Why websites blocked the KISS browser, and what changed

Task history analysed from ~/.kiss/sorcar.db (8.4 million events, 24,146 tasks). Work done 20 September 2026 on the GCP host koushik-sorcar.

The browser tool that KISS agents use to read web pages was being turned away by a growing number of sites. This report explains which sites did it and why, what was changed so the browser is treated like a person's Chrome, the measured effect, and what is deliberately not done.

1. What the task history shows

Every result the browser tools (go_to_url, click, get_page_content) returned was scanned for the signatures of bot-protection pages. 95 distinct hosts served one. Grouped by the vendor behind the page:

Two things stand out. First, Cloudflare accounts for most of the hosts, and most of those are the silent managed challenge: a page that checks the browser with JavaScript and reloads the real content on its own when the browser looks like a person's. Second, Google is different in kind: its page says so itself, "if a network you use … seems to be sending automated traffic", and Google Cloud address space is such a network.

2. Why the browser stood out

The old configuration launched the open-source Chromium build through Playwright in headless mode, with a hard-coded Los Angeles timezone, a Retina scale factor of 2 on a Linux server, a JavaScript override of navigator.userAgent, and clicks that teleported the pointer onto the target. Each of these is visible to a page, and detection vendors score them in layers:

The single most important finding came late. On an X server without a GPU, Chromium puts its graphics stack on a blocklist and ships no WebGL at all. Practically every human browser has WebGL, and challenge scripts test for it first. With the browser otherwise fixed, six publisher sites (ACM, Science, ScienceDirect, Sage, cppreference, ResearchGate) still showed Cloudflare's "Verify you are human" checkbox, and pressing it was accepted by the widget but rejected by the verdict every time. One flag, --ignore-gpu-blocklist, lets Chromium render WebGL through Mesa's software renderer, which reports itself as ANGLE (Mesa, llvmpipe …), exactly what a Linux desktop without a GPU reports. After that, all six cleared.

3. Measured effect

Fourteen URLs from the blocked list were used as a development set during the work. A second set of fourteen hosts from the same list, never probed during development, served as a held-out check. All runs used fresh browser profiles from the same GCP machine.

The intermediate row "10 / 14 (Turnstile rejected)" is worth a sentence: it was lower than the row above only because the six publisher sites were now reached far enough to show the checkbox, and the checkbox verdict failed on the missing WebGL. That is what pointed to the graphics blocklist.

4. What changed in the code

New module src/kiss/agents/sorcar/web_stealth.py

• playwright_api(), playwright_package(): use Patchright's sync API when installed, stock Playwright otherwise. Patchright 1.63.0 was added to pyproject.toml.
• chrome_channel(): launch Google Chrome when it is installed, the bundled Chromium otherwise.
• virtual_display(), stop_virtual_display(): one Xvfb per process, started with -displayfd so it picks a free display number, wrapped in a tiny shell loop that kills Xvfb within two seconds if the Python process dies without running atexit. Falls back to real headless mode on macOS, Windows, or Linux without Xvfb.
• mouse_path(): cubic Bezier pointer path with ease-out and sub-pixel jitter. typing_chunks(): per-word typing speed with a longer pause at each space.
• challenge_vendor(): recognises an interstitial by its exact title ("Just a moment…", "Access Denied", "Robot or human?") or by two co-occurring body phrases ("Sorry, you have been blocked" plus "Ray ID"), so an article that merely mentions CAPTCHAs is not mistaken for a block.
• search_fallback_url(): turns a Google search or /sorry/index?continue=… URL into the same query on Bing, which served 72 of 73 searches in the task history (DuckDuckGo was flagged on 37 of 63).

Changes in src/kiss/agents/sorcar/web_use_tool.py

• "No window" (headless=True, still the default) now means a headed Chromium on the virtual display when one is available. Callers, show_browser(), screenshots and the persistent profile behave as before.
• Launch arguments: removed --disable-features=IsolateOrigins,site-per-process; added --window-size and --ignore-gpu-blocklist. Context options: no more locale, timezone_id, device_scale_factor=2; no_viewport when headed.
• Clicks and hovers glide the pointer along a curve to a random point near the element's middle, pause, then press for 45–140 ms. Playwright's own actionability checks still apply, and a point that cannot receive events within five seconds falls back to the previous centre click.
• Typing runs at an uneven cadence and pauses before Enter; scrolling wheels in uneven notches from a random mid-page point.
• go_to_url reads the cf-mitigated: challenge response header and the page, waits up to 12 s for a challenge to clear while the pointer drifts, ticks Cloudflare's single "Verify you are human" box if it appears, and otherwise prefixes the result with a one-line Note: naming the vendor and suggesting show_browser() or another source.

Note: www.science.org answered with a bot-protection page (Cloudflare challenge) that did not
clear within 12s. Call show_browser() so the user can complete the check, or use another source
for the same information.

Note: Google answered with its 'unusual traffic' page. It rates this network's IP address as
automated traffic, which no browser setting changes, so the same query was opened on Bing instead.

Tests

src/kiss/tests/agents/sorcar/test_web_stealth.py holds 24 end-to-end tests that drive a real Chromium against a local HTTP server: engine and display selection (including reading DISPLAY from the browser's /proc/<pid>/environ), fingerprint properties, the curved click path and held button, typing cadence, wheel notches, all fallback paths, Cloudflare-style challenges that clear and that do not, a routed Turnstile widget, vendor recognition with benign-text negatives, the Google-to-Bing mapping, Xvfb restart hygiene (descriptor count and atexit callbacks constant; descriptor exhaustion handled), and a live load of journals.sagepub.com. web_stealth.py has 100 % branch coverage; the 254 existing tests that touch the browser tool still pass.

5. What is deliberately not done

6. Things to know when running it

• Linux needs the Xvfb binary (Debian package xvfb) and Mesa (libgl1-mesa-dri) for the headed mode with WebGL; both are present on this host. Without Xvfb the tool logs a warning and runs headless as before.
• On first use Patchright downloads its own Chromium build (about 115 MB) into ~/.cache/ms-playwright; the tool does this automatically, as it did for Playwright.
• Patchright evaluates JavaScript in an isolated world by default; code that needs the page's own globals must pass isolated_context=False. Console events do not fire under Patchright; the tool never relied on them.
• The machine's timezone is UTC. That is now what the browser reports too; a person's laptop would report a local zone. If this matters for a site, set the system timezone rather than reintroducing a browser override.

Sources consulted

• Patchright, patched Playwright driver: github.com/Kaliiiiiiiiii-Vinyzu/patchright-python, known bugs (issue #30), PyPI.
• Browser automation bypass benchmark: github.com/techinz/browsers-benchmark.
• Cloudflare docs: bot scores, JavaScript detections, detecting a challenge page response.
• Google Search Help: "Unusual traffic from your computer network".
• HumanCursor (algorithm reference for pointer paths): github.com/riflosnake/HumanCursor.