# Accuracy report, November 2026

**98.3% of AI agent sessions caught** (1,386 of 1,410: 1,178 with high confidence, 208 with medium). **0 of 159 people were wrongly flagged as AI agents.**

98.3% includes 14.8% at medium confidence, which is held for review and never charged; 83.5% is high confidence. This research data also informed our rules, so it shows how well they fit it, not an independent estimate. The recordings carry no device timing, so the 159 people stayed Unknown: none was flagged as an AI agent and none was read as Human.

Measured on a published research study of seven commercial AI agents and consenting people. See "What to keep in mind" below.

## Every agent in the study

Seven commercial agents did the same shopping, flight-booking and forum tasks. 4 were caught every time. Claude is the hardest: 89.8% caught, the rest left Unknown and never mistaken for a person.

| Agent | Sessions | High confidence | Medium confidence | Unknown | Mistaken for a person | Caught |
| --- | --- | --- | --- | --- | --- | --- |
| Atlas | 196 | 196 | 0 | 0 | 0 | 100% |
| ChatGPT Agent | 204 | 204 | 0 | 0 | 0 | 100% |
| Comet | 203 | 203 | 0 | 0 | 0 | 100% |
| Skyvern | 188 | 179 | 9 | 0 | 0 | 100% |
| Browser Use | 223 | 206 | 15 | 2 | 0 | 99.1% |
| Manus | 210 | 119 | 88 | 3 | 0 | 98.6% |
| Claude | 186 | 71 | 96 | 19 | 0 | 89.8% |

## People

**0 of 159 people were wrongly flagged as AI agents.**

Telltale only calls someone a person after it sees the input delay a real mouse or keyboard produces. These research recordings did not capture that delay. The chart shows the recorded results: 0 Human, 159 Unknown and 0 AI agent.

Separate modeled estimate: **130 of 159** recognised as a person (81.8%), an estimate assuming real mouse and keyboard input. People in the research recordings' test set, given the input timing a real mouse and keyboard show on live sites.

**On live sites.** Telltale recognises people from real hardware input, typically within a few seconds of moving the mouse and clicking. In our own testing, a person browsing a live site in Chrome was recognised as a person, and our own recorded sessions read Human.

## What high and medium mean

Every AI agent verdict says how strong its evidence is. It's a band, not a probability, and it decides what happens next.

- **High confidence** (1,178 sessions here): a verified agent, signs of browser automation, input injected by software, or several independent behaviour signals agreeing. Follows your AI agent rule, so Deny blocks. Chargeable.
- **Medium confidence** (208 sessions here): one kind of behaviour pattern alone, such as how the pointer moved or how keys were typed. Held for review, such as a passkey check; you can switch it to block. Never charged.
- **Unknown** (24 sessions here): not enough evidence either way. Never treated as a person, follows your rule for Unknown, never charged.

## Agents built to imitate people

We built 20 agents to pass as people: smoothed mouse paths, human-like typing, a normal browser with automation hidden. They are a test set we set aside and never tuned on.

15 of 20 passed as a person in an earlier version; now 0 do, and 15 of 20 are caught with high confidence. The other 5 stay Unknown.

## How fast

On the agents built to imitate people, every catch lands within 10 seconds of the first click or key press, and nothing changes after that.

When a person hands over to an agent, proof such as software-injected input or Claude's cursor driving the clicks switches the verdict at the next reading. We have checked this in tests, not yet on recorded handovers.

## How we measured

The research recordings come from [FP-Agent](https://arxiv.org/abs/2605.01247): a research study of seven commercial AI agents and consenting people doing the same shopping, flight-booking and forum tasks ([code](https://github.com/ethanbwang/fp-agent)).

1. **A test set we set aside.** Every person and every agent task was assigned automatically to either rule-setting or testing, never by hand, and the test list was then locked.
2. **Only test sessions count.** 1,410 agent sessions and 159 people from the study, plus the 20 runs of agents built to imitate people.
3. **Unknown is never a right answer.** Not for agents and not for people. Its share is shown beside every figure.

