Auto-Clicker with Human-Like Jitter
A macro recorder for Old School RuneScape that tried to look human and what caught it.
Highlights
- Automated click intensive, repetitive leveling grinds.
- Not to make gold.
- 3s base interval with ±30% timing jitter.
- Position jitter plus 65% chance of overshoot per click.
- Backtick to start/stop, tilde to quit.
- Caught and temporarily banned.
- Variances approached a mean over long sessions.
- OS-injected input lacks a real mouse's hardware signals.
Overview
A small Python tool to automate the repetitive tasks in Old School RuneScape. "Free" macro recorders like this already exist, but one of my favorite parts of vibecoding small projects is avoiding the bloat, telemetry, ads, or spyware that plague modern "free" software. It added variation to every action (timing jitter, position jitter, and purposeful overshoot) to pass as a real player. It worked for about a week, then the account got temporarily(!) banned, which turned into another interesting project - understanding how modern anti-cheat software catches this.
Learnings
Statistical and behavioral detection
No single click gave me away, the aggregate did. Real players drift, speed up, slow down, and get distracted. My fixed mean with ±30% uniform noise looked identical in hour one and hour six, and over thousands of actions that stability reads as a machine.
Synthetic input vs real hardware
Tools like pyautogui inject events through the OS, and Windows can flag those as injected. A real mouse sends a noisy, high-resolution stream. Injected input arrives as clean, discrete jumps, so human-like timing doesn't help if the events announce they were generated.
Mouse-movement fingerprinting
Real cursor paths curve, overshoot, correct, and follow Fitts's law. My overshoot logic was a rough nod to this, but straight segments and repeat clicks on the same pixel stand out against a human's messy scatter.
Server-side heuristics and human review
The server doesn't need the client at all: hours of the same loop, flat XP per hour, and no breaks flag an account on their own. A moderator or a player report usually finishes the job.
Client integrity checks
The official client can scan its own process for injected libraries, memory access, debuggers, and known automation tools.
Machine-learning classifiers and account linking
Jagex's ML systems (historically Botwatch) learn what human play looks like, and a clean, repetitive account is easy to separate from the human cloud. The same models link accounts by IP, hardware, and behavior to catch whole bot farms.
Honeypots and randomized traps
Random events, shifting layouts, and moving UI break scripts that click fixed coordinates. A human adapts without noticing. A script does exactly what it was told.
What passing would actually take
Beating this means faking the full shape of human behavior over hours, at the hardware level, invisible to the client. By then you've rebuilt a convincing human, which is far more work than the grind you were trying to skip.