How Antidetect Browsers Get Caught in 2026: The Signals That Give a Profile Away

An antidetect browser sells you one thing: a profile that looks like an ordinary person on an ordinary computer. The companies on the other side sell sites the opposite, and some of them publish how they do it. Fingerprint, Castle and Cloudflare write about their methods, Check Point published a report on antidetect browsers on October 20, 2026, and 2 academic studies measured how well these methods work on real traffic.

This piece puts it together for media buying: what detectors actually check, which part of it you control, and which part you don't. I've used Dolphin, Linken Sphere, AdsPower and Multilogin in my own work; the detection side below is built on what detection companies and researchers publish, all checked on October 23, 2026. For what separates the big antidetects on price and kernel updates, see Antidetect Browsers for Media Buyers 2026: Real Differences.

Is a unique fingerprint what gets you caught?

No. Contradictions do. Fingerprint, a company that sells device identification to sites, put it simply in September 2026: "Spoofing one attribute is easy. Spoofing dozens of them so they all agree with each other is much harder." Its example is a profile that claims to be Safari on macOS "while its rendering output, supported APIs, or font list point to Chromium on Windows."

Detectors ask 2 separate questions. Does the profile contradict itself? And how common is this exact device in real traffic? Fingerprint's documentation describes both: "Statistical anomaly detection, which identifies browser signatures that are unusually rare compared to the overall population," and antidetect detection that "combines heuristic (rule-based) methods with a machine learning model to identify known antidetect browsers." A profile can pass the first test and fail the second. Fingerprint's name for that case is "a device almost nobody owns."

The thresholds are public. Fingerprint treats an anomaly score above 0.5 and an antidetect model score above 0.8 as actionable, and its confidence is high when the rule-based checks and the model fire together. As examples of what this signal targets, the docs name "AdsPower, DolphinAnty, OctoBrowser, and GoLogin." When Fingerprint added the machine learning layer in April 2026, it reported that its antidetect detection coverage grew from 2.1% to 6.4%.

Contradictions also happen over time. In FP-Inconsistent, a study first posted on arXiv in June 2024 and revised in September 2025, researchers set up a test site behind 2 anti-bot services, DataDome and BotD, and ordered traffic from 20 bot services that sell "realistic and undetectable traffic." The bots got past DataDome 52.93% of the time and past BotD 44.56% of the time. Then the researchers wrote rules that look for inconsistencies "across space (two attributes in a given browser fingerprint) and time (a single attribute at two different points in time)," and those rules cut the evasion rate by 48.11% and 44.95%. These were bot services, not antidetect users, but the lesson carries over: a profile whose parameters change between visits contradicts itself too.

How does the engine give you away?

Every profile tells the site which browser it is. The user agent and Client Hints say, for example, Chrome 156 on Windows. A detector doesn't have to take that on trust. Each Chrome version on each operating system supports a known set of features, so the detector can check what the browser actually does.

Castle showed how simple that can be. In May 2025 Antoine Vastel of Castle, a bot detection company, took apart Hidemium, an antidetect that runs part of its spoofing as a script injected by its own built-in extension. Even on a profile set to match the real machine, Chrome on macOS, that script deleted APIs that real Chrome on macOS has, such as BarcodeDetector and navigator.share. BarcodeDetector "is expected to be available starting in Chrome 88 on macOS," Vastel wrote, so "if a browser says it's Chrome 134 on macOS, but BarcodeDetector is missing, that's a sign that something is off." His advice to defenders is to check "whether important browser features match what we expect for a given browser, version, and operating system" instead of chasing one tool's bugs.

Browser Polygraph did this at scale. The study, presented at the IMC 2024 conference and run on a real financial company's traffic, used 513 JavaScript feature tests and grouped browser versions into clusters by how they answer them. If a session's user agent claims one version and its features match another cluster, it gets flagged. The authors also sorted the antidetects of the time by how they lie. Linken Sphere 8.93, a 2022 version, showed fingerprints that didn't match any real browser. GoLogin, Incogniton, Octo Browser and others kept a real browser's fingerprint, but "the fingerprint does not change when modifying the user-agent string." Change the version in the profile, and the engine underneath still answers as the old one.

