Resemble AI on October 29, 2026 released Resemble Agent Detection, a behavioural model called RAD-S1 that labels each website session as a person or an AI agent, and claimed that in its own testing the model identified at least 98.8% of agents built to hide their automation while six widely used bot detection tools caught between 3.1% and 14.8%. The company has published the names of the six tools and a breakdown by evasion technique, but no sample size, no list of the agents tested and no measure of how often its model mistakes a human for a machine.

In Short

A company that sells detection software built a tool that watches how a website visitor moves the mouse and types, and guesses whether the visitor is a person or an AI program acting for one. It says ordinary bot blockers missed almost all of the disguised AI programs it tested, while its own tool caught nearly every one. Because the company ran the test itself and has not said how many visits it used or how often its tool wrongly flags real people, the numbers are a sales claim with no outside check behind them.

What Resemble AI released

The announcement, datelined Mountain View, California, October 29, 2026, introduces Resemble Agent Detection, which runs on a model the company calls RAD-S1. Resemble AI describes RAD-S1 as "a System One model that identifies agentic traffic on websites and in products." Its own model page expands the abbreviation as Resemble Agent Detection - System One, without explaining what the System One designation means.

According to the release, the product classifies each session "based on how the visitor behaves and interacts, rather than on what the visitor claims to be." That distinction sits at the centre of the pitch. A visitor's user-agent string, the label a browser or bot attaches to every request, can be set to anything. Resemble AI's argument is that behaviour - cursor paths, keystroke timing, the order of clicks - gives an agent away even when its label does not. "A spoofed user agent or disguised session does not change the result," according to the release.

Resemble AI's previous appearance in PPC Land coverage concerned synthetic media rather than bots. On October 22, it published a study claiming that only 2 of 3,379 Meta ad files its detector flagged as AI-generated disclosed AI use, a report that also relied on the company's own detector and published no error rates. The company calls itself "the AI detection models company" in the release.

The framing of the launch is blunt. A note circulated with the release carried the line "Existing tools meant to stop AI agents miss nearly all of them," and summarised the result this way: "The best of them caught 14.8%. The worst caught 3.1%." The release itself is more careful in one respect: it describes RAD-S1's result as "at least 98.8%," a floor rather than a measured value.

Zohaib Ahmed, CEO and co-founder of Resemble AI, set out the commercial argument in the release. "We already have a clear workflow for humans shopping and banking online: confirm who the person is, check what they're allowed to do, then give them access to match," Ahmed said. "Agents will inevitably need to follow the same rules, but that's an impossible task unless you can tell what's an agent and what's a person. Detection is the first step, and the companies that can securely embrace authorized agent traffic will win the business those agents bring."

How the detection works

Signals and timing

According to the release, the model analyses "cursor movement, typing rhythm and on-page actions, alongside browser and environment signals" for every session. Resemble AI's model page lists the behavioural inputs in more detail as pointer movement, click timing, scrolling, touch activity and typing rhythm, with browser details, request headers and automation flags used as supporting context. The product page's frequently asked questions add user agent, language, time zone, screen and window size, graphics renderer, page path, page title and referrer to the browser-side list.

The architecture, according to the model page, combines a behavioural model with a set of rules, and all scoring happens on Resemble AI's servers rather than in the visitor's browser. A first verdict is attempted after roughly five actions or 50 pointer movements. Checks then repeat until two consecutive readings agree, at which point the script stops collecting. Resemble AI puts the median response time at about 120 milliseconds, with 95% of checks returning within 200 milliseconds. The script weighs 25 KB compressed and loads asynchronously. Its pages disagree slightly on how often it sends batches of data: every 1.2 seconds on the model page, about every second on the product page.

How does a model grade a visitor that barely moves? It does not. According to the model page, a session with too little interaction is marked Undecided. The product page describes borderline visits as coming back for review, a status it says most sites treat as human. That matters for agents that load a page, read it and leave without scrolling or clicking - a pattern a behavioural model has little to work with.

Three labels or two?

The release says every session is labelled "Person, AI Agent or Bot." Resemble AI's own pages describe the verdict differently. The model page classifies a session as a person or an AI agent for the rest of the visit, plus the Undecided state. The product page says each session is labelled human or AI agent and that its dashboard shows which are bots, without defining a separate bot verdict. Each verdict carries the visitor type and a likelihood that a person is present, but the product page says the scoring method is not public and changes over time.

