Acted on a moving target's SECONDS-OLD position — a snapshot-then-slowly-reason LLM agent
bh.arena_stale_snapshot · convicts
What it catches
LLM-agent detection — the STALE-SNAPSHOT tell, the one behavioral signal that survives a coherent fingerprint (unlike the automation/CDP tells an LLM agent trips today, which any script also trips). The arena's moving-target gate (arena/track.go) serves a target that moves over time; the client must click its CURRENT position (GET /arena/track/pos re-perceives it — a human tracking it live). An LLM browser agent works from a PAGE SNAPSHOT taken at step start, then REASONS for seconds (an inference round-trip) before acting, so it clicks where the target WAS at snapshot time — a position the target left more than trackStaleAge (1.2s) ago, far from where it is now. The gate emits anomaly:stale_snapshot and the detector's /arena/track/verify relay joins it to ks_sid. FP-SAFE BY CONSTRUCTION: no human acts on a >1.2s-old view — a human (even a slow or distracted one) RE-PERCEIVES the target's current position before clicking, so a human click lands on the current target, never on a seconds-old stale one; the tell fires only when the click is near the stale position AND far from the current one. LLM-SPECIFIC (non-redundant): a fast scripted bot acts before the target moves (also current) and can re-query the live position; only a SNAPSHOT-then-SLOWLY-REASON agent acts on the stale view — the structural signature of an LLM reasoning loop, which survives ghost-cursor input synthesis (that humanizes the MOUSE, not the stale DECISION) and a coherent fingerprint. Convicting (w0.85). GROUNDED (server-side + FP-safety) 2026-07-04: a stale-snapshot client (issue -> wait -> click the issue-time position) trips anomaly:stale_snapshot; a live-tracking client (issue -> GET /pos -> click current) does NOT, and neither does an immediate click. The real claude-agent browser-rendered validation is gated behind a coherent-fingerprint agent (in-sandbox the agent is caught on fingerprint first; see docs/research-radar.md LLM-agent axis). Experimental until validated against the live agent on a rendered target.
Signals it reads
behavioral.arena_stale_snapshot
How it fires
present
Bypassed by 10
Frontier evaders that reach the detector uncaught (scored only suspicious, defeating every convicting tell) — this check is not one that stops them. The red-team frontier this detection still has to convict.