How Far Does Per-Screen Timing Separate Screen-Reading AI Agents from Practiced Humans? Effectiveness and Limits of Endpoint Time-Based Detection

A screen-reading AI agent that operates a PC through the analog hole (HDMI capture of the display and USB-HID injection of keyboard and mouse) leaves no software or network trace. What remains for a defender is behaviour at the display–HID boundary, and almost all of it is the attacker's to shape: device identity, display identity, and mouse and keystroke dynamics are produced by firmware and software the attacker owns and can be made human-like at a one-time cost. One behaviour is harder to script: in a sequential loop the agent must wait for the model to finish the inference that decides each input, so its response carries a delay tied to the model rather than to the injector. We ask how far that timing separates such agents from practiced humans, and find that whether it does depends on the dwell-time definition and the execution conditions. Replaying identical screens, practiced humans decide in 1.00 s under the D1 dwell definition where Claude Sonnet takes 2.64 s (slower on 85% of screens) and Kimi-k2.7-code with extended thinking 5.62 s (95%), a 2–3× and 5× per-person gap (4 annotators, replayed screens, software input). Removing the ~0.9 s difference between Sonnet's full and stripped context leaves it slower on 67% of screens under D1, but under a looser dwell definition (D3) the median ordering reverses (48%): whether a gap appears at all is definition- and condition-dependent. The dispersion of decision latency (rhythm) does not separate practiced humans from the agents on its own (3 of 13 overlap), though it adds detection at a false-alarm cost. Its level does: agents at ~5 s per screen are reliably detected, while the fastest completing agent (~2.5 s) sits at the detection boundary (0–18%). Our contribution is this mapping of how the detection conclusion moves with the measurement definition and the execution conditions, and the procedure to re-measure it as models change.