为什么 AI Agent 需要持久化浏览器身份
英文标题：🔶 Why AI Agents Need Persistent Browser Identities
Browser3 认为，AI Agent 的浏览器身份不能仅依赖随机化指纹，而应在多次启动、重载和并行工作流中保持内部一致、可复现且相互隔离。该项目通过为每个 Profile 保存确定性生成的身份配置及独立 Chromium 用户数据目录，试图让同一 Agent 在长期使用中维持稳定浏览器边界。其公开的五 Profile 测试显示，部分生命周期稳定性指标达到 15/15 或 5/5，但外部检测服务结果存在混合、失败和不可用情况。项目明确表示不保证绕过反机器人系统或实现“不可检测”，并邀请开发者在受授权环境中复现和报告矛盾结果。
50.3 KB
中文
为什么 AI Agent 需要持久化浏览器身份
随机化浏览器指纹很容易，但让它们保持一致很难。
AI Agent 很少只执行一项浏览器任务。它们会进行身份验证、暂停运行、在进程重启后返回，有时还会并行运行多个彼此无关的工作流。Cookie 和本地存储很重要，但它们只是网站能够观测到的浏览器身份的一部分。
浏览器还会暴露一系列关联信号，例如 User-Agent、User-Agent Client Hints、平台、屏幕特征、硬件分档、区域设置、时区、图形数据以及网络上下文。独立修改其中某一项，可能会制造矛盾。每次启动时再次修改这些值，则可能使同一个 Agent 在刷新后看起来像是不同的浏览器。
因此，真正有价值的工程问题不只是：
浏览器能否报告一个不同的指纹？
而是：
一个已保存的浏览器身份能否在长期使用中保持一致且可复现？
这些概念很容易被混为一谈：
- 掩码（Masking）：修改选定的浏览器可见值。
- 一致性（Consistency）：让相关值彼此协调一致。
- 持久化（Persistence）：让同一 Profile 身份和用户状态在后续启动中得以保留。
- 隔离（Isolation）：防止一个 Profile 继承另一个 Profile 的状态。
没有一致性的掩码，可能产生一组看似合理、实则彼此矛盾的值。没有持久化的一致性，仍然只会给 Agent 一个一次性会话。没有隔离的持久化，则有混合无关工作流的风险。
Browser3 是面向用户和 AI Agent 的多 Profile 反检测 Chromium 浏览器。它的核心差异化能力是持久化、内部一致的浏览器身份。Chromium 原生层面的指纹掩码是其实现切入点；而一致性与持久化，才使每个已保存身份能够长期接受测试。
一个 Agent，对应一个已保存的 Profile
每个 Browser3 Profile 都将生成的身份配置与其专属 Chromium 用户数据目录结合在一起。该配置具有持久化的 profile_id。Profile 特定选项从该种子确定性推导得出，而不是在每个会话中重新随机生成。用户数据目录则保存 Cookie 和 Web 存储等常规状态。
再次选择同一个 Profile 时，会同时复用两者：
不同 Profile 使用独立的用户数据目录和 Profile 锁。预期映射很简单：
一个 Agent -> 一个持久化 Browser3 Profile
这种映射不会赋予 Agent 新权限、解决身份验证问题，或保证网站将如何响应。它创建的是一个可复现、可调试的稳定浏览器边界。
掩码位于 Chromium 内部
Python 层负责探测主机、生成确定性配置、管理 Profile 并启动浏览器。它不会向页面注入指纹 JavaScript。浏览器可见的掩码由打包的原生 Chromium 层实现。
公开源码边界是有意设计的：该仓库公开 MPL-2.0 编排层、Profile 生成策略、文档和发布验证路径；但不公开私有原生掩码实现，也不公开足以重建所分发可执行文件的源码。
这一区别很重要，因为页面层的 JavaScript Hook 可以改变某一项读数，却无法让相关浏览器表面保持一致。Browser3 将已验证的 Profile 数据传递给原生浏览器代码，并在没有可安全覆盖项时保留原生行为。
常规启动采用有界面模式（headful）且不使用 CDP。自动化通过仅限回环地址的 CDP 控制路径或本地 Session API 选择性启用。在一次针对五个 Profile 的 Release 测量中，活跃的 Playwright 或 Puppeteer 客户端在 5/5 个 Profile 中都会被检测工具识别为 Developer Tools。这项限制已被记录，而非被当作指纹掩码成果。
版本细节也是一致性的一部分
所分发的 Browser3 运行时基于 Chromium 149.0.7827.201。这并不意味着每个浏览器表面都会报告相同的四段版本字符串。
精简后的 User-Agent 当前遵循 Chromium 的精简格式，并报告 149.0.0.0。高熵 UA-CH 和生成的 Profile 完整版本值，则使用从 149.0.7827.196 到 149.0.7827.201 的确定性已验证补丁。因此，Browser3 并不声称每个表面都精确报告 .201。
与硬件绑定的能力、限制、色深和 ANGLE 后端保持原生状态。GPU 身份覆盖仅接受一个经过验证的 WebGL/WebGPU 数据块；无效数据会回退至主机行为。Canvas 和音频噪声默认保持关闭，因为早期测试能够检测到它们。目前测得的、干净且由种子生成的差异化轴为文本边缘处理和字体隐藏。
五 Profile 验证发现了什么
公开的生命周期报告，是针对一个物理 Windows 主机及一个网络上下文中 Browser3/Chromium 149.0.7827.201 的带日期观察结果。测试使用五个持久化 Profile，在无代理的有界面、无 CDP 运行中完成。它并未挑选某个表现最佳的 Profile。