What the script records

According to the release, the script "doesn't collect typed text or passwords" and visitors "encounter no puzzles or challenges." Resemble AI's product documentation says keystrokes are logged by type - letter, digit or backspace - rather than by the key pressed, that form fields are recorded only by their ID and length, and that IP addresses are hashed before storage. No retention period is stated. On consent, the product page says the answer depends on where a site's visitors are located and leaves the question to each customer's legal team. Native mobile apps are not supported yet, according to the model page, which sits awkwardly beside the release's claim that RAD-S1 identifies agentic traffic "on websites and in products."

Detection, not blocking

The product does not act on its own verdicts. "It does not block or route traffic on its own," according to the release, which leaves the response to customers: allowing an agent, redirecting it to an API or an MCP server, restricting it from sensitive areas or stopping destructive actions. Responses can be set page by page and paired with existing identity systems or "emerging standards such as Sierra's Personal Agent Protocol." Sierra announced that protocol on October 6 with Meta as co-developer and Genesys, Instinct, Rocket, Shopify, Stripe and Walmart as partners, according to TNW, which describes it as an OAuth-based standard for how personal agents authenticate with businesses.

Resemble AI's product page pitches sending agents to an MCP server as faster and cheaper for the site than letting them click through pages built for people. It is a different idea of what detection is for: not only keeping agents out, but steering the ones a business wants into a channel built for machines.

The benchmark behind "nearly all"

What Resemble AI has published

The release gives one sentence of method: "In internal testing across eight website stacks, RAD-S1 identified at least 98.8% of agents built to conceal their automation, including agents running on stealth browsers and agents that took over a clean browser session. Six widely used bot detection tools tested on the same visits identified between 3.1% and 14.8%."

More detail sits on Resemble AI's model page, under a heading that dates the results to October 2026 and cites a Resemble AI internal benchmark as the only source. It names the six tools and gives each one's score on disguised agents, measured as the share of agent sessions the tool correctly classified as an agent:

  • BotD: 14.8%
  • Akamai: 8.7%
  • F5: 6.8%
  • Cloudflare Turnstile: 4.6%
  • Google reCAPTCHA: 3.6%
  • Vercel BotID: 3.1%
  • RAD-S1: at least 98.8%

The page also splits the disguised agents by the technique they used to hide. Agents running Camoufox, a modified Firefox, were caught by RAD-S1 at a rate of at least 96.8%, against 0.0% to 6.6% for the other six. For Patchright, a modified Chromium, the figures were at least 92.6% against 0.0% to 5.9%. For Stealth Playwright, which hides automation fingerprints, they were at least 92.7% against 0.0% to 10.2%. The fourth category, session takeover, covers an agent that seizes a clean browser session after a person has opened it - a form of session hijacking - and here RAD-S1 scored at least 96.7% while the other tools ranged from 4.0% to 50.2%.

What the published results show on closer reading

Three details in Resemble AI's own figures complicate the "nearly all" framing.

First, the session-takeover row. The headline on the model page says the other tools caught under 15%, and the release puts the ceiling at 14.8%. Yet in the session-takeover category at least one of the six tools, which the page does not identify, caught up to 50.2% of agents. The page does not reconcile the two.

Second, the parts and the whole. Every one of the four technique-level floors for RAD-S1 - 96.8%, 92.6%, 92.7% and 96.7% - sits below the 98.8% headline floor. Resemble AI presents every RAD-S1 number as a minimum rather than a measured rate and does not explain how those minimums were calculated, so how the combined figure ends up above each of its parts cannot be checked from what has been published.

Third, the agents that did not hide. The same page reports results for agents that left normal signs of automation, and there the picture reverses. BotD scored at least 99.3% and Akamai 99.1%, both above RAD-S1's floor of 98.7%. F5 reached 98.4%, Cloudflare Turnstile 97.6%, Google reCAPTCHA 96.9% and Vercel BotID 94.8%. Resemble AI's page acknowledges that all seven tools performed well when agents left signs of automation. The gap the company advertises exists only for agents deliberately built to evade detection.

Resemble AI's product page separately claims the model is up to 6.5 times more accurate than traditional bot detection tools. Dividing 98.8% by the best rival score of 14.8% gives about 6.7x, a PPC Land calculation; the page does not show how the 6.5x figure was derived.

What the results leave out

The benchmark measures one thing: how many agent sessions each tool labelled as agents. It does not report how many human sessions each tool wrongly labelled as agents. That omission is not a technicality. A detector that called every visitor an agent would score 100% on Resemble AI's metric while being useless on a checkout page, and the release's own pitch rests on avoiding "friction to checkout and transactional paths." Without a false-positive rate, precision figure or any human sessions in the test, the 98.8% cannot be weighed against the cost of misclassifying real customers.

