Live demo
A no-install demo at https://app.trytelltale.dev/try: eight small, fictional site tasks and a panel that shows how your own session is classified.
Running it
- Press Start on
https://app.trytelltale.dev/try(it opens the product reviews task), or open any scenario, for examplehttps://app.trytelltale.dev/try/flights, and press Start there. Nothing is observed before that. Stop observing is there from then on, also while the page is still connecting; it withdraws the session and discards pending telemetry. - Do the task. The same session detects whoever drives the browser, you or an AI agent: there is one Start for both.
- Watch the This session panel beside the task (on a phone, a verdict bar stays at the foot of the screen; Details opens its sentence). How we know opens one short line on what the verdict rests on. Restart opens a new session and resets the task.
- Optional, before or after Start: Want to see it catch an AI agent? Copy this prompt for your agent (on the first screen: Or have your AI agent do it: copy a prompt) opens a prompt to paste into an AI browser agent. The prompt names the page and the task, asks for made-up details only, and tells the agent to press Start itself: showing or copying the prompt observes nothing.
A task with typing reaches a person's verdict sooner than one with only clicks and menus: the human rule needs ten key or click intervals with a person's timing, and the input must show a physical device's delay.
Each browser tab has its own demo session (the SDK's sessionScope: 'tab'). Claude in Chrome and Comet work inside your own browser, so the tab they open gets its own session and verdict and yours stays yours. To see both side by side, create a comparison link first (below): the agent prompt then carries it. A separate browser works too.
When you finish a task, the panel keeps the result under Task finished ("Classified as human activity at 3:12 PM (Reserve).") while the live view above it keeps updating. If the task was done differently from what it asked, the heading says so and names the first difference ("Finished, but not as asked: you picked Friday"); the result still counts. On a phone, See your result under the task jumps to it. A task finished while the page is still connecting counts too: it is recorded, and checked once, as soon as the session is ready.
A new search (or another stay, date or room) clears the earlier pick and its result, so a confirmation never describes a choice you have since changed. Times are shown in the product’s one 12-hour format (7:45 PM).
Scenarios: stay booking, flight search, concert tickets, table reservation, product reviews, pay survey, item return and car rental. Every form finishes inside the page; nothing is booked, bought, posted or sent.
What the panel shows
| State | Meaning |
|---|---|
| Not started | Nothing is observed until you press Start. |
| Connecting | The page is opening a session with the Telltale server. After 8 seconds it says Still connecting…; it shows an error only once the SDK reports the connection failed. |
| Monitoring | The session is open but no pointer, click, key or scroll activity has arrived yet. |
| Looks like a person so far | The verdict is still unknown (unknown), but the mouse input so far came from a real device. It is not a verdict: protected actions, chargeable use and counts never read it, and a few more clicks or some typing settle it. Anything that points to an AI agent replaces it at once. |
| More activity needed | The verdict is unknown (unknown): too little recent activity to tell. It is not counted as human. |
| Can't confirm a person | The verdict is unknown (unknown), and something in the session already rules out calling it a person (for example an agent page marker or machine-even key holds), though not enough to call it an AI agent. More activity alone will not change it. |
| Human activity | The verdict is human. A category, not a guarantee. |
| Human activity, last confirmed N s ago | Nothing new arrived and the current evidence (the last 60 seconds) is simply too thin to say anything, so the page keeps the last verdict and says how long ago it was confirmed. It updates when you use the page again. Only shown when nothing in the window points another way; the API verdict is still unknown. The same applies to AI agent activity. |
| Human activity, paused | The same, after two minutes without anything new. It is the last verdict, never a new one. |
| AI agent activity | The verdict is agent (agent): software is driving the browser. We use this label for any automation. It is a category, not a claim about which model is involved: without anything reliable to name it, no agent is named. |
| AI agent activity, named | The verdict is agent and the agent is named with how we know the name: Verified (signed: its maker signed the requests, and we checked the signature) or Unconfirmed (weak-marker: named from something its tool leaves on the page. The AI agent verdict doesn't depend on it, but the name could be faked). Once a name has been seen in a session it stays beside the AI agent verdict for the rest of that session, as named earlier in this session (Unconfirmed), even after the page marker is gone; the panel, the result and the comparison row say the same. |
| Connection problem | The Telltale server could not be reached. The last verdict is not presented as current, and the pill beside This session says Connection problem instead of Observing. |
If the page has seen your pointer for 15 seconds but nothing reached the Telltale server, the panel says We aren't receiving your activity. Restart to try again. with its one Restart button. Restart fully restarts capture on a new session.
