diff --git a/skill-data/core/SKILL.md b/skill-data/core/SKILL.md
index 9d5fb80..87db004 100644
--- a/skill-data/core/SKILL.md
+++ b/skill-data/core/SKILL.md
@@ -57,6 +57,15 @@ GUI-automation tool** like the `cua-driver` skill — see
 `agent-browser extension connect`. After that it's zero-confirmation, zero-token
 CLI. Use `--launch` instead when a fresh, isolated browser is fine.
 
+Each `--session` that connects gets its **own colored Chrome tab group** (named
+after the session) and drives only its own tabs — multiple agents share the one
+real browser without cross-talk, and the user's own tabs are never grouped. CDP
+drives the page without moving the user's mouse/keyboard, so it doesn't fight
+them for control. **Anti-detection ranking: this real logged-in Chrome (extension
+connect) > a headed launched browser > headless (forbidden).** A genuine human
+browser has no headless/automation tells at all, so prefer it for anything
+anti-bot-sensitive.
+
 ## Two ways to drive a page — and when to drop to `eval`
 
 You have a **real Chrome with the user's DOM**. Two layers, mix them freely:
@@ -506,7 +515,9 @@ and [references/authentication.md](references/authentication.md).
 ```bash
 --session <name>        # isolated browser session
 --json                  # JSON output (for machine parsing)
---headed                # show the window (default is headless)
+--headed                # default & always-on for stealth — headless is FORBIDDEN
+                        #   (a bot tell: creepjs flags ~33% headless vs 0% headed).
+                        #   Display-less servers only: AGENT_BROWSER_ALLOW_HEADLESS=1
 --auto-connect          # connect to an already-running Chrome
 --cdp <port>            # connect to a specific CDP port
 --profile <name|path>   # use a Chrome profile (login state survives)
diff --git a/skill-data/core/references/commands.md b/skill-data/core/references/commands.md
index e9da008..20a228e 100644
--- a/skill-data/core/references/commands.md
+++ b/skill-data/core/references/commands.md
@@ -302,7 +302,8 @@ agent-browser state load auth.json    # Restore saved state
 ```bash
 agent-browser --session <name> ...    # Isolated browser session
 agent-browser --json ...              # JSON output for parsing
-agent-browser --headed ...            # Show browser window (not headless)
+agent-browser --headed ...            # Default & always-on (stealth). Headless is FORBIDDEN
+                                      #   (bot tell); display-less servers: AGENT_BROWSER_ALLOW_HEADLESS=1
 agent-browser --full ...              # Full page screenshot (-f)
 agent-browser --cdp <port> ...        # Connect via Chrome DevTools Protocol
 agent-browser -p <provider> ...       # Cloud browser provider (--provider)