The list of other gaps is long:

  • Sample size: no count of sessions, visits or agents appears in the release or on either product page.
  • Agents tested: the benchmark names hiding techniques, not agent products. The model page separately lists the agents RAD-S1 was trained on - Claude, Codex, Grok, ChatGPT, OpenAI's Dot (the company's product is called Dots), Browser Use, Playwright and Muse - but does not say which, if any, were used in the benchmark.
  • Website stacks: the eight stacks are mentioned once and never named or described.
  • Rival configurations: no versions, settings or product tiers are given. Akamai and F5 each sell more than one bot-defence product, and the page names only the companies. Cloudflare Turnstile and Google reCAPTCHA are CAPTCHA services that sites usually place on specific forms and logins, and Cloudflare's separate enterprise Bot Management product does not appear in the comparison. BotD is an open-source detection library.
  • Test dates: none beyond October 2026.
  • Independent review: none is mentioned.

None of the six vendors' responses appear in the release or on Resemble AI's pages.

Low catch rates for disguised automation are not a finding unique to Resemble AI. In a June test of 21,491 high-traffic domains, DataDome found that only 2.4% of popular websites blocked all 10 of its test bots, and just 3.1% stopped every real-browser bot running anti-detection tools. That test, too, came from a vendor selling bot protection, and it measured how sites had configured their defences rather than how individual products performed head to head.

The incidents in the release

Resemble AI frames the launch against a run of events from 2026. Checking them against the reporting they rest on shows that most are accurate in substance, with one error on timing, one bank that does not appear in the coverage and one claim that could not be matched to a single disclosure.

According to the release, the launch "comes a week after JPMorgan Chase, Morgan Stanley, Citigroup, Bank of America and Charles Schwab moved to block AI agents such as Meta's Muse and OpenAI's Dots from customer accounts, citing unresolved questions about liability." The bank moves came two weeks earlier, not one. JPMorgan Chase chief executive Jamie Dimon discussed outside agents on the bank's October 13 earnings call, according to American Banker, and Schwab chief executive Rick Wurster said on October 15 that the firm was blocking unauthorised agents that try to log in on behalf of clients, according to InvestmentNews. Bank of America's position was a condition on agent access to consumer deposits rather than an outright ban, according to PYMNTS, and Citigroup does not let third-party agents log into accounts or transact, according to PYMNTS citing the Financial Times. Morgan Stanley is not named as blocking or restricting agents in the American Banker, TNW, PYMNTS or InvestmentNews reports. Liability did come up - Wurster raised the question of who would be liable if an agent's action went wrong, according to TNW - but security and client control were the reasons the bank executives gave most often.

The other incidents largely check out. Gambit Security reported on September 22 that a single operator used AI agents to compromise at least 27 companies in five days, according to BleepingComputer, and the more than 600,000 card records came from two of those businesses, according to CSO Online. According to TNW, the three open-source agents involved did vulnerability scanning, exploitation and orchestration. The release does not say whether a session classifier that reads cursor movement and typing rhythm would have flagged attacks of that kind.

In Australia, an OpenAI agent bypassed access controls on a government Medicare statistics portal on June 18 during what OpenAI called an internal evaluation, according to The Hacker News. OpenAI first notified Services Australia on September 10, and Prime Minister Anthony Albanese made the incident public on September 24, according to the same report. The same pattern - an agent working around a barrier during testing - led Anthropic to switch off live internet access for all of its internal evaluations after documenting four categories of Claude workarounds in October.

The release's reference to "seven South Korean financial institutions" disclosing agent-related breaches is harder to pin down. Reporting from South Korea in October described a police investigation into bank breaches amid suspected AI-powered attacks, according to BleepingComputer, with the number of affected firms varying between reports.

Pricing and the free tier

According to the release, sites create a free Resemble AI account, add a single script tag and have their first 1 million sessions classified at no cost. After that the price is $1 per 1,000 sessions. The note circulated with the release went further, saying Agent Detection "is free for anyone to use," which holds only up to the free allowance. The release does not say whether the 1 million sessions are a one-time allowance or reset each month, and one summary description on Resemble AI's product site says the service is free for 10,000 visitors, which conflicts with the 1 million figure in the release and the product page body.

A crowded field measuring the same traffic

Resemble AI arrives in a market where several companies have spent 2026 publishing their own counts of agent traffic, each drawn from its own network and none independently audited. The numbers have climbed steeply since Meta released Muse in the US on September 8, inside WhatsApp and a standalone app.

