AgentShield: Fortifying Web Applications Against AI Agents and Agentic Browsers

Abstract

LLM-powered browser agents are rapidly transforming web automation, enabling autonomous agents to interact with websites’ graphical interfaces and perform complex workflows. However, it is currently unclear how effective existing anti-bot defenses are against these systems and what behavioral characteristics may distinguish them from human users. In this paper, we present the first systematic empirical evaluation of modern agentic browsers against widely deployed anti-bot mechanisms, (e.g., Google’s reCAPTCHA, Cloudflare’s Turnstile). We experimentally characterize the capabilities and limitations of state-of-the-art agentic clients and show that many existing defenses, originally designed to detect traditional automation frameworks, struggle to reliably identify autonomous AI-driven agents. Motivated by these findings, we introduce AgentShield, a behavioral fingerprinting framework that targets the Perception–Reasoning–Action (PRA) loop underlying agentic user clients. By leveraging dynamic web forms that progressively reveal content and capture fine-grained interaction telemetry, AgentShield exposes behavioral artifacts that enable differentiation between human users and autonomous agents. We further demonstrate Extinction-induced Policy Drift (EPD), a novel attack in which repeated obstruction of task completion causes agents to relax their safeguards and engage in unsafe behaviors. Finally, we present defensive prompt injection techniques that exploit agent-specific weaknesses to mitigate emerging forms of autonomous web abuse that rely on content extraction. Our results highlight both the shortcomings of current web defenses against agentic user clients and the feasibility of practical detection mechanisms tailored to this new generation of web automation.