Under the state, How we know shows one short line from a fixed list, with what it means, and the kinds of activity received: Automation trace, Injected input, Verified signature, Behaviour pattern, Sustained behaviour, Behaviour change or Agent cursor for AI agent activity, and Physical input for Human activity. The detailed reasons and input notes stay in your own dashboard: a public page that explained them would help someone tune an agent to slip past. There are no scores or percentages: verdicts are categorical, not probabilities.
When the verdict first becomes agent, the page opens a You caught an AI agent dialog once per session. It shows the category (AI agent activity), the one short How we know line, the agent's name only with how we know it, and one next step, Start free trial; it has no email field and asks you nothing. It is the demo's own response, not security: a real site applies its own rule on its server (let it through, hold it for review, or block it).
On the final step of a task (Reserve, Buy tickets and so on) the page asks the Telltale server once more, through POST /demo-api/action-check, and shows the result under the task: the verdict at that moment and what a protected action would do with it. The task itself is never blocked.
Comparison links
Create a comparison link (under the agent prompt, after Start: the link is made from your own demo session) makes a link such as https://app.trytelltale.dev/try/booking?run=<id> that you can open in several browsers, for example your own and an AI agent's. A browser that opens the link is told it was invited, and joins only after its own Start. The card then lists You and the other browsers as Browser 2, Browser 3 and so on, each with its verdict and, for an agent, its name with how we know ("Claude in Chrome · Unconfirmed", or "AI agent · Not named"): no person's identity, typed data or other session details. The news is said once, in the Compare browsers card: a browser that joins hears "You joined; 1 other browser is here.", and the browsers already there hear "Browser 2 joined: …". Stopping a browser, or pressing Leave comparison (POST /demo-api/run/leave, which frees only that browser's own seat), removes it from every list on the next poll; a list that cannot be refreshed is hidden rather than shown stale. Links live in memory, hold up to six browsers and expire within an hour (a browser that has not joined yet sees "expires within an hour"); a link that is mistyped or expired says "This comparison link isn't valid or has expired". Each demo session can create three links an hour (ten a minute per client address); when the server holds its maximum of 1,000 links, the oldest link no browser has joined is dropped first.
Next step
Once a verdict is on screen the panel offers one next step: Start free trial (/#auth=signup), with a link to these docs. Where Telltale's plans are on, it adds "14-day free trial of Growth, no card."; elsewhere "Free to start, no card." The demo collects no email address and never asks you to confirm or label your verdict.
How the panel gets the verdict
The page loads the browser SDK paused until consent (waitForConsent: true) with the publishable key of a dedicated Public demo Site, created automatically when the Telltale server starts. That Site captures behaviour only: discovery and request capture are off. Its server key is generated and discarded at creation, so no browser ever receives one.
The panel calls POST /demo-api/verdict with {"sessionToken": "..."} from client.getSessionToken(). The Telltale server evaluates that one session the same way /api/v1/verify does and returns only a visitor-safe summary:
{"state":"more-activity","verdict":"unknown","basis":null,"activity":["pointer movement","scrolling"],"attribution":null,"evidence":{"stale":false,"ageSeconds":2}}When the session read Human or AI agent earlier and the current window is simply quiet, state is earlier and earlier says which verdict, how many seconds ago it was last read (ageSeconds) and whether that is over two minutes (paused).
- It answers only for a valid token of a Public demo session, sent from the page's own origin. Any other token, Site or origin gets the same
404 {"error":"session_not_found"}, so it cannot read or probe another session. basisis the one "How we know" line (null while Unknown). No reasons, notes, signal names, session ID, score, identity, token, events or admin data are returned. No decision is recorded.- Budgets: 120 requests a minute per client address and 90 a minute per session.
GET /demo-api/live-config returns the demo Site's publishable key, the collector origin for the page and plans (whether Telltale's plans are on, so the page knows whether to mention the trial).