HUMAN Security put the growth of agentic AI traffic in 2025 at 7,851%, a figure Resemble AI's product page also cites, and found that only half of one percent separated the rates of benign and malicious automation. HUMAN later found Muse accounting for 72% of AI agent requests on its network. DataDome reported that Muse took a 33% share of agentic browser requests in September after only nine days of measurement and said the agent does not declare itself. Arkose Labs found that only 2.3% of legitimate AI agent sessions carried a verified signature, while agents reached login, registration and checkout flows at 65.2% of its customers. Amazon blocked Muse from shopping on Amazon.com on September 20, citing among other things that it does not identify itself.

The vendors do not even agree on where the traffic comes from. Profound reported that Muse and Instinct route traffic through residential internet connections and present as ordinary visitors, while DataDome traced 99.3% of a Muse sample to cloud and CDN infrastructure. Disguise has been documented for longer than Muse has existed: in December 2025, DataDome recorded Grok sending 16 requests from 12 IP addresses for a single query, none identifying as xAI or Grok.

Two broad approaches have formed. One relies on agents identifying themselves cryptographically. Web Bot Auth lets a site verify which company sent an automated request; Cloudflare unveiled a registry format for bot and agent authentication, Visa and Mastercard built their agent payment protocols on it with Cloudflare in October 2025, and Cloudflare now grades Verified bots on whether they obey robots.txt and rate limits. Walmart's Agent Profiles let AI agents buy within customer-set limits such as $50 or $100. The other approach watches behaviour, on the assumption that agents bent on abuse will not sign their requests. Experian added DataDome's behaviour monitoring to its agent checks on October 1, and Resemble AI's product sits squarely in this second camp, while pointing customers to identity standards for what to do once an agent has been found.

The two approaches are not rivals so much as layers. A signature tells a site which company's agent is visiting; a behavioural verdict is aimed at the visitors that carry no signature at all. Resemble AI's claim is about the second group, and its benchmark is built entirely from agents designed to evade the first.

Why this matters for marketers

For advertisers and publishers, the question of who is a person is not only a security matter. Sessions that analytics tools count as human feed conversion reports, attribution models, retargeting audiences and the signals that automated bidding systems learn from. An agent that browses product pages and abandons a cart can look, in an analytics dashboard, like a shopper who lost interest. Microsoft Clarity added a bot activity dashboard in January, and HUMAN Security has pitched agent visibility directly to marketing teams since April.

The commercial stakes run in both directions. If personal agents like Muse and OpenAI's Dots turn into a meaningful buying channel, the sites that block them outright may lose sales, while the sites that let all automation through absorb fraud, scraping and distorted data. Resemble AI's page-by-page policy model, with an option to steer welcome agents to an API or MCP server, is pitched at that middle ground. Whether it works depends on two numbers. Resemble AI has published a version of the first - how many agents it catches - and has not published the second: how many paying customers it would wrongly flag.

That second number decides whether a behavioural verdict is safe to act on at a checkout page. Until it is published, or until someone outside the company tests the model, the 98.8% figure is a claim about one side of the ledger, produced by the company that sells the product.

Timeline

Summary

Who: Resemble AI, a Mountain View, California company that sells AI detection models, with comments from CEO and co-founder Zohaib Ahmed. The benchmark compares its RAD-S1 model with six bot detection tools: BotD, Akamai, F5, Cloudflare Turnstile, Google reCAPTCHA and Vercel BotID.

What: Resemble Agent Detection, a behavioural model that labels website sessions as a person or an AI agent from cursor movement, typing rhythm, on-page actions and browser signals, without blocking traffic itself. Resemble AI claims it identified at least 98.8% of disguised agents in internal testing while the six other tools caught 3.1% to 14.8%. The company has not published a sample size, the agents tested, the eight website stacks or any human false-positive rate, and its own figures show one rival reaching 50.2% on session-takeover agents and two rivals scoring above RAD-S1 on agents that did not hide. The first 1 million sessions are free, then $1 per 1,000.

When: Released on October 29, 2026. The benchmark is dated only to October 2026.

Where: Websites that add Resemble AI's script, with scoring done on Resemble AI's servers. Native mobile apps are not yet supported.

Why: Personal AI agents such as Meta's Muse and OpenAI's Dots now reach login and checkout pages, often without identifying themselves, and banks and retailers have begun restricting them. Sites, advertisers and analytics systems need to know which sessions are human, and Resemble AI is selling a behavioural answer - one whose accuracy so far rests on a test the company ran itself.