We Built a Website That Catches Bots Lying About Who They Are. It Caught One in 30 Minutes.
Launch-night case file from 13 Labs: a scraper posing as a Pixel 6, the Internet Archive in the robots.txt trap, and a stealth browser undone by one impossible number.
CASE FILE OPENED 21 OCTOBER 2026. Novel Cognition's new lab switched its website on that evening, Mountain time. Thirty minutes later the first liar was already in the log, and by the end of the night there were three exhibits worth declassifying.
Exhibit A: the phone that read like a machine
The visitor introduced itself as Chrome on a Pixel 6. Nothing unusual about that string; millions of real phones send it every day. What it did next was unusual. It fired fifteen page requests in a run, and then it requested a path that no human visitor can see and that the site's robots.txt explicitly forbids.
That path is the trap. It exists for one kind of reader only: software that ignores the house rules. A person thumbing through a site on a phone never reaches it, because there is nothing on the screen to tap. The requests came from a server on Google Cloud. That tells you where the scraper was rented, not who rented it, and the lab's file is careful to say exactly that. What the file does say is blunt. The costume said "phone". The behaviour said "machine". Behaviour wins.
Exhibit B: a librarian in the trap
The second catch was no villain. The Internet Archive's crawler walked into the forbidden path as well. The Archive argued in public back in 2017 that robots.txt, a convention written for search engines, fits a web archive badly, so its presence is a difference in philosophy rather than a scandal. It is still a clean demonstration of the lab's founding hunch: you learn more from what a crawler does than from what it claims to be.
Exhibit C: thirty-two gigabytes
The third case is the elegant one. A session arrived through Firecrawl's stealth browser, a tool built to pass as a person's browser. It hid every automation flag the lab's script looks for. By the ordinary tests it was a human reader on an ordinary machine.
Except for one number. Browsers will tell a page roughly how much memory the device has, and this one answered 32 gigabytes. Real Chrome never reports more than 8; the figure is capped on purpose so it can't be used to single people out. A browser that claims 32 is therefore not the browser it says it is. One seam showed, and the disguise came apart at it. The lab filed the session as a hybrid, a machine acting for a person, and stamped it spoofed.
The scoreboard at 8:40 p.m.
Every visit to the site is sorted into human, hybrid, machine or unresolved, and the tallies are published as they accumulate. At 8:40 p.m. MDT on launch night the count stood at 65 machine, 20 human, 8 unresolved and 1 hybrid. Facebook's link previewer led the machines with 20 visits, followed by the Internet Archive and the rule-breaking scraper at 15 each. Googlebot had stopped by three times.
The most interesting number was a zero. Not one assistant agent, the ChatGPT-User or Claude-User kind that fetches a page because a person just asked a question, had arrived yet. The instrument was built ahead of that wave on purpose. You can watch the Signal Room sort visitors in real time, and the raw aggregate sits in a public signals.json file for anyone who wants to check the arithmetic.
Why a lab builds a lie detector
13 Labs is the skunk works of Novel Cognition, the AI strategy and entity-architecture practice founded by Guerin Green. Its job is to prove methods on the live web, cheaply, before any of them reach client work. This experiment carries the codename THE ROOM, and it asks the question most analytics dashboards quietly dodge: who is actually reading the page?
The answer has to come without cookies, without fingerprinting and without publishing a single IP address, and so far it does. The sensor reports whether its script ran and whether a person touched the page. Readers that never run scripts get a one-pixel image instead. Rule-breakers get the trap.
Night one's lesson fits on an index card. A name tag is cheap to fake. Faking every behaviour that goes with the name tag is expensive, and the first mismatch gives the game away. Fifteen requests and a forbidden link. One impossible memory figure. That is all it took.
The rest of the file, the other experiments, and the one that is still blacked out are at the 13 Labs home base. Visit, and the site will tell you what it thinks you are.