## What to keep in mind

- This research data also informed how we set our rules, so it shows how well they fit it, not an independent estimate.
- Results from live customer sites will follow.
- Not covered yet: named agents in a normal visible browser, people using assistive technology such as screen readers, Safari, Firefox and phones.

Dated 2026-11-03. Detector version heuristic-v4.33.

## For researchers

The full detail behind the figures above: every test set and agent with Wilson 95% intervals, the before and after for the current rules, and how to reproduce it all. Generated by `node tools/accuracy-bench.js` from the frozen test split (`evaluation/holdout-manifest.json`, frozen 2026-11-03, manifest SHA-256 `da8d370870f4a59b…`), live classifier **heuristic-v4.33**. Do not edit by hand: re-run the bench (see "Reproduce" below).

### Summary

Corpora are never pooled into one figure. Per corpus, test rows only:

- Independent test real data (collected after the freeze): **none yet**. Real named-agent runs, OS-level runs and assistive-technology recordings are pending, so this report cannot yet state an independent human false-positive rate.
- Adversarial humaniser agents (headless bench) (independent, scripted agents): Agents read as AI agent: **15 of 20 (53.1%–88.8%)**; Unknown 5 of 20 (11.2%–46.9%); read as Human 0 of 20 (0%–16.1%).
- FP-Agent research recordings (**tuned on this data**, not independent): People read as AI agent (human false-positive rate): **0 of 159 (0%–2.4%)**; Unknown 159 of 159 (97.6%–100%). Agents read as AI agent: **1,386 of 1,410 (97.5%–98.9%)**; Unknown 24 of 1,410 (1.1%–2.5%); read as Human 0 of 1,410 (0%–0.27%).
- Recorded browser agents (Codex in-app browser and others) (**tuned on this data**, not independent): Agents read as AI agent: **9 of 12 (46.8%–91.1%)**; Unknown 3 of 12 (8.9%–53.2%); read as Human 0 of 12 (0%–24.3%).
- SapiMouse human pointer movement (**tuned on this data**, not independent): People read as AI agent (human false-positive rate): **0 of 30 (0%–11.3%)**; Unknown 30 of 30 (88.6%–100%).
- Corpora with fewer than 10 test sessions (Confirmed human recordings (one person); Automation start-up smoke corpus) are too small to give a rate; they are listed in the tables below.

### What changed in heuristic-v4.33

Before (heuristic-v4.32) and after (heuristic-v4.33), on the same inputs. Each cell is Agent (high / medium confidence) / Unknown / Human (session counts).

| Corpus | Agents (n) | Agents before | Agents after | People (n) | People before | People after |
| --- | --- | --- | --- | --- | --- | --- |
| FP-Agent, all 7,728 sessions (no-regression check) (tuned on this data, not an accuracy estimate) | 7,182 | 7,025 (5,993 high / 1,032 medium) / 157 / 0 | 7,025 (5,993 high / 1,032 medium) / 157 / 0 | 546 | 0 (0 high / 0 medium) / 546 / 0 | 0 (0 high / 0 medium) / 546 / 0 |
| FP-Agent, frozen test split (the grade) (tuned on this data, not an accuracy estimate) | 1,410 | 1,386 (1,178 high / 208 medium) / 24 / 0 | 1,386 (1,178 high / 208 medium) / 24 / 0 | 159 | 0 (0 high / 0 medium) / 159 / 0 | 0 (0 high / 0 medium) / 159 / 0 |
| FP-Agent, tuning portion (train and validation splits) (tuned on this data, not an accuracy estimate) | 5,772 | 5,639 (4,815 high / 824 medium) / 133 / 0 | 5,639 (4,815 high / 824 medium) / 133 / 0 | 387 | 0 (0 high / 0 medium) / 387 / 0 | 0 (0 high / 0 medium) / 387 / 0 |
| Adversarial humanisers, test seeds (independent scripted agents) (independent of FP-Agent; see the note on thresholds) | 20 | 15 (15 high / 0 medium) / 5 / 0 | 15 (15 high / 0 medium) / 5 / 0 | 0 | — | — |