The results on real traffic:

• Octo Browser 1.10: 84%
• Incogniton 3.2: 78%
• GoLogin 3.3: 75%
• Sphere 1.3, an old free version with profiles as old as Chrome 61: 67%

Deployed at the company for 4.5 months in 2023, Polygraph flagged 897 of more than 205,000 logged-in sessions. Of those, 2% were used for account takeover within 72 hours, against 0.43% across all sessions. All the antidetect versions above have long been replaced, so read this as a method, not a verdict on today's Octo Browser or GoLogin.

One type was left out on purpose. AdsPower 4.12 and 5.4 switched to the matching browser engine with each user agent you picked. The authors say browsers like that "aim to approximate recreating a user's entire browser environment" and need more sophisticated detection, so Polygraph didn't target them. That isn't a pass: Fingerprint names AdsPower among the antidetects its signal is built for.

And the detector itself goes stale. Polygraph's model placed new Chrome, Firefox and Edge releases correctly for about 3.5 months. In late October 2023, Firefox 119 and Chrome 119 started drifting out of their clusters, and the model needed retraining. Since September 2026 Chrome ships a new version every 2 weeks, so both sides now race the same calendar. A kernel that falls behind ends up either claiming a version it can't back up or showing a version real Chrome users left weeks ago. Our comparison of the big 5 shows how fast each vendor follows Chrome.

What to do with it. The fewer things a profile fakes, the fewer contradictions it can have. Where you can, claim the operating system and browser family your machine really runs; even Hidemium, per Castle, "explicitly warns users against misrepresenting their true OS." Keep the version in the profile equal to the kernel, and keep the kernel current.

Can detectors see fingerprint noise?

Yes, if they look for it. Noise is how many antidetects make canvas, WebGL and audio output unique per profile: they change the result slightly so the hash differs. Sebastian Wallin of Castle wrote in February 2025 that "There are no silver bullets to detect if a canvas has been artificially modified," and then described 2 ways to do it anyway. The first is a proof of work: make the browser draw something with known colors and check specific pixels. Fill a canvas with 1 exact color, and noise shows up as pixels that are off. The second looks for overridden canvas functions through side effects such as error stack traces. With it, Castle could even name the browser extension that changed the canvas.

Engine-level noise doesn't escape the first method. When the noise is added inside the engine, there's no overridden function to find. Castle's answer, from the Hidemium piece: changes "deep in the browser engine" don't show up in simple API checks, so "you need to run JavaScript challenges that test how the browser behaves when rendering canvas, audio, or WebGL content."

A real case from this week. On October 22, 2026, users testing the first Chromium 156 build of ShardBrowser, a free antidetect from the proxy seller ProxyShard, reported on GitHub that its audio noise "alters an AudioBuffer the page filled: detectable in one read." Another user reported that a public checker flagged "inconsistent browser fingerprint" on every profile with noise turned off. New engine, new noise code, and the first outside test found a trace. The team had fixed earlier reports on canvas, WebGL and fonts in later releases; details are in our ShardBrowser review.

Vendors know where the pressure is. In September 2026 Linken Sphere announced a third-generation canvas that, in its words, makes "a fingerprint unique without altering the source data." It doesn't explain the method, but the wording targets exactly the pixel checks above.

What to do with it. Don't stack a canvas or fingerprint extension on top of an antidetect: extensions are what Castle's stack trace check names. Use the browser's own settings, and run a profile through a checker again after every kernel update, because the noise code changes with the engine.

What gives away automation?

The control channel. When you connect Puppeteer or Playwright to a profile through your antidetect's API, they drive Chromium through the Chrome DevTools Protocol (CDP). Fingerprint has a separate signal for this: it detects "whether a Chrome instance is being controlled via an active Chrome DevTools Protocol session." It's also part of Fingerprint's example of how signals add up: "a rare browser signature, a VPN timezone mismatch, and a DevTools-controlled session is far more suspect than any one of those alone."

One classic check died, the others didn't. For years the standard way to catch CDP was a trick that fired when DevTools read an error object. Castle's Vastel wrote in August 2025 that it stopped working after 2 changes to Chrome's V8 engine on May 7 and May 9, 2025. Castle says it still catches CDP automation "using other JavaScript signals that leak in certain setups" and relies on a mix: mouse movement, scrolling and typing, checks for virtual machines, headless browsers and fake hardware, proxy and network detection, and "time series analysis to catch large-scale bot activity." Fingerprint also flags browsers running inside virtual machines such as VirtualBox.