| 生命周期检查 | 记录结果 |
|---|---|
| 选定信号在重载后保持稳定 | 15/15 |
| 关闭并重新打开 | 5/5 |
| 新浏览器进程重启 | 5/5 |
| 每个生命周期阶段中均存在不同的私有 Profile 签名 | 5/5 |
15/15 的重载总数代表五个 Profile 横跨三个进程周期的结果。原始标识符和原始 Profile 签名并未公开。
随后，不可变 r3 Release 于 2026-08-20 通过了其自身的有界面、无 CDP、无代理门槛测试。所有五个 Profile 都返回了分数和重载测量结果。记录的五 Profile 平均值分别为：Fingerprint.com 篡改模型 0.0412、其虚拟机模型 0.0654，以及可选 VPN 模型 0.1250。这些数字是这些模型在该 Release 和主机上的观察结果，并非目标值或绕过保证。
日期为 2026-08-15 的更深入公开交叉检查，也保留了不利结果：
| 服务 | 记录的观察结果 | 它不能证明什么 |
|---|---|---|
| Fingerprint.com Playground | 三个五 Profile 生命周期阶段中的篡改模型平均值为 0.0283-0.0335；VM 模型平均值为 0.0580-0.0600 |
并非普遍 PASS；visitorId 不是掩码成功的证明 |
| Pixelscan | Navigator、webdriver 和 CDP 检查在 15/15 中通过；User-Agent 检查在 0/15 中通过 |
结果混合，并非整体通过 |
| OverpoweredJS | 自动化采集在 15/15 中报错 |
无法得出结论 |
| CreepJS | 在 15/15 中出现红色警告 |
并非整体通过 |
| BrowserLeaks | 在 5/5 中采集到 Features Detection；审查的视口显示 322/322 项特性 |
表面可用性，而非绕过结论 |
这些服务衡量的是不同事物，并且可能独立于 Browser3 发生变化。访客标识符、篡改信号、机器人判定和生命周期比较不是可以互换的指标。完整方法和限制见公开验证报告。
一种可复现的质疑方式
使用官方 Windows x64 r3 Release，并验证分离式 OpenPGP 签名和 SHA-256 清单。Browser3 自有 PE 文件未使用 Authenticode 签名。请保持完整的 runtime\ 目录不变，并使用物理硬件加速 GPU。
若要进行符合门槛要求的直连网络运行，请在不使用代理的情况下启动全部五个 Profile：
.\browser3 --profile 1 --no-proxy
.\browser3 --profile 2 --no-proxy
.\browser3 --profile 3 --no-proxy
.\browser3 --profile 4 --no-proxy
.\browser3 --profile 5 --no-proxy
对于每个 Profile：
- 在每次观察之间使用新文档加载同一测试。
- 仅比较选定的稳定信号。
- 关闭并重新打开同一个 Profile。
- 启动新的浏览器进程并重复。
- 将结果与另外四个 Profile 进行比较。
- 记录 Release、日期、主机上下文、代理模式，以及 CDP 是否处于活跃状态。
请勿公开 Cookie、IP 或地理位置数据、代理凭据、访客/请求 ID、个人数据或原始 Profile 签名。内部测试工具和原始基线数据保持私有；公开报告提供经过脱敏的聚合结果，以及足以质疑结论的协议细节，同时不会暴露敏感测试数据。
这并非一项通用的检测器规避声明。
- 所引用证据仅覆盖一个物理 Windows 主机和一个网络上下文。
- Release 门槛测试在无代理环境下进行；代理和多地理位置行为不属于该次已测试的 GO 范围。
- Profile 是为当前机器生成的，不应迁移到不同硬件上。
- 当前运行时要求 Windows x64 和物理硬件加速 GPU。
- 不包含 Widevine；Windows N/KN 可能需要安装 Media Feature Pack。
- 公开源码层无法重建专有原生可执行文件。
- 外部检测器模型会随时间变化，记录结果中也包括混合结果和不可用结果。
Browser3 不声称自己“不可检测”，也不保证能够绕过反机器人系统或获得特定检测器分数。
先试用，再报告矛盾结果
下载不可变的 Browser3 v149.0.7827.201-r3 Release，并按照仓库中的快速开始操作。Python 3.10+ 客户端也已发布为 browser3==0.1.0；可选的 npm 包 @radek-b3/browser3@0.1.0 是该 Python 客户端的轻量包装，而不是独立运行时。
最有价值的实验很简单：
- 在完整浏览器重启后重新打开同一个 Profile；
- 将其选定信号与另一个 Profile 进行比较；
- 将自动化生命周期与干净的无 CDP 运行分开测试；
- 报告可复现的不一致、限制或检测器变化。
请仅在你拥有或获授权测试的系统和账户上使用 Browser3。请通过 GitHub Issues 或 GitHub Discussions 提交经过脱敏、可复现的反馈。
我维护 Browser3。本文是在请求技术批评与复现，而不是一篇独立评测，也不是对规避检测器的承诺。
English / 原文
Why AI Agents Need Persistent Browser Identities
Randomizing browser fingerprints is easy. Keeping them consistent is hard.