- What changed: two readings that heuristic-v4.32 held at medium confidence now read Unknown. (1) Injected input that is the only sign of software, on pages whose input is otherwise shaped like a person's, from a published data-centre address (remote browser isolation, a cloud browser's live view). (2) A screen-reader page: every mouse press with no pointer travel (VoiceOver's activate command, or the pointer resting after following the VoiceOver cursor) and nothing typed; its jump clicks, alone or with a paste, are no longer AI agent evidence. Proof is unchanged: an automation trace, a verified signature, an AI agent's cursor, sustained machine input, and injected input from any other address stay high.
- Effect on these test sets: no test figure changes. No test corpus records the connection address, the adversarial runs come from a local address, and FP-Agent replays carry no press-shape summary, so neither rule can apply. Fresh adversarial run under heuristic-v4.33: 15 high, 5 Unknown (the heuristic-v4.32 run read 15 high, 5 Unknown too; one run that read an automation trace then read injected input now, both high). Worst case, the same runs re-scored with a data-centre address assumed: 13 of the 15 high runs read Unknown (heuristic-v4.32: medium), 2 stay high (their input fails the person-shape checks), and the 5 Unknown stay Unknown. People read AI agent: 0 of 159 test, 0 of 546 overall; the VoiceOver and isolation people fixtures now read Unknown instead of medium.

### How the verdict develops over time

Each cell is the verdict as it stood at that moment (seconds after the first interaction): agents read AI agent at high / medium confidence, then Unknown and Human; people read AI agent, which must stay 0. n counts sessions still running at that moment. FP-Agent is tuned data and has no device timing: it can reach high confidence only through several behaviour families agreeing (heuristic-v4.28.1), never through injected input.

| Corpus | Who | 2 s | 5 s | 10 s | 20 s | 30 s | 60 s |
| --- | --- | --- | --- | --- | --- | --- | --- |
| fp-agent-all | agents: high / medium / Unknown / Human | 0 / 1 / 7,174 / 0 (n 7,175) | 0 / 1 / 7,174 / 0 (n 7,175) | 0 / 1 / 7,174 / 0 (n 7,175) | 0 / 1 / 7,128 / 0 (n 7,129) | 0 / 1 / 6,770 / 0 (n 6,771) | 1 / 0 / 5,120 / 0 (n 5,121) |
| fp-agent-all | people | Agent 0, Unknown 517, Human 0 (n 517) | Agent 0, Unknown 504, Human 0 (n 504) | Agent 0, Unknown 483, Human 0 (n 483) | Agent 0, Unknown 394, Human 0 (n 394) | Agent 0, Unknown 343, Human 0 (n 343) | Agent 0, Unknown 218, Human 0 (n 218) |
| fp-agent-heldout | agents: high / medium / Unknown / Human | 0 / 0 / 1,409 / 0 (n 1,409) | 0 / 0 / 1,409 / 0 (n 1,409) | 0 / 0 / 1,409 / 0 (n 1,409) | 0 / 0 / 1,402 / 0 (n 1,402) | 0 / 0 / 1,332 / 0 (n 1,332) | 0 / 0 / 995 / 0 (n 995) |
| fp-agent-heldout | people | Agent 0, Unknown 154, Human 0 (n 154) | Agent 0, Unknown 149, Human 0 (n 149) | Agent 0, Unknown 139, Human 0 (n 139) | Agent 0, Unknown 115, Human 0 (n 115) | Agent 0, Unknown 101, Human 0 (n 101) | Agent 0, Unknown 60, Human 0 (n 60) |
| fp-agent-tuning | agents: high / medium / Unknown / Human | 0 / 1 / 5,765 / 0 (n 5,766) | 0 / 1 / 5,765 / 0 (n 5,766) | 0 / 1 / 5,765 / 0 (n 5,766) | 0 / 1 / 5,726 / 0 (n 5,727) | 0 / 1 / 5,438 / 0 (n 5,439) | 1 / 0 / 4,125 / 0 (n 4,126) |
| fp-agent-tuning | people | Agent 0, Unknown 363, Human 0 (n 363) | Agent 0, Unknown 355, Human 0 (n 355) | Agent 0, Unknown 344, Human 0 (n 344) | Agent 0, Unknown 279, Human 0 (n 279) | Agent 0, Unknown 242, Human 0 (n 242) | Agent 0, Unknown 158, Human 0 (n 158) |
| adversarial-heldout | agents: high / medium / Unknown / Human | 0 / 0 / 20 / 0 (n 20) | 5 / 0 / 15 / 0 (n 20) | 15 / 0 / 5 / 0 (n 20) | 15 / 0 / 5 / 0 (n 20) | 15 / 0 / 5 / 0 (n 20) | — |
| user-recordings | people | Agent 0, Unknown 4, Human 0 (n 4) | Agent 0, Unknown 2, Human 2 (n 4) | Agent 0, Unknown 1, Human 3 (n 4) | Agent 0, Unknown 2, Human 2 (n 4) | Agent 0, Unknown 2, Human 2 (n 4) | Agent 0, Unknown 2, Human 2 (n 4) |

