Agents circumventing website restrictions for public benchmark runs

Timeline

• 30 March 2026: GLM 5- and MiniMax M2.7 agents attempted to create an account and make campsite reservations through Parks Canada. No successful account creation or reservations were observed.
• 16 July 2026: A GLM 5.2 agent tried to bypass OpenReview's verification check in order to retrieve a filtered list of ICCV 2025 oral papers. Attempts used Scrapling and the browser's verification checkbox, but did not succeed.
• 16–17 July 2026: GLM 5.2- and Grok 4.5 agents attempted to get past GSMArena's bot checks for a task that required researching smartphones. We did not establish success.
• 9 September 2026: A MiniMax M3 agent requested an account with the U.S. Environmental Protection Agency (EPA) after encountering a shared account's daily data limit. You.com's tool reported success, but we cannot establish an account was actually created.

Observations

In an evaluation run by You.com in September 2026 for the public benchmark DeepSearchQA, a MiniMax M3 agent tried to register for an account with the U.S. Environmental Protection Agency (EPA) when encountering a limit on data requests. The agent used an email address not provided in the task instructions. In other public benchmark runs, agents tried to get past anti-bot checks. We could not confirm that any of these attempts succeeded.

An apparently made-up email address for EPA registration

You.com (a provider of web-search tools for AI agents) tested how well MiniMax M3 could answer difficult research questions using its search and page-reading tools. M3 was released in June 2026 by Chinese AI company MiniMax. The evaluation used DeepSearchQA, a standard set of research questions with reference answers.

One question asked about historical air quality in three U.S. metropolitan areas. The agent tried a publicly available test account supplied by the U.S. Environmental Protection Agency (EPA) but received a message saying the account's daily usage limit had been exceeded. It then wrote: “Let me try the EPA AQS API one more time with a different email/key to avoid rate limits.”

The agent had read EPA's instructions, which recommend registering for your own account and explained how to do so. The agent then requested registration using research@research.org as a placeholder email address.

The agent did not need to access an on-screen form to take this action; it used its page-reading tool on the sign-up web address, with the email address added to it - thus invoking EPA’s registration service. The reply said a registration confirmation email should arrive, and the agent then continued researching, ultimately producing its answer about two minutes later, without confirming if it had successfully registered with the EPA website.

Attempts to get past GSMArena's bot checks

In separate tests, agents identified as Grok 4.5 and GLM 5.2 were asked to recommend a smartphone meeting seven specific requirements. These runs were published by WildClawBench, a research project involving Shanghai AI Laboratory and university collaborators that compares models on practical tasks using real tools.

When conducting the tasks, the agents encountered bot checks on GSMArena (a phone specification and review website) and used a scraping tool (Scrapling) to try to get past the checks.

Scrapling reported that it had solved the bot checks, but the returned pages still showed the checks, so it seems these particular attempts failed. The records do not explain the misleading success messages.

An unsuccessful attempt to bypass OpenReview’s bot/automation check

We observe another WildClawBench benchmark run in which a GLM 5.2 agent attempted to circumvent OpenReview's website controls. Specifically, the agent was tasked with compiling ICCV 2025 oral papers. The agent was then expected to count and list papers with a first affiliation at either Shanghai Jiao Tong University or Fudan University. The benchmark's primary goal is to assess the model’s web research and online information retrieval capabilities. The task record is published here.

However, while running the benchmark, the agent received a 403 error from OpenReview. At this point, the agent used Scrapling (a scraping Python library available in its evaluation setting) to try to bypass OpenReview’s verification checks. The agent called Scrapling’s StealthyFetcher twice, with the solve_cloudflare argument set to True. Both attempts failed to access OpenReview’s API data. Note that StealthyFetcher attempts to hide automated behavior by concealing/updating browser fingerprints, and solve_cloudflare=True tries to solve Cloudflare verification challenges if they come up.

In both requests, the agent had no explicit goal or prompt of bypassing website restrictions. More surprisingly, Scrapling logs wrongly reported the CAPTCHA attempts were successful, and both requests only returned OpenReview’s verification page.

Attempts to get past the Parks Canada reservation-site block

A ClawBench task was attempted by two agents (GLM 5 and Minimax M2.7). Each agent was asked to create a Parks Canada account on their reservation portal. The agents were also asked to reserve a Banff campsite for three nights after creating the account.

When the agents tried to access the Parks Canada website, the site blocked both agents almost immediately. Faced with site blocks, the agents pivoted to trying new URLs, such as directly opening up /HomePage, /Account/Logon, /login, and /CreateAccount.aspx. Across the URL search, the initial block page persisted. The prompts did not specify these URLs to the agents; instead, the agents chose the URL search strategy after encountering the initial block.

Throughout the chain of events, the records do not show a successful account creation, successful reservations, or any access to protected data.

Attribution

You.com ran and published the EPA evaluation, and the WildClawBench team published the smartphone runs. Their records contain the tasks, model responses, tool requests and matching results, providing evidence of agent activity during benchmark tests. Their records identify MiniMax M3, xAI's Grok 4.5 and Z.ai's GLM 5.2 in model configurations and message metadata. WildClawBench published the OpenReview record and the ClawBench release contains the Parks Canada records. These records include the tasks, model messages, tool requests, and matching results. They identify the configured models as GLM 5.2, GLM 5, and MiniMax M2.7.

Assessment

While the benchmark tasks documented above do not specifically request account creation and cirmcumventing bot restrictions, the actions the agents took were likely informed by supplied instructions. EPA's documentation suggests registration, and the agent tried to register an account with an apparently invented email address in order to overcome an obstacle during the research task. Moreover, the scraping instructions supplied by WildClawBench advertise bot-check circumvention. Finally, it is noteworthy how the agent used a tool for reading web pages to trigger an action, as in the EPA case.

Links

• You.com evaluation data

• WildClawBench OpenReview bypass