization.
Step 2: Use device continuity alongside session signals. Comparing fingerprints can help link repeat sessions despite IP or cookie changes. Treat a match as correlation, not confirmed identity; shared devices and configuration changes can affect it. Apply blocking or additional checks based on the combined risk.
Step 3: Separate intent classification from blanket blocking. Not every automated session is fraud. A consumer agent completing a purchase on behalf of a legitimate buyer is a sale, not an attack. Blocking all agents risks blocking real revenue. Use the browser-layer signals to classify intent (scraper versus buyer, card tester versus repeat customer) and route suspicious sessions to friction while letting trusted agents through.
Securing the Agentic Commerce Era
AI agents are fundamentally changing how users interact with the web. While some agents are malicious, others are legitimate consumer tools acting on behalf of real buyers.
The goal is to understand the intent behind the session, not to block all automated traffic. By monitoring browser-layer signals, you can detect AI agents accurately. You can block the scrapers and the card testers, while guiding trusted consumer agents safely through your checkout flow.
What happens in the browser is the difference between a blocked attack and a costly chargeback.
Book a demo to see how cside Fingerprinting can secure your login and payment pages from agentic fraud.