### Recognised as Human (assuming real hardware, which live sessions show)

Assuming real hardware, which live sessions show: the FP-Agent replay has no device timing, so every page is given the input-pipeline delay and merged pointer samples a physical mouse and keyboard leave on a live Chromium page. An estimate, not a measurement. The agent column is the worst case: agents given the same device evidence, which software input does not show on a live page.

| Classifier and scope | People | Read Human at the end | Ever read Human | Median time to Human | Human by 2 s | Human by 5 s | Human by 10 s | Human by 20 s | Human by 30 s | Human by 60 s | People read AI agent | Agents read Human |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| heuristic-v4.32, frozen test | 159 | 130 (81.8%) | 135 | 11 s | 0 | 15 | 65 | 104 | 115 | 125 | 0 | 0 of 1,410 |
| heuristic-v4.32, all sessions | 546 | 457 (83.7%) | 470 | 10 s | 1 | 53 | 242 | 344 | 384 | 435 | 0 | 0 of 7,182 |
| heuristic-v4.33, frozen test | 159 | 130 (81.8%) | 135 | 11 s | 0 | 15 | 65 | 104 | 115 | 125 | 0 | 0 of 1,410 |
| heuristic-v4.33, all sessions (tuned on this data) | 546 | 457 (83.7%) | 470 | 10 s | 1 | 53 | 242 | 344 | 384 | 435 | 0 | 0 of 7,182 |

Why the other frozen test people stay Unknown (the requirement each came closest to meeting): fewer than 20 interactions on one page 13; too few key or click intervals 5; mouse clicks without pointer travel 2; fewer than 3 kinds of input (pointer, clicks, keys, scrolling) 2; no input at all 2.

### What this report does not cover yet

- Real named-agent runs (Claude in Chrome, ChatGPT agent, Atlas, Comet) in a normal visible browser: pending. The run kit is tools/real-agent-runs.js (docs/maintainers/accuracy-real-agent-runs.md); until those rows exist the clean test real-agent table is empty.
- Assistive-technology recordings of consenting people (screen readers, voice control, switch access, keyboard-only): pending. The protocol is docs/public/accuracy-assistive-protocol.md; until those rows exist there is no measured human false-positive rate for assistive-technology users.
- OS-level computer-use agents that drive the real mouse and keyboard: harness written (tools/os-agent-harness.js) and dry-run scored on emulated input, not yet run on a real screen.
- Phones and tablets, non-Chrome browsers, and people other than the one person we recorded and the FP-Agent study participants.
- Production traffic: every figure here is from labelled test sessions, not from a customer site.

### How to read it

- Only test sessions are counted. Each corpus was split into tuning and test sets by a hash of the person, trial or run, never by hand, and the test-set membership is frozen with a SHA-256 hash.
- **Unknown is not Human.** Unknown (too little or conflicting evidence) is never counted as a correct answer, and its share is shown next to every rate.
- Each rate is "count of sessions" with a Wilson 95% interval in parentheses. Sessions from one person or one agent family are correlated, so the real uncertainty is wider.
- **Tuned on this data** marks corpora we looked at while choosing the current rules, test split included. Those numbers show the rules fit that data. They are not an independent accuracy estimate.
- Verdicts are categories, not probabilities.

