Obility Editorial · · 4 min read
An agent runs a buyer’s errand through a browser
Most talk about AI and websites concerns crawlers that collect pages for an index, or fetchers that read one page to answer one question. Agents are a third kind of visitor. A person asks an assistant to compare three vendors’ pricing or find which tools integrate with their CRM, and the assistant opens a browser, loads pages, clicks through menus and reads what it finds before reporting back.
OpenAI’s help centre describes this for the cloud browser ChatGPT uses to carry out tasks. It also states that, at launch, that browser cannot sign in to websites or complete payments. For now, then, an agent visit to a B2B site is mostly research: the shortlist work a buyer would once have done in their own tabs.
Analytics sees a browser, so it counts a visitor
Because an agent drives a real browser, it loads your scripts the way a person does, and your analytics tag can fire. Google’s documentation for Google Analytics says known bots are excluded automatically, identified through Google’s own research and the International Spiders and Bots List kept by the Interactive Advertising Bureau. It also says you cannot switch that exclusion off or see how much traffic it removed. The filter is a list of known bots, and an agent presenting an ordinary browser is not obviously on it.
Seer Interactive tested this with OpenAI’s Operator, the predecessor of ChatGPT’s agent, and published the results. Operator identified itself as Chrome on Linux. When told to visit Seer’s site directly, it arrived as direct traffic. When told to find the company, it searched Bing and arrived as Bing organic, like a person would. Seer reports that none of the checks it ran on browser, version, operating system or user agent reliably separated those sessions from human ones. The test is from 2025 and the product has since changed, but the mechanism has not: a browser-driving agent inherits whatever a browser would record.
A user agent is a claim, and a signature is proof
Most advice on spotting AI traffic says to search your logs for names such as ChatGPT-User or GPTBot. That finds crawlers and fetchers that announce themselves, and anyone can type those names into a request. It finds nothing when the visitor reports itself as Chrome.
Signed requests close that gap. OpenAI’s help centre says ChatGPT’s cloud browser signs its outbound requests using HTTP Message Signatures, the IETF standard published as RFC 9421. Each request carries Signature and Signature-Input headers plus a Signature-Agent header set to chatgpt.com, and OpenAI publishes the matching public keys in a directory on chatgpt.com. A server that checks the signature against those keys knows the request came from OpenAI, which no user agent string can tell it.
The same article says Akamai, Cloudflare, HUMAN and Vercel already recognise these requests and verify the signature for you, which is how most teams will get this without writing code. The wider approach, known as Web Bot Auth, has its own IETF working group, and its architecture draft, written by authors from Cloudflare and Google, is still a work in progress. Treat it as an emerging convention, not a settled one.
Count agent visits as tasks, kept apart from people
Once you can identify verified agent requests, keep them out of the human numbers and look at them separately. The useful questions are which pages agents open, in what order, and where their path ends. An agent that reaches your pricing page and stops may have found what it needed. One that loops through navigation without reaching a page that states your price, your integrations or your security terms is telling you those facts are hard to reach, and the buyer’s summary will be thinner for it.
As an illustration, suppose verified agent requests on a SaaS site cluster on the integrations page and the pricing page, while human visitors from AI answers mostly land on blog posts. That pattern suggests agents are doing comparison work the blog does not support, and the integrations page is where clarity pays off first. The numbers in such a review will be small, so read them as a list of journeys rather than a trend line.
A quiet log does not mean no agents
Verification only covers agents that sign. An agent that does not sign, or a browser with built-in agent features acting on a person’s own machine, can still look exactly like that person, and nothing in the request will say otherwise. A count of signed visits is a floor, not a total, and it says nothing on its own about whether you appear in the answer the agent finally writes.
That is why Obility’s Agent Analytics keeps automated traffic, citation observations and referral visits as separate signals, and treats a user-agent match as useful but not as verified bot identity. A signature is the stronger evidence where it exists. Pair it with what the answers themselves say about you, because the agent’s visit and the answer it produces are two different facts.