Humans flinch. Agents don't.
Flinch detects AI agents posing as real people inside apps, starting with online games. It reads how a session moves and reacts, and when something seems off, it adds a surprise that only a person handles naturally.
Try the flinch test
Five rounds. Keyboard users can press Space when the dot appears.
| Signal | You | Typical script |
|---|---|---|
| Median reaction | – | 40 ms |
| Reaction variation | – | near 0% |
| Path vs straight line | – | +0% (teleports) |
A toy version of three signals Flinch uses. It runs only in your browser, and nothing is sent anywhere.
AI agents now use software the way people do
They read the screen and drive a normal mouse and keyboard, so anywhere a platform pays for a real person doing something, an agent can fake it. Anti-cheat looks for cheat software on the machine, and web bot tools only verify agents that announce themselves. An agent driving an untouched app slips past both.
- $8.5B a yearActivision's estimate of the game cheat economy, as cheats shift from software to agents.
Source - Coursework, automatedIn February 2026 an agent called Einstein completed Canvas coursework for students until it was shut down.
Source - Banks are blocking themIn October 2026 JPMorgan and Schwab said they block outside agents logging in as customers.
Source
How Flinch works
A risk score, not a ban hammer. Studios see what we found and decide what to do, so no player is ever banned automatically.
Capture
A light SDK records input timing and motion inside the app. Never key values, never what people type.
Score
Each session is scored as human, script or agent, in milliseconds.
Challenge
When risk is high, a surprise moment appears that people react to and agents fumble.
Decide
The studio gets a score with reasons: allow, challenge, restrict or send to review.
What our first tests show
We attack our own detector with a zoo of bots and AI agents. Simple rules already catch the lazy ones. The careful ones are the reason Flinch exists.
| Attacker | Result | What gave it away |
|---|---|---|
| Naive script | Caught | Teleporting clicks and superhuman reactions |
| AI agent, jumping pointer | Caught | No movement before clicks; failed the live challenge |
| Humanized script | Passed as human | Curved paths and random delays fool simple rules |
| AI agent, smooth pointer | Passed as human | The evasive agent is the real target |
An early prototype test using rules only, before any trained model. Next we train on human sessions and report the catch rate at a false-positive rate studios accept.
One detection core, three markets in order
Now
Online games
Agents farm currency and boost ranks. Studios feel the cost, and the data is the richest.
Next
Learning platforms
Agents complete coursework using students' own logins. We start with a Moodle plugin.
Later
Smaller banks
Agent logins, plus a check that the customer actually authorized them.
We classify sessions, not people
Flinch asks one question about a session: is a person or an agent driving it? It builds no profile of who you are, and raw input is discarded after scoring.
False positives hurt real people, including players who use assistive tools. So Flinch flags for review and never punishes on its own.
Running an online game with a bot problem?
Try Flinch in shadow mode: we score your sessions without blocking anything, then show you how much of your traffic looks like hidden agents. I'm also looking for a co-founder with game live-ops or trust-and-safety experience.