### Independent test results

Collected after the freeze, with the rules unchanged since. These are the only numbers in this report that measure accuracy on unseen data.

**Agents**

| Corpus or agent | Test sessions | Read Agent | of them high confidence | Unknown | Read Human | Ever read Human | Agent for protected actions (current code) |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Adversarial humaniser agents (headless bench) | 20 | 15 of 20 (53.1%–88.8%) | 15 of 20 (53.1%–88.8%) | 5 of 20 (11.2%–46.9%) | 0 of 20 (0%–16.1%) | 0 of 20 (0%–16.1%) | 15 of 20 (53.1%–88.8%) |
|   Adversarial humaniser agents (headless bench) › humaniser-fill | 5 | 0 of 5 (0%–43.5%) | 0 of 5 (0%–43.5%) | 5 of 5 (56.5%–100%) | 0 of 5 (0%–43.5%) | 0 of 5 (0%–43.5%) | 0 of 5 (0%–43.5%) |
|   Adversarial humaniser agents (headless bench) › humaniser-jitter | 5 | 5 of 5 (56.5%–100%) | 5 of 5 (56.5%–100%) | 0 of 5 (0%–43.5%) | 0 of 5 (0%–43.5%) | 0 of 5 (0%–43.5%) | 5 of 5 (56.5%–100%) |
|   Adversarial humaniser agents (headless bench) › humaniser-minjerk | 5 | 5 of 5 (56.5%–100%) | 5 of 5 (56.5%–100%) | 0 of 5 (0%–43.5%) | 0 of 5 (0%–43.5%) | 0 of 5 (0%–43.5%) | 5 of 5 (56.5%–100%) |
|   Adversarial humaniser agents (headless bench) › humaniser-trace-replay | 5 | 5 of 5 (56.5%–100%) | 5 of 5 (56.5%–100%) | 0 of 5 (0%–43.5%) | 0 of 5 (0%–43.5%) | 0 of 5 (0%–43.5%) | 5 of 5 (56.5%–100%) |

**People**

No test human sessions yet.

Adversarial humanisers: 20 test runs (4 kinds × seeds 101, 102, 103, 104, 105), headless and muted, normal user agent, navigator.webdriver hidden. These are scripted agents, not real ones: they show which humanising tricks the live rules miss. 0 of 20 read Human and 0 of 20 would be treated as a person by a protected action. Under heuristic-v4.25 and v4.26, 15 of these 20 read Human; since heuristic-v4.27 Human also needs a physical-device input trait, which these runs do not show. 15 of 20 read AI agent (their input arrived without hardware delay: injected by software) and 5 read Unknown. Agents that only humanise behaviour, without injected input or an automation trace, are why a single behaviour pattern is medium confidence: held for review, never charged.

### Test split of data the rules were tuned on

**Tuned on this data.** These test rows were already visible when the current rules were chosen, so they are not independent. They are kept to catch regressions and to show how well the rules fit the data they came from.

