The AI-agent detection market crossed a line this week that sounds small and is not: a vendor is now offering to classify website visitors not by what their browser says they are, but by how they move. Resemble AI launched RAD-S1 on 29 October, described as the first “System One” model for agent detection — the name borrowed from human fast cognition, because the model is meant to judge behaviour the way people do, instantly and from posture rather than paperwork. A 25-kilobyte script watches pointer movement, clicks, scrolling, touch activity and typing rhythm, batches the signals every 1.2 seconds, and after roughly five actions or fifty pointer movements returns a verdict: person, bot, or AI agent. The company’s own announcement is candid about who this is for — the banks that spent the past two weeks locking AI agents out of customer accounts, and every enterprise now fielding agent traffic it cannot see.
The benchmark numbers, and the asterisk they deserve
The company’s claim is specific: in internal testing across eight website stacks and six agent-hiding techniques, RAD-S1 identified 98.8% of agents that disguised their automation, while the six comparison tools — Cloudflare Turnstile, F5, Google reCAPTCHA, Akamai, Vercel BotID and Fingerprint’s BotD — caught between 0% and 14.8% of the same sessions. Against Camoufox-modified Firefox and Patchright-modified Chromium, the incumbents scored zero in some configurations. Those are the numbers that will sell the product, and they deserve their asterisk: the benchmarks are Resemble’s own, published without third-party replication, tested against competitors by the company selling against them. Independent verification does not exist yet, and detection-accuracy claims from detection vendors have a well-earned reputation for melting under adversarial reproduction — every tool in this market, including the incumbents being outscored, has been the confident new challenger at some point in the past eighteen months.
But the structural claim underneath survives the scepticism. Traditional bot detection reads fingerprints: user agents, IP ranges, headless-browser flags, known automation signatures. The agents that matter now run inside real browsers — Muse in a customer’s signed-in shopping session, Claude’s agents in Chrome, OpenAI’s Dots booking flights — and the newest ones use stealth forks that strip those fingerprints entirely. A fingerprint-reader has nothing to read. A behaviour-reader does, at least in principle: agents drive cursors differently, scroll in straight lines, pause at intervals that look like network round-trips rather than hesitation. Whether Resemble’s model exploits that well enough to actually match its 98.8% is the open question; that the industry needs the attempt is not really disputed by anyone shipping a checkout flow.
The market problem RAD-S1 is arriving to serve
The product launch is a business story attached to a structural one. In late October, JPMorgan Chase, Morgan Stanley, Citigroup, Bank of America and Charles Schwab moved to block agent traffic from customer accounts, citing unresolved liability when third-party software acts inside a signed-in session; Charles Schwab’s chief executive said the question that kept stopping outside agents from moving client money was “who’s liable”. Amazon blocked Meta’s Muse in September, saying the agent did not identify itself as AI while browsing; Yelp and Delta followed. The blocks solved the immediate exposure but created a new operational blindness: sites now routinely refuse agent traffic they cannot distinguish from human customers, and the cost of that refusal lands on real users who get caught in the same net. Sierra’s Personal Agent Protocol — the Meta, Shopify and Stripe-backed draft standard — proposes solving it with identity: agents that declare themselves and negotiate permissions. RAD-S1 proposes the complementary half: behavioural verification, so that a declaration can be checked against conduct rather than trusted.
This site’s coverage of the agent-credential crisis over the middle of the year traced the same pattern on the security side: real credentials reachable by agents, governance tooling that could detect a breach but not prevent it. The detection stack now being assembled is the mirrored problem — a web where agents are functionally indistinguishable from the people they act for, and the answer is to watch how everything moves.
The privacy question arrives in the same package
Behavioural agent detection and behavioural surveillance are one technology deployed in two moods. The same 25 KB script that classifies a session as agent or person collects typing rhythm, pointer paths and touch activity from every visitor — and the company states it collects no typed text or passwords, which describes the boundary precisely enough to note how close to it the system sits. Most human users will never know they were scored. The privacy implications of persistent behavioural fingerprinting have been argued mostly around emotion-recognition and keystroke research; applying that family of techniques to everyone on a commerce site because some fraction of visitors might be an AI agent is a trade worth naming, and Resemble’s answer — that verdicts are reviewable and the script loads asynchronously — addresses transparency, not consent. There is a New Zealand dimension here: NZ businesses adopting agent-detection will inherit these questions silently, and the Office of the Privacy Commissioner has no published guidance specific to behavioural visitor classification. As agent traffic grows, that gap gets harder to leave open.
❓ FAQ
Is the 98.8% figure verified? No. It comes from Resemble AI’s internal testing, published 29 October 2026, against six named competitors. No independent replication is available yet. The comparison numbers for competing tools are also self-published.
Who is this product actually for? Enterprises with transactional traffic — the banks blocking agents, retailers negotiating agent access, anyone who needs to distinguish a signed-in human from an agent acting in that human’s session.
Does RAD-S1 block agents? No. Per the company’s documentation, it classifies and routes; customers define the policy per page. That positioning matters: the vendor is selling measurement, not enforcement.
How does this relate to bot detection incumbents? The company claims incumbent tools catch disguised agents at 0–15% versus its reported 98.8%+. The incumbents’ tools were built to read fingerprints, not behaviour — whether they can close the gap with their own behavioural models is the next twelve months of this market.
🔍 THE BOTTOM LINE
The interesting thing about RAD-S1 is not whether its benchmark survives reproduction — it probably will not, in full. It is that the web’s answer to “is this a person” is now a behaviour-reading model scoring everyone, in a market large enough that a detection vendor can go first and the enterprise security press will cover the launch. Trust and identity on the web used to be credentials and consent; now they are rapidly becoming inference. That shift, running underneath the agent-lockout headlines, is the actual story this month — and nobody has paused it to ask the visitors who will be quietly scored how they feel about it.
📰 Sources
- Resemble AI — Introducing RAD-S1: a System One model for detecting AI agents that look human (29 October 2026)
- Resemble AI — RAD-S1 model page with benchmark tables and pricing-free architecture notes
- The National Law Review — Resemble AI Launches Agent Detection to Expose AI Agents That Appear Human (29 October 2026)
- The Verge — Amazon, Yelp, Delta and US banks join the move to block AI agents (17 October 2026)
- Sierra — Personal Agent Protocol (Poppy) draft spec and design partners
- Singularity.Kiwi prior coverage: ai-agent-credential-crisis-six-months-2026, amazon-blocks-meta-muse-shopping-agent-2026, amazon-grokbot-agent-shopping-block-x-money-2026
