An antidetect browser is a desktop application that runs many isolated browser profiles and rewrites the fingerprint each profile presents to a website. Canvas and WebGL output, user-agent and client hints, screen geometry, installed fonts, audio stack, timezone, WebRTC behavior, and the proxy each profile exits through are all set per profile. Multilogin, GoLogin, AdsPower, Dolphin and a dozen smaller vendors sell variations of the same idea: one machine, many convincing identities.
The engineering behind them is real. The model still has a ceiling, and the ceiling is not a defect in any particular product.
Spoofing has to produce a consistent lie across every surface a detector can read. Detection only has to find one place where the lie fails to hold. That asymmetry is the reason Archonum runs agent browser sessions on real consumer smartphones instead: a fingerprint that was never constructed has nothing to keep consistent.
Spoofing scales linearly, detection scales combinatorially
The cost of spoofing grows with the number of attributes you rewrite. The cost of catching it does not, because every attribute an antidetect browser controls is one more value that has to agree with all the others. Add a spoofed platform string and you have added a dependency on the WebGL renderer, the font list, the plugin array, the client hints, and whatever platform-specific API a detector decides to read next quarter.
Detectors do not check attributes one at a time. They check whether the set is internally coherent, which is a much cheaper thing to do than to construct.
Antoine Vastel, Pierre Laperdrix, Walter Rudametkin and Romain Rouvoy made this concrete in FP-Scanner at USENIX Security 2018. Their test suite identified fingerprinting countermeasures precisely from the inconsistencies those countermeasures introduced. The tool that was supposed to hide the browser was what gave it away.
That was eight years ago, against privacy extensions. The commercial detection stack has had the intervening years to industrialize the idea.
“But antidetect browsers demonstrably work”
They do, and the honest number is worth stating. Hari Venugopalan, Shaoor Munir, Shuaib Ahmed, Tangbaihe Wang, Samuel T. King and Zubair Shafiq at UC Davis published FP-Inconsistent in June 2024. They stood up a measurement site behind DataDome and BotD, pointed twenty commercial bot services at it, and collected 507,080 requests. Evasion succeeded 52.93% of the time against DataDome and 44.56% against BotD.
So the objection is correct on its own terms. Fingerprint rewriting gets you past two serious commercial detectors roughly half the time.
The trouble is what the same paper did next. The authors derived rules from the inconsistencies those services left behind, spatial ones inside a single request and temporal ones across a session, and cut evasion by roughly 48% against DataDome and 45% against BotD while still correctly passing 96.84% of legitimate traffic.
That is a published, reproducible method sitting in the literature that every detection vendor reads. A coin flip is a workable hit rate for a marketing campaign. As the availability target for a production data pipeline it is not, and it only moves in one direction as those countermeasures ship.
“The fingerprint is only one layer, and good tooling covers the rest”
An antidetect browser controls the surface it can reach from inside the page. It does not control the route the request took to get there.
Cloudflare’s residential-proxy detection model, described by Bob AminAzad, Santiago Vargas and Adam Martinetti in June 2024, leans on exactly that gap. Rather than blocking IP ranges, the model reads latency patterns and activity timing, on the reasoning that a proxied request traverses extra hops before it reaches the origin and that a residential IP being used as an exit node behaves differently from the household it belongs to. Cloudflare put the scale of what it was classifying at more than 17 million unique IPs per hour, across 237 countries and over 45,000 ASNs.
Below that sits the TLS handshake, where JA3 and JA4 fingerprints are produced by the networking library rather than the browser UI. We walked through that layer in why real devices beat emulators and will not repeat it here.
Each of those layers belongs to somebody else. The proxy vendor owns the route, the networking library owns the handshake, and the host operating system owns most of what sits between them. Covering the rest means getting all of it to tell one story, which is not something a profile editor can reach.
Stealth patches are themselves a fingerprint
The most useful recent result on this came out in June 2026, when Iliana Fayolle, Sihem Bouhenniche, Samuel Pélissier, Pierre Laperdrix, Clémentine Maurice and Walter Rudametkin ran six LLM-based web agents against honeysites protected by robots.txt, CAPTCHAs, proof-of-work and Cloudflare.
Some agents got through every defense. All six were still distinguishable from human visitors, and from each other, using layered fingerprinting across the network, HTTP and browser surfaces. The authors call the next part paradoxical: the stealth mechanisms frequently made detection easier rather than harder.
This follows from how the population is shaped. A patched property is rarer than an unpatched one. An override that returns a plausible value in a way no shipping browser build ever does is a sharper identifier than the value it replaced.
Antidetect browser detection is not the hard problem people assume. Being classified as an antidetect browser at all is usually sufficient grounds for a block, whatever identity the profile was wearing.
“Then real devices are just an expensive antidetect browser”
This is the objection worth taking most seriously, and the answer is that there is no spoofing step to get wrong.
Archonum runs the browser session on a real consumer smartphone: 250,000+ devices across 175+ countries, and 1 network hop, because Chrome is running on the handset that owns the IP. Nothing is rewritten to look plausible. The canvas output is whatever that GPU actually renders, the sensors report whatever they are actually measuring, and the exit IP belongs to the phone making the request, so there is no proxy split for a latency model to notice.
The consistency budget that antidetect browsers spend their whole engineering effort on does not exist, because no two values were ever set independently. There is also no treadmill: a Chrome release that changes a fingerprintable API changes it on the device, the same day it changes for everyone else.
Real devices do not make traffic invisible, and nothing should be sold as if they do. Request patterns and session behavior are still readable, and Cloudflare and its peers weight them heavily. What real hardware removes is one specific class of failure, the one caused by claiming to be something you are not.
The category’s reputation is part of what you are buying
Michele Campobasso and Luca Allodi documented the other end of this market at ACM CCS 2020. Their study of an invite-only Impersonation-as-a-Service platform found profiles for more than 260,000 internet users on sale, bundling credentials, cookies, and device and behavioral fingerprints so a buyer could reproduce a victim’s browser closely enough to walk through risk-based authentication and MFA.
Fingerprint-spoofing tooling is load-bearing in that economy. Detection vendors know it, and it is a large part of why the tooling itself became a classification target rather than just the traffic it produces.
That inheritance follows any workload built on the same primitive, including entirely legitimate ones. Archonum is data-access infrastructure for AI agents. There is no borrowed profile and no constructed identity, which is a different conversation to have with a security team than explaining which antidetect vendor you standardized on.
Where the ceiling actually is
An antidetect browser is a reasonable answer to the question of how to make one machine present as several. It is a poor foundation for infrastructure that has to keep working after the next detection paper ships.
Archonum takes the other route. Agent traffic runs on 250,000+ real consumer smartphones in 175+ countries, one hop from the origin, with no fingerprint to maintain because none was ever assembled.
You can rewrite every value a page is able to read. Everything underneath still has to agree with all of them at once, and that is the part that does not scale.