AI agents rarely perform only one browser task. They authenticate, pause, return after a process restart, and sometimes run several unrelated workflows in parallel. Cookies and local storage matter, but they are only part of the browser identity that a site observes.
A browser also exposes related signals such as User-Agent, User-Agent Client Hints, platform, screen characteristics, hardware buckets, locale, time zone, graphics data, and network context. Changing one value independently can create contradictions. Changing values again on every launch can make the same agent look like a different browser after a reload.
The useful engineering question is therefore not just:
Can a browser report a different fingerprint?
It is:
Can one saved browser identity remain coherent and reproducible across time?
These ideas are easy to conflate:
- Masking changes selected browser-visible values.
- Consistency keeps related values coherent with one another.
- Persistence keeps the same profile identity and user state across later launches.
- Isolation prevents one profile from inheriting another profile's state.
Masking without consistency can produce a plausible-looking collection of contradictory values. Consistency without persistence still gives an agent a disposable session. Persistence without isolation risks mixing unrelated workflows.
Browser3 is a multi-profile antidetect Chromium browser for people and AI agents. Its primary differentiator is persistent, internally consistent browser identities. Native Chromium-level fingerprint masking is the implementation hook; consistency and persistence are what make each saved identity testable over time.
One agent, one saved profile
Each Browser3 profile combines a generated identity configuration with its own Chromium user-data directory. The configuration has a persistent profile_id. Profile-specific choices derive deterministically from that seed instead of fresh per-session randomness. The user-data directory stores normal state such as cookies and web storage.
Selecting the same profile again reuses both:
Different profiles use separate user-data directories and profile locks. The intended mapping is simple:
one agent -> one persistent Browser3 profile
That mapping does not give an agent new permissions, solve authentication, or guarantee how a website will react. It creates a stable browser boundary that can be reproduced and debugged.
Masking lives inside Chromium
The Python layer probes the host, generates deterministic configuration, manages profiles, and launches the browser. It does not inject fingerprint JavaScript into pages. Browser-visible masking is implemented in the packaged native Chromium layer.
The public source boundary is deliberate: the repository exposes the MPL-2.0 orchestration, profile-generation policy, documentation, and release verification path. It does not expose the private native masking implementation or enough source to rebuild the distributed executable.
This distinction matters because a page-level JavaScript hook can change one readout without making related browser surfaces agree. Browser3 passes validated profile data to native browser code and preserves native behavior when a safe override is not available.
Normal launches are headful and CDP-free. Automation is opt-in through a loopback-only CDP control path or the local Session API. In a five-profile Release measurement, an active Playwright or Puppeteer client was visible to detector tooling as Developer Tools in 5/5 profiles. That limitation is documented rather than treated as a fingerprint-masking result.
Version details are part of consistency
The distributed Browser3 runtime is based on Chromium 149.0.7827.201. That does not mean every browser surface reports the same four-part string.
The reduced User-Agent currently follows Chromium's reduced format and reports 149.0.0.0. High-entropy UA-CH and generated profile full-version values use deterministic verified patches from 149.0.7827.196 through 149.0.7827.201. Browser3 therefore does not claim exact .201 on every surface.
