这项研究揭示了LLM代理的一个重大安全风险——网站可以被动识别你的AI模型，做AI安全和隐私保护的团队值得关注，建议开发者检查自己的代理是否容易通过UI痕迹被指纹识别。
研究人员发现，基于LLM的浏览器代理在网页上执行任务时，其操作序列和交互时间可以被被动JavaScript追踪器捕获，从而以高达96%的F1分数识别出底层模型。该研究覆盖了14个前沿LLM和四个网页环境，包括信息检索和购物任务。攻击者可以利用此漏洞针对已知模型漏洞发起定向攻击。虽然注入随机时间延迟可以降低分类器性能，但重新训练后仍能恢复大部分识别能力。研究团队已发布相关工具和标注数据集。
Known By Their Actions: Fingerprinting LLM Browser Agents via UI Traces
As LLM-based agents increasingly browse the web on users' behalf, a natural question arises: can websites passively identify which underlying model powers an agent? Doing so would represent a significant security risk, enabling targeted attacks tailored to known model vulnerabilities. Across 14 frontier LLMs and four web environments spanning information retrieval and shopping tasks, we show that an agent's actions and interaction timings, captured via a passive JavaScript tracker, are sufficient to identify the underlying model with up to 96\% F1. We formalise this attack surface by demonstrating that classifiers trained on agent actions generalise across model sizes and families. We further show that strong classifiers can be trained from few interaction traces and that agent identity can be inferred early within an episode. Injecting randomised timing delays between actions substantially degrades classifier performance, but does not provide robust protection: a classifier retrained on delayed traces largely recovers performance. We release our harness and a labelled corpus of agent traces \href{https://github.com/KabakaWilliam/known_actions}{here}.