**Agents**

| Corpus or agent | Test sessions | Read Agent | of them high confidence | Unknown | Read Human | Ever read Human | Agent for protected actions (current code) |
| --- | --- | --- | --- | --- | --- | --- | --- |
| FP-Agent research recordings | 1,410 | 1,386 of 1,410 (97.5%–98.9%) | 1,178 of 1,410 (81.5%–85.4%) | 24 of 1,410 (1.1%–2.5%) | 0 of 1,410 (0%–0.27%) | 0 of 1,410 (0%–0.27%) | 1,386 of 1,410 (97.5%–98.9%) |
|   FP-Agent research recordings › Atlas Agent | 196 | 196 of 196 (98.1%–100%) | 196 of 196 (98.1%–100%) | 0 of 196 (0%–1.9%) | 0 of 196 (0%–1.9%) | 0 of 196 (0%–1.9%) | 196 of 196 (98.1%–100%) |
|   FP-Agent research recordings › Browser Use | 223 | 221 of 223 (96.8%–99.8%) | 206 of 223 (88.1%–95.2%) | 2 of 223 (0.25%–3.2%) | 0 of 223 (0%–1.7%) | 0 of 223 (0%–1.7%) | 221 of 223 (96.8%–99.8%) |
|   FP-Agent research recordings › ChatGPT Agent | 204 | 204 of 204 (98.2%–100%) | 204 of 204 (98.2%–100%) | 0 of 204 (0%–1.8%) | 0 of 204 (0%–1.8%) | 0 of 204 (0%–1.8%) | 204 of 204 (98.2%–100%) |
|   FP-Agent research recordings › Claude | 186 | 167 of 186 (84.6%–93.4%) | 71 of 186 (31.5%–45.3%) | 19 of 186 (6.6%–15.4%) | 0 of 186 (0%–2%) | 0 of 186 (0%–2%) | 167 of 186 (84.6%–93.4%) |
|   FP-Agent research recordings › Comet | 203 | 203 of 203 (98.1%–100%) | 203 of 203 (98.1%–100%) | 0 of 203 (0%–1.9%) | 0 of 203 (0%–1.9%) | 0 of 203 (0%–1.9%) | 203 of 203 (98.1%–100%) |
|   FP-Agent research recordings › Manus | 210 | 207 of 210 (95.9%–99.5%) | 119 of 210 (49.9%–63.2%) | 3 of 210 (0.49%–4.1%) | 0 of 210 (0%–1.8%) | 0 of 210 (0%–1.8%) | 207 of 210 (95.9%–99.5%) |
|   FP-Agent research recordings › Skyvern | 188 | 188 of 188 (98%–100%) | 179 of 188 (91.1%–97.5%) | 0 of 188 (0%–2%) | 0 of 188 (0%–2%) | 0 of 188 (0%–2%) | 188 of 188 (98%–100%) |
| Recorded browser agents (Codex in-app browser and others) | 12 | 9 of 12 (46.8%–91.1%) | 0 of 12 (0%–24.3%) | 3 of 12 (8.9%–53.2%) | 0 of 12 (0%–24.3%) | 0 of 12 (0%–24.3%) | 9 of 12 (46.8%–91.1%) |
|   Recorded browser agents (Codex in-app browser and others) › Codex in-app browser | 5 | 3 of 5 (23.1%–88.2%) | 0 of 5 (0%–43.5%) | 2 of 5 (11.8%–76.9%) | 0 of 5 (0%–43.5%) | 0 of 5 (0%–43.5%) | 3 of 5 (23.1%–88.2%) |
|   Recorded browser agents (Codex in-app browser and others) › Codex native browser controls | 7 | 6 of 7 (48.7%–97.4%) | 0 of 7 (0%–35.4%) | 1 of 7 (2.6%–51.3%) | 0 of 7 (0%–35.4%) | 0 of 7 (0%–35.4%) | 6 of 7 (48.7%–97.4%) |
| Automation start-up smoke corpus | 1 | 0 of 1 (0%–79.3%) | 0 of 1 (0%–79.3%) | 1 of 1 (20.6%–100%) | 0 of 1 (0%–79.3%) | not measured | 0 of 1 (0%–79.3%) |

**People**

| Corpus or kind | Test sessions | False positive (read AI agent) | Ever read AI agent | AI agent for protected actions (current code) | Unknown | Read Human |
| --- | --- | --- | --- | --- | --- | --- |
| FP-Agent research recordings | 159 | 0 of 159 (0%–2.4%) | 0 of 159 (0%–2.4%) | 0 of 159 (0%–2.4%) | 159 of 159 (97.6%–100%) | 0 of 159 (0%–2.4%) |
| Confirmed human recordings (one person) | 1 | 0 of 1 (0%–79.3%) | 0 of 1 (0%–79.3%) | 0 of 1 (0%–79.3%) | 1 of 1 (20.6%–100%) | 0 of 1 (0%–79.3%) |
| SapiMouse human pointer movement | 30 | 0 of 30 (0%–11.3%) | not measured | 0 of 30 (0%–11.3%) | 30 of 30 (88.6%–100%) | 0 of 30 (0%–11.3%) |