Hardware-bound capabilities, limits, color depth, and the ANGLE backend remain native. A GPU identity override is accepted only as one validated WebGL/WebGPU block; invalid data falls back to host behavior. Canvas and audio noise remain off by default because earlier testing detected them. The currently measured clean seeded diversity axes are text edging and font hiding.
What the five-profile validation found
The public lifecycle report is a dated observation for Browser3/Chromium 149.0.7827.201 on one physical Windows host and one network context. It used five persistent profiles in a headful, CDP-free run without a proxy. It did not select one favorable profile.
| Lifecycle check | Recorded result |
|---|---|
| Selected signals stable across reloads | 15/15 |
| Close and reopen | 5/5 |
| New browser-process restart | 5/5 |
| Distinct private profile signatures in each lifecycle phase | 5/5 |
The 15/15 reload total represents five profiles across three process cycles. Raw identifiers and raw profile signatures are not published.
The immutable r3 release then passed its own headful, CDP-free, no-proxy gate on 2026-08-20. All five profiles returned scores and reload measurements. The recorded five-profile averages were 0.0412 for the Fingerprint.com tampering model, 0.0654 for its virtual-machine model, and 0.1250 for the optional VPN model. These numbers are observations of those models on that release and host, not targets or bypass guarantees.
The deeper public cross-check dated 2026-08-15 also kept adverse results visible:
| Service | Recorded observation | What it does not prove |
|---|---|---|
| Fingerprint.com Playground | Tampering-model averages 0.0283-0.0335; VM-model averages 0.0580-0.0600 across three five-profile lifecycle phases |
No universal PASS; a visitorId is not proof of masking |
| Pixelscan | Navigator, webdriver, and CDP checks clear on 15/15; User-Agent check clear on 0/15 |
Mixed result, not an overall pass |
| OverpoweredJS | Automated collection errored on 15/15 |
No conclusion |
| CreepJS | A red warning appeared on 15/15 |
No overall pass |
| BrowserLeaks | Features Detection captured for 5/5; the reviewed viewport showed 322/322 features |
Surface availability, not a bypass verdict |
These services measure different things and can change independently of Browser3. A visitor identifier, a tampering signal, a bot verdict, and a lifecycle comparison are not interchangeable metrics. The complete method and limitations are in the public validation report.
A reproducible way to challenge the claim
Use the official Windows x64 r3 release and verify the detached OpenPGP signature and SHA-256 manifest. Browser3-owned PE files are not Authenticode-signed. Keep the complete runtime\ directory intact and use a physical hardware-accelerated GPU.
For a gate-compatible direct-network run, launch all five profiles without a proxy:
.\browser3 --profile 1 --no-proxy
.\browser3 --profile 2 --no-proxy
.\browser3 --profile 3 --no-proxy
.\browser3 --profile 4 --no-proxy
.\browser3 --profile 5 --no-proxy
For each profile:
- Load the same test with a fresh document between observations.
- Compare only selected stable signals.
- Close and reopen the same profile.
- Start a new browser process and repeat.
- Compare the result with the other four profiles.
- Record the release, date, host context, proxy mode, and whether CDP was active.
Do not publish cookies, IP or geolocation data, proxy credentials, visitor/request IDs, personal data, or raw profile signatures. The internal harness and raw baselines remain private; the public report exposes sanitized aggregates and enough protocol detail to challenge the conclusion without exposing sensitive test data.
This is not a universal detector-evasion claim.
- The cited evidence covers one physical Windows host and one network context.
- The release gate ran without a proxy; proxy and multi-geo behavior were not part of that tested GO.
- Profiles are generated for the current machine and should not be moved to different hardware.
- The current runtime requires Windows x64 and a physical hardware-accelerated GPU.
- Widevine is not included; Windows N/KN may require the Media Feature Pack.
- The public source layer cannot rebuild the proprietary native executable.
- External detector models change over time, and the recorded results include mixed and unavailable outcomes.
Browser3 does not claim to be "undetectable" and does not guarantee an anti-bot bypass or a particular detector score.
Try it, then report a contradiction
Download the immutable Browser3 v149.0.7827.201-r3 release and follow the repository Quick Start. A Python 3.10+ client is also published as browser3==0.1.0; the optional npm package @radek-b3/browser3@0.1.0 is a thin wrapper around that Python client, not a separate runtime.
The most useful experiments are simple:
- reopen the same profile after a full browser restart;
- compare its selected signals with another profile;
- test an automation lifecycle separately from a clean CDP-free run;
- report a reproducible inconsistency, limitation, or detector change.
Use Browser3 only on systems and accounts you own or are authorized to test. Please file sanitized, reproducible feedback through GitHub Issues or GitHub Discussions.
I maintain Browser3. This article is a request for technical criticism and reproduction, not an independent review or a promise of detector evasion.