Behavior is the layer no kernel patch covers. 20 profiles that log in within the same minute and do the same things in the same order look like a script whatever their fingerprints say. A synchronizer that repeats 1 window's actions in 10 others produces exactly the kind of pattern time series analysis is built for. Use automation for routine steps, spread the timing, and keep your most expensive accounts on manual work.

What does your network say about you?

Your proxy sits under every profile. Fingerprint's VPN detection compares the time zone from the system settings with the location of the IP. It works at country level: the flag "will be true even if a visitor in Prague uses a Berlin VPN server, despite both countries being in the same GMT+2 UTC offset." A second check compares the network signature of the request with the operating system the browser reports.

The IP has a memory. Fingerprint raises the time zone flag when "at least 50% of requests from the same IP in the last 7 days" show a mismatch, and the OS flag at 10%. So a shared proxy brings other people's mistakes into your profile. The Polygraph data shows the same link from the other side: 78% of the sessions it flagged came from IPs the financial company didn't recognize, against 51% across all users.

TLS comes from the engine, not the settings. Before a page even loads, the browser sends a TLS handshake that identifies the client. Cloudflare's JA4 fingerprint is "resistant to the randomization of TLS extensions" that Chrome introduced in 2023, and Cloudflare says it analyzes "over 15 million unique JA4 fingerprints generated from more than 500 million user agents" every day. The handshake is built by the browser's network code, so a profile that claims Safari while running on Chromium still sends a Chromium handshake, unless the vendor patches the network stack too. ShardBrowser, for example, claims its handshake matches Chrome 156.

Security researchers now point platforms at this layer. Check Point's October 20, 2026 report says "The detection priority should shift from the account and behavioral layer, where these tools are already designed to appear invisible, to the network and infrastructure layer." Its list of indicators: "residential proxy infrastructure operating at scale, WebRTC suppression patterns, anomalous cookie injection sequences, and known antidetect browser user agent strings in web traffic logs." Note the second one: WebRTC switched off entirely is a pattern too, not just a leaked IP.

What do platforms add on top?

They're being told to treat antidetects as fraud infrastructure. Check Point's report covers Kameleo, AdsPower and Multilogin, picked because of references on underground forums, and describes their use in account takeover, carding and influence operations. It recommends that platforms "consider actively acquiring and reverse engineering antidetect tools to map their proxy patterns, fingerprint rotation behaviors, and detection bypass mechanisms." On warming it says account warming patterns "may be indistinguishable from legitimate organic behavior without cross-referencing device fingerprint consistency over time." For a media buyer that means 2 things: the tools you use are on the platforms' research list, and the check that matters is whether your account looks like the same device week after week.

The rules don't depend on your fingerprint. Google's circumventing systems policy says "you can't create multiple Google Ads accounts after getting suspended to try to get around Google Ads' policies," that Google "may review information from multiple sources including your ad, website, accounts, and third-party sources," and that suspension "occurs upon detection and without prior warning." TikTok's Advertiser Account Policy says: "We do not allow advertisers to circumvent, evade, or interfere with our advertising systems and processes," and its enforcement can go as far as "permanent suspension from all Bytedance platforms." Meta's terms say: "Create only one account (your own) and use it for personal purposes."

So the browser is only 1 of the links. Payment methods, business documents, domains and creatives connect accounts no matter which profile they run in. An antidetect keeps the accounts you run for clients and team members apart. It doesn't turn a banned advertiser into a new one, and the platforms don't read it that way.

What does this mean for your setup?

Consistency beats uniqueness. A profile that looks like a common device and stays the same from visit to visit is safer than a perfectly randomized one. Don't regenerate the fingerprint of a profile that already runs an account: that's the change over time that FP-Inconsistent's rules and Check Point's advice are built to catch.

Fake as little as you can. Every claimed parameter that differs from the real machine is 1 more thing that has to agree with everything else. The profile's version should match the kernel, and the kernel should be no more than 1 or 2 Chrome versions behind.

Treat the proxy as part of the fingerprint. Match the IP's country with the profile's time zone and language, keep 1 sticky IP per profile, and avoid cheap shared pools whose IPs carry other people's history.

Read checkers for what they are. A public fingerprint checker sees what a page can see from 1 visit. It doesn't see the IP's 7-day history, how your profile looked last week, or how your 20 profiles behave together, and those are exactly the signals detection companies say they correlate. A clean result is a minimum, not a pass.