Large language models can now operate a web browser and carry out multi-step shopping tasks. Does such an agent leave a behavioral signature in a session that separates it from a person, even when it drives a real browser and presents an ordinary client fingerprint? We study the question at the session level. We first show that weak per-action evidence aggregates into a session-level distinction whose error decays exponentially in the number of actions. We then define six families of behavioral signals, each grounded in a documented difference between goal-directed automation and human browsing, and combine them in a classifier we call HABITS (Human–Agent Behavioral Invariants from Traffic at Session-level). Labeled agent sessions are scarce, so we describe a simulation methodology for driving language models through shopping tasks and instantiate it on public data with realism-controlled planner agents. We evaluate on five public benchmarks spanning e-commerce clickstreams, web-task demonstrations, and mouse dynamics, reimplementing prior methods on the identical corpus. Against agents that imitate human timing, timing-only classifiers fall to 0.35 recall at a 1% false-positive rate and to 0.01 -0.02 when timing is fully matched, while HABITS reaches 0.96 on the clickstream corpus. Paired tests separate HABITS from every restricted-view baseline, and equivalence tests show that strong classifiers given the same features are interchangeable, which places the contribution in the behavioral view rather than the estimator. A check against real agent trajectories supports the structural assumption our simulator relies on and finds one realism parameter set too favorably.