Fortress: The Stealth Browser Built for AI Agents to Bypass Anti-Bot Detection

When AI Agents Hit the Anti-Bot Wall

As automated browsers and AI Agents become more prevalent, developers increasingly want their programs to interact with web pages like humans do — filling forms, scraping data, clicking through interfaces. Reality, however, is harsh: a growing number of websites deploy sophisticated anti-bot detection systems that, upon identifying a browser under automation control, immediately serve a CAPTCHA, return empty data, or outright ban the IP.

The open-source project Fortress, which recently appeared on Hacker News, is aimed squarely at this pain point. It bills itself as a "stealth Chromium" — with one core goal: make your AI Agent stop getting blocked by websites.

What Problem Does Fortress Solve

Why Automated Browsers Are Easy to Detect

When driving Chromium with Puppeteer, Playwright, or Selenium, the browser exposes a host of "bot signals." For instance, the navigator.webdriver property is set to true, and certain JavaScript environment variables, fingerprint characteristics, and rendering behaviors differ subtly from those of a real user's browser.

In reality, modern browser fingerprinting has grown extraordinarily precise — far beyond just checking navigator.webdriver. Anti-bot systems simultaneously evaluate dozens to hundreds of signals: Canvas fingerprinting (rendering specific graphics to extract a unique GPU and rendering engine signature), WebGL fingerprinting (using GPU driver differences in rendering specific 3D scenes to generate a device-level unique identifier), AudioContext fingerprinting (identifying the underlying audio stack via differences in how the AudioContext API processes audio signals), font list completeness, screen resolution and color depth, internal consistency of timezone and language settings, and behavioral dimensions such as the entropy of mouse movement trajectories.

Canvas and WebGL fingerprints are particularly hard to spoof because they reflect the physical characteristics of GPU hardware and drivers — the same drawing code produces sub-pixel rendering differences across different hardware and driver stacks, and these differences are extremely difficult to replicate perfectly in software. Automated browsers often exhibit an "overly perfect" consistency across these dimensions — abnormally sparse font lists, perfectly straight mouse trajectories — and this unnatural regularity itself becomes the tell.

Leading anti-bot vendors such as Cloudflare Bot Management, DataDome, and PerimeterX (now HUMAN Security) build their defenses around these multi-dimensional signals, though they differ significantly in technical approach. Cloudflare's solution combines TLS fingerprinting (JA3/JA4 — identifying client types by hashing the cipher suites and extension fields in the TLS handshake), HTTP/2 frame sequence analysis, and JavaScript challenges (the famous "five-second shield," which runs obfuscated JS proof-of-work in the browser); DataDome focuses on real-time behavioral analysis, scoring behavioral sequences for each request using machine learning models and claiming detection within 200 milliseconds; PerimeterX introduces Device DNA technology, combining browser hardware characteristics with cross-session behavioral patterns to establish a device-level identity that's hard to clone. These vendors generally use a "risk scoring" mechanism rather than a simple binary judgment — blocking is only triggered when a score exceeds a threshold — which is why some evasion techniques still work in low-frequency scenarios.

For AI Agents that rely on web interaction, these blocks are fatal. No matter how intelligent the model, if it can't open a page or retrieve data, the entire automation pipeline breaks down.

The Core Idea Behind Stealth Browsers

Fortress works at the browser's foundational level to systematically eliminate the fingerprint characteristics that reveal an automated identity, making a program-controlled Chromium resemble a real user's browser as closely as possible from a fingerprinting standpoint. Such stealth approaches aren't entirely new in the open-source community — tools like puppeteer-extra-plugin-stealth have done similar work — but Fortress aims to provide a more complete, Agent-friendly integrated solution.

puppeteer-extra-plugin-stealth is the most representative predecessor in this space. It uses a plugin-based "evasions" architecture to patch different detection points individually: overriding navigator.webdriver, spoofing navigator.plugins lists, fixing missing Chrome runtime objects, simulating a real window.chrome object, and more. Its design philosophy is "intercept and modify API return values at the JavaScript layer" — essentially injecting override code before page scripts execute via mechanisms like Object.defineProperty. However, this approach has a fundamental limitation: JavaScript-layer patches cannot cover characteristics at the browser inter-process communication (IPC) level, and anti-bot systems can detect evasion by identifying inconsistencies between the JS environment and underlying behavior. As anti-bot systems have continued to evolve, some of this plugin's evasion techniques have been identified, and its maintenance has stagnated.

Fortress aims to provide a more systematic next-generation solution on this foundation, also drawing on the deeper approach of tools like undetected-chromedriver — directly patching the Chromium source code to eliminate automation characteristics at the compilation stage, rather than patching at the JavaScript layer. This approach can modify the automation identifiers embedded in Chromium's CDP (Chrome DevTools Protocol) responses, internal IPC messages, and network request headers, making evasion far more thorough. The tradeoff is the need to maintain a custom Chromium build pipeline, which significantly increases engineering complexity.

From Tool to Agent Infrastructure

Worth noting is the context of Fortress's positioning. The project's author explicitly ties it to "agents (AI agents)" rather than generic traditional web scraping. This reflects a rapidly evolving trend:

AI Agents are becoming the primary consumers of browser automation.

