Can CPU Concurrency Be Used to Bypass Bot Detection?

Yes, CPU concurrency can be used to bypass bot detection—but only if the detection system depends on concurrency as the sole or primary signal. Attackers can manipulate the reported concurrency value (the number of CPU cores a browser claims) to match a typical human device, making a bot appear legitimate. However, this trick fails against modern detection that cross-references concurrency with dozens of other independent checks, such as GPU fingerprinting, behavior patterns, and network anomalies.

Here's the key distinction: concurrency is a weak, spoofable metric on its own. It only becomes useful when combined with other signals. BotRefund, for example, treats CPU concurrency as one of 106 independent checks and feeds it into an AI model that evaluates the complete pattern of a visit. A mismatch in concurrency alone won't trigger a verdict; only corroborated inconsistencies would.

How CPU Concurrency Is Used in Bot Detection

CPU concurrency refers to the number of logical processors a browser reports via JavaScript (e.g., navigator.hardwareConcurrency). Legitimate users typically have a stable value that matches their device—4, 8, 16, etc. Detection systems may check whether this reported value is realistic, whether it changes mid-session, or whether it aligns with other hardware fingerprints.

Attackers bypass this by overriding the property using browser automation tools or extensions. For instance, a bot running in a virtual machine with 2 cores can report 8 cores, and a spoofed user agent can claim an iPhone while the concurrency reads 16. But as BotRefund's documentation explains, “A normal browser reports hardware, graphics, fonts, and operating-system details that naturally fit together for that device.” A concurrency mismatch often reveals that these details don't align.

Why Concurrency Alone Is a Weak Signal

Concurrency is easy to spoof because it's a single numeric value. It doesn't reflect real behavior or the physical environment. A genuine user on a corporate virtual desktop might have unusual concurrency due to IT policies. A privacy-conscious user might use a browser extension that changes it. So a strict concurrency threshold would produce false positives.

BotRefund explicitly warns: “A single anomaly is not a bot verdict. Privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for genuine people.” This is why they keep concurrency “as evidence—not a verdict” and cross-check it against independent browser, network, device, and behavior data.

How Attackers Spoof CPU Concurrency: A Hypothetical Scenario

Imagine a bot operator targeting a high-value ad campaign. The bot uses a headless browser like Puppeteer or Playwright. By default, navigator.hardwareConcurrency might return a server's core count, like 32. The detection script sees that and flags it as a bot because a typical visitor has 4 or 8 cores.

To bypass, the attacker injects a JavaScript override:

Object.defineProperty(navigator, 'hardwareConcurrency', { get: () => 8 });

Now the bot reports 8 cores. It also spoofs the user agent, screen resolution, and GPU vendor strings. The concurrency check passes, and the bot looks human—at least on that single test. If the site's only bot filter is this concurrency check, the bot gets through. But if the site uses a system like BotRefund, it will also examine click behavior, pointer paths, session duration, and network ports. The concurrency spoof is just one piece of a puzzle that still shows other mismatches.

What Modern Detection Does Instead: Cross-Checking and AI

Modern anti-bot systems don't trust any single signal. Instead, they build a profile from dozens of independent facts. BotRefund uses “106 independent checks” to create a reliable picture. These include behavioral signals like mouse tremor, impossible tab speed, and ghost click detection, as well as hardware and network checks like CPU concurrency and suspicious ports.

The critical step is corroboration. BotRefund explains: “Accuracy comes from corroboration, not one browser tell.” Each signal is independent evidence. The AI model weighs the complete pattern—if concurrency says one thing but the GPU fingerprint, fonts, and click patterns say another, the system flags the visit as suspicious. This makes it much harder for an attacker to pass because they'd have to spoof every signal consistently, not just one.

Key Facts from BotRefund's Approach

Limitations of Concurrency-Based Detection and When It Fails

Concurrency-based detection fails in two common situations. First, when it's used as a standalone rule—attackers can trivially override the value. Second, when it's used with rigid thresholds, it causes false positives for legitimate users with unusual setups. For example, a developer running a browser inside a virtual machine might have a concurrency mismatch even though they're a real person.

BotRefund's approach avoids these pitfalls by never treating concurrency as a verdict. It only becomes meaningful when multiple independent signals disagree. As they state, “BotRefund keeps this signal as evidence—not a verdict—and cross-checks it against independent browser, network, device, and behavior data.” This is why bypass attempts that only spoof concurrency fail.

Practical Steps to Protect Your Site

If you rely on a simple concurrency check, upgrade to a solution that correlates multiple signals. Look for:

• Behavioral analysis (mouse paths, click timing, scroll patterns)
• Network signal checks (proxy, VPN, suspicious ports)
• Hardware and GPU fingerprinting
• AI-based pattern recognition

BotRefund offers a free bot audit that evaluates your site against these checks. Their system is designed to catch spoofed concurrency and other evasion tactics. “Add free bot protection to your website,” as their page suggests, is a practical first step.

Frequently Asked Questions

Can a bot spoof CPU concurrency on a real browser?

Yes, any browser automation tool can override navigator.hardwareConcurrency. Even a regular browser extension can change it. But if the site uses multiple checks, the spoof becomes one untrustworthy signal among many.

Does CPU concurrency affect ad fraud?

Ad fraud bots often run in virtualized environments with many cores. Without spoofing, they'd be easy to catch. By faking concurrency, they can slip past naive detection and click on ads. BotRefund's case study with FinTrust shows a $140,000 refund driven by catching such bots.

What other signals do bots usually spoof?

Bots commonly spoof user agent, screen size, GPU vendor, and now concurrency. But they rarely get all behavioral and network signals right—like humanlike mouse tremor or residential proxy timing.

How accurate is BotRefund at detecting concurrency spoofs?

BotRefund claims 99% accuracy overall, based on corroboration rather than any single check. Their system processes 106 independent signals through AI.

Is concurrency check harmful to legitimate users?

It can cause false positives if used alone. That's why BotRefund stresses that a single anomaly should not be a bot verdict. Their approach tolerates genuine users with unusual hardware or privacy add-ons.