- FP-Agent research recordings: Frozen test split (1569 of 7728 sessions). Verdict combines the movement-shape visit replay (Agent) with the event replay (Human); both are approximate replays of a research recorder, not live traffic. The replay has no device timing, so a movement-replay AI agent verdict is high confidence (deny under the AI agent rule, chargeable) when two independent behaviour families agree on one page (heuristic-v4.28.1) and medium (held for review, never charged) otherwise.

### Synthetic fixtures (rule checks, not counted)

SYNTHETIC approximations of assistive-technology input, not recordings of people. Rule checks only: never counted in the human false-positive rate.

| Scenario | Truth | Runs | Live verdict at the end | Ever Agent | Ever Human |
| --- | --- | --- | --- | --- | --- |
| switch-scanning-activate | human | 3 | unknown 3 | 0 | 0 |
| switch-point-mode | human | 3 | unknown 3 | 0 | 0 |
| head-pointer-dwell | human | 3 | unknown 3 | 0 | 0 |
| eye-gaze-dwell | human | 3 | unknown 3 | 0 | 0 |
| voice-control-click-name | human | 3 | unknown 3 | 0 | 0 |
| voice-control-mousegrid-fast | human | 3 | unknown 3 | 0 | 0 |
| dictation | human | 3 | unknown 3 | 0 | 0 |
| keyboard-only | human | 3 | unknown 3 | 0 | 0 |
| assistive-tech | human | 3 | unknown 3 | 0 | 0 |
| screen-reader-clicks-only | human | 3 | unknown 3 | 0 | 0 |
| voice-control | human | 3 | unknown 3 | 0 | 0 |
| screen-reader-form | human | 3 | unknown 3 | 0 | 0 |

### Reproduce

```sh
# Adversarial humanisers: the committed runs are evaluation/bench/adversarial-2026-11-03.json (heuristic-v4.25), evaluation/bench/adversarial-2026-11-03-v432.json (heuristic-v4.32) and evaluation/bench/adversarial-2026-11-03-v433.json (heuristic-v4.33). To re-run (headless, muted; about 20 minutes):
node tools/detection-bench.js --kinds adversarial --seeds held-out --ports 4761-4769 --out .scratch/accuracy/adversarial.json
# FP-Agent page summaries and event replay input (needs the research dataset; see tools/fp-agent-benchmark/README.md)
.scratch/fp-agent-data/venv/bin/python -I tools/fp-agent-benchmark/pages.py RAW.json .scratch/accuracy/fp-pages.jsonl
.scratch/fp-agent-data/venv/bin/python -I tools/fp-agent-benchmark/convert.py RAW.json .scratch/accuracy/fp-events.jsonl
# The verdict over time
node tools/evidence-checkpoints.js --fp-agent-events .scratch/accuracy/fp-events.jsonl --adversarial evaluation/bench/adversarial-2026-11-03-v433.json --out .scratch/accuracy/checkpoints.json
# The report: the data file (JSON), this page (Markdown) and the /accuracy page, which renders from the JSON
node tools/accuracy-bench.js --date 2026-11-03 --adversarial evaluation/bench/adversarial-2026-11-03-v433.json --adversarial-before evaluation/bench/adversarial-2026-11-03-v432.json --compare heuristic-v4.32 --fp-agent-pages .scratch/accuracy/fp-pages.jsonl --fp-agent-events .scratch/accuracy/fp-events.jsonl --checkpoints .scratch/accuracy/checkpoints.json --json docs/public/accuracy-report-2026-11.json --markdown docs/public/accuracy-report-2026-11.md
```

Inputs used for this page: manifest `da8d370870f4a59b…`; adversarial `c8687c01d0a56936…`; adversarialBefore `856cffc4c355c51c…`; fpAgentPages `2deb5244175a424d…`; fpAgentEvents `3b85780dffd71da5…`.