In the past, browser automation was mainly used for testing and small-scale data collection. Today, AI Agent browser automation is undergoing a profound paradigm shift from "tool invocation" to "autonomous operation." Early approaches typically wrapped Puppeteer/Playwright scripts around an LLM, with the model outputting structured instructions executed by the script — a loosely coupled model where the browser served as a stateless executor. The current mainstream direction has moved toward deeper integration: Anthropic's Computer Use API allows models to directly perceive and manipulate interfaces via screenshots, achieving an end-to-end perception-decision-execution loop; Microsoft's Playwright MCP (Model Context Protocol) server wraps browser operations as standardized tools exposed to the model, enabling any MCP-compatible Agent framework to call browser capabilities directly; specialized frameworks like Browser Use and Skyvern unify DOM parsing, visual understanding, and action execution within a single Agent loop, allowing the Agent to dynamically plan multi-step action sequences without pre-written scripts. More and more AI products require Agents to autonomously complete complex tasks on real web pages — price comparison, booking, information aggregation, competitive monitoring.

In these architectures, whether the underlying browser can bypass anti-bot detection directly determines the completeness of the entire Agent capability chain. The problem Fortress solves therefore has a multiplier effect — these scenarios demand "not being blocked" more urgently than ever before, and once blocked, the Agent's autonomy exists in name only.

From this perspective, tools like Fortress are becoming foundational infrastructure for the AI Agent ecosystem — as indispensable as databases are to web applications.

Technical and Ethical Considerations

An Ongoing Escalation

It's important to recognize clearly that stealth browsers and anti-bot systems are locked in an endless arms race. Anti-bot vendors continuously update their detection algorithms, and stealth tools must iterate constantly to remain effective. This means no stealth solution can ever be a one-time fix — it requires active maintenance and community support. For teams considering adopting Fortress, the project's update frequency and maintenance activity are more worth evaluating than its current feature list.

Industry practice also shows that the effectiveness of single stealth browser solutions is declining, and multi-layer defense combinations have become the consensus. At the proxy IP layer, residential proxies are harder to detect than datacenter IPs because their IPs are assigned to real ISP users — datacenter IP ASN (Autonomous System Number, the identifier in the internet routing system for a group of IP addresses managed by a single organization; anti-bot systems can use ASN to quickly determine whether an IP comes from AWS, GCP, or other cloud provider datacenter ranges) characteristics make them easy to identify and block en masse. At the behavioral simulation layer, introducing random delays, simulating realistic Bézier curve mouse movements (Bézier curves use control points to generate naturally curved trajectories — compared to linear interpolation, they more closely approximate the physical laws of human hand movement; cubic Bézier curves are widely used for their smooth control over start and end velocities), and randomizing keyboard input rhythms can significantly improve pass rates. At the request characteristics layer, TLS fingerprint spoofing (such as using the curl-impersonate library to precisely replicate the TLS handshake parameter ordering of a specific Chrome version, including cipher suite lists, extension field arrangement, and elliptic curve priority) and normalization of HTTP header field order (different browsers send HTTP headers in consistent patterns — Chrome, for example, consistently places sec-ch-ua headers before accept, while automation tools often scramble this order and expose their identity) are also critical. Fortress's value lies precisely in integrating these scattered strategies into a unified solution for Agent scenarios.

Compliance and Ethical Boundaries

Bypassing anti-bot mechanisms is itself a gray area. Websites deploy anti-bot systems for legitimate reasons — protecting server resources, preventing malicious data scraping, complying with privacy regulations, and more. When using Fortress, developers need to carefully assess:

• Whether the target site's robots.txt and terms of service permit automated access
• Whether the data being scraped involves personal privacy or copyright
• Whether high-frequency access would place undue burden on the target's servers

It's worth noting that in some scenarios, directly calling the target website's official API (if available) or using authorized data providers fundamentally avoids these compliance risks — a strategically superior choice over technical confrontation.

From a legal standpoint, the U.S. Computer Fraud and Abuse Act (CFAA — a federal law enacted in 1986 that criminalizes unauthorized access to computer systems; its broad definition of "unauthorized access" makes it a potential legal tool against automated scraping) and the EU's General Data Protection Regulation (GDPR — which imposes strict restrictions on scraping personal data of EU citizens, with violations subject to fines up to 4% of global annual revenue) can both create legal constraints on unauthorized automated access. Cases like hiQ Labs v. LinkedIn (which went through multiple rounds of rulings; the Ninth Circuit Court of Appeals ultimately ruled in 2022 that LinkedIn could not invoke the CFAA to prevent hiQ from scraping publicly visible user profile pages, though the ruling's scope remains contested, with different legal risks for different data types and access methods) continue to clarify the legal boundaries of data scraping. Developers should conduct necessary compliance assessments before technical implementation.

The tool itself is neutral, but how it's used determines its nature. Responsible Agent developers should use such tools within a compliance framework, not as an instrument for indiscriminate scraping.

Summary and Outlook

Fortress's traction on Hacker News is still in its early stages, community feedback is limited, and its real-world effectiveness and stability remain to be validated through broader practice. But the need it addresses is real and growing: in the AI Agent era, making an automated browser "access web pages like a human" has evolved from a niche requirement into a core necessity.

For developers building browser-based Agents, Fortress is worth watching and small-scale testing. At the same time, maintain realistic expectations — there's no silver bullet in stealth solutions; best practices typically involve combining multiple layers of strategy: proxy IP rotation, request throttling, humanized behavior, TLS fingerprint spoofing, and more. And beyond the technical, staying within compliance boundaries should always be the first principle of automation practice.

Key Takeaways