AI Agents That Don't Identify Themselves: What Logs Miss

PSentry cannot tell you which AI agent read your website yesterday. It measures what four assistants say when someone asks them a question, not who fetched which page, and nothing in this article changes that. Server logs look like the obvious place to fill the gap, and for AI agents they are only a partial answer: an agent that does not identify itself leaves a log line with the same shape as a person sitting at a browser.

Our earlier piece on what an AI crawler looks like in your server logs dealt with the bots that announce themselves. This one deals with the rest: what a log can prove about AI agents, what it cannot, and why the boundary between the two moved during 2025.

A log line records a claim, not an identity

An access log stores what the client chose to send. In the combined format that Apache and nginx use by default, that means the IP address, the time, the request line, the status code, the size of the response, the referrer and the user agent string. Nothing else.

The user agent is a sentence the visitor writes about itself. GPTBot in that field means the client said it was GPTBot. When Cloudflare proposed a cryptographic alternative in May 2025, its own explanation started from exactly this point: the user agent header is easy to spoof, so on its own it cannot identify anyone reliably.

The IP address is harder to fake inside a working connection, but it tells you who owns the network, not who sent the request. OpenAI and Google publish the address ranges of their declared crawlers, so a request that says GPTBot and arrives from an OpenAI range is very probably GPTBot. A request that says Chrome on a Mac and arrives from a cloud provider is nothing in particular. It could be a person on a VPN, an uptime monitor, a scraper or an AI agent. The log does not know, and no amount of filtering will make it know.

So every reading of a log has two layers: what the visitor claims, and what you can confirm. The second layer is much thinner than most dashboards suggest.

Three ways an AI visit reaches your server

An AI agent, in this article, is software that browses on a person's behalf: it opens pages, reads them and sometimes clicks or fills in forms, to complete a task someone gave it. It is one of three kinds of AI traffic, and each leaves a different trace.

• The declared crawler. GPTBot, ClaudeBot, OAI-SearchBot, Claude-SearchBot. Fixed names, published documentation, verifiable addresses. They collect pages for training or for a search index, on their own schedule.
• The user-triggered fetcher. ChatGPT-User and Claude-User. Also declared, but they arrive because someone asked a question at that moment and the assistant went to read a page. Cloudflare's public bot directory files both under its Agent category, separate from Search and Training.
• The agent with its own browser. A task such as "compare three suppliers of stainless steel valves and request a quote from the cheapest" is carried out by an agent driving a complete browser, usually on a remote machine. To your server it looks like a browser, because it is one. It runs JavaScript, loads images and stylesheets, and keeps cookies within a session.

The first two kinds can be counted with reasonable confidence. The third is the one this article is about. Nothing obliges it to put the name of an AI service in its user agent, and a remote browser that behaves like a browser produces log lines that look like a human visit.

What signed agents change, and what they leave out

The industry's answer is to make identity cryptographic instead of declarative. Web Bot Auth, which Cloudflare proposed on 15 May 2025, builds on the HTTP Message Signatures standard (RFC 9421). The agent signs each request with a private key, a Signature-Agent header tells the website where the operator publishes its public keys, and the website can check the signature against them. A signature cannot be copied from one request to another the way a user agent string can.

On 28 August 2025 Cloudflare introduced a category of signed agents, and ChatGPT agent was in the first group it classified that way. Cloudflare's developer documentation states that since 1 July 2026 signed agents sit inside the verified bots programme with an extra field: direct access for bots run by a single operator, intermediary for agentic services that many end users can drive. The documentation is explicit that you may trust the intermediary without trusting every user behind it.

That is real progress, and it has three limits worth knowing before you rely on it.

• Your log probably does not keep the header. The default combined format has no field for Signature-Agent or Signature. If they are not logged, the evidence is discarded on arrival.
• Signing is voluntary. An agent that signs can be identified. An agent that does not sign still looks like a browser, and the log cannot tell you which of the two you are reading.
• A signature names the platform, not the purpose. It tells you the request came through a given agent service. It does not tell you who gave the instruction or what the visit was for.

The Perplexity case, and only what the sources say

The clearest public example of how hard attribution is came on 4 August 2025. Cloudflare published a post stating that, after test sites blocked PerplexityBot and Perplexity-User, it observed requests from an undeclared crawler presenting itself as Chrome on macOS, from IP addresses outside Perplexity's published ranges. In the same post Cloudflare wrote that it had de-listed Perplexity as a verified bot. It also reported that in the same test ChatGPT-User fetched the robots.txt file and stopped when it was disallowed.

Perplexity replied publicly and disputed the account. It argued that an assistant fetching a page because a user asked is not a crawler, and that Cloudflare had attributed to it traffic from a third-party cloud browser service. As of 20 October 2026 neither PerplexityBot nor Perplexity-User appears in Cloudflare's public bot directory.

We have no data to settle the dispute, and this article does not try. The lesson for anyone reading their own logs is narrower. Two companies with far more traffic data than a single website disagreed in public about whose requests those were. If they could not agree, a line in your access log that says Chrome and comes from a data centre will not settle the question either. Attributing unsigned, browser-like traffic is a judgement, not a measurement.

What your logs can still tell you

None of this makes logs useless. It makes them precise about a smaller thing. Four checks keep the reading honest.

• Count only verified bots as bots. Match declared user agents against the published ranges or a reverse DNS check, and report the unverified ones in a separate line instead of adding them in.
• Start logging signatures. In nginx any request header is available as a variable, so $http_signature_agent can be added to a custom log_format. From that day on, signed agents become countable on your own server.
• Label the grey zone as unknown. Browser-like requests from cloud ranges that read one page and leave are a category, not an identity. Calling them AI agents is a guess, and so is calling them people.
• Keep visits and visibility apart. An assistant can answer a question about your products from its index or from a search provider without fetching your site at that moment. A quiet log does not mean an assistant never mentions you, and a busy one does not mean it does.

The last point is where the two measurements meet. Logs record who came to read. They say nothing about what an assistant then told the buyer, in which language, and whether your name was in it. That second question is what PSentry measures: the answers ChatGPT, Claude, Gemini and Perplexity give to the questions your buyers ask, twice a month, per language and market. It does not see visits. Your logs do not see answers. Neither replaces the other, and a site that blocks or welcomes AI traffic through robots.txt should know that only declared bots read that file, as our piece on AI crawlers and llms.txt explains.