Agents that run through a provider’s cloud gateway usually announce themselves. Agents that run headlessly like Instinct, inside a browser like Muse, or on your device like Claude Computer Use - attempt to blend in.

Some agents announce themselves and some do not, and the difference comes down to where their web requests originate.

Cloud crawlers and research agents. When a cloud-based agent such as Gemini Deep Research fetches a page, the request originates from the provider’s own infrastructure. Those systems send self-declaring headers, may declare their identity with their user-agent, and a growing number sign their requests under Web Bot Auth (WBA), so the site can verify who is knocking.

Personal agents in a browser. Muse, Dots, Grok Bot, browser extensions and desktop agents drive a real browser instance. There is no gateway in the path to stamp the request, so what arrives on your page is exactly what anyone else’s Chrome would send.

So to anything that relies on the user agent, a person browsing on Chrome and a Muse session browsing on their behalf look like the same visitor. The difference only shows up once you look at how the session behaves.

Should you block all AI agents? The idea is tempting, until you remember there is a real customer behind every Muse session, with real purchase intent, who really asked it to do a transaction.

How quickly is Muse growing?

If “wait and see” was your strategy for figuring out what to do about Muse, it’s probably time to reconsider! Here’s how Muse traffic accelerated from Oct 17 to Oct 26, 2026:

• Total Muse sessions more than tripled (+217%)
• Muse sessions per site more than doubled (+113%)
• Total sites receiving Muse traffic is up 40%, now reaching 1 in 3 of the platforms we protect, up from 1 in 4 two weeks earlier.

Note: We’re referring to sites/platforms rather than the number of our customers impacted because some organizations use multiple Verisoul projects to manage different apps, sites, brands, etc.

Agentic ecommerce: where you sit in the funnel decides your policy

There’s nuance here, and even the biggest ecommerce companies disagree on whether to allow the Muse shopping agent. The stakes are high: according to Meta, the average purchase price on a Muse-driven session is $200. The easiest way to predict which side a company lands on is to look at where it makes its money between “I need new running shoes” and “order placed.”

If you sell the product, agents are another checkout lane. A merchant with its own inventory gets paid when the order goes through, whoever or whatever clicked the button. An agent that turns a sentence in a chat window into a completed order raises transaction velocity, so these merchants want the path to be as easy as possible for agents, with fraud controls on the risky steps. Shopify is the clearest example: Shop Pay plugs into agent checkout flows, and merchants on the platform pick up sales that started as a sentence typed into an assistant. Even Shopify keeps a person in the loop at the end, since its default storefront rules ask agents to hand the final checkout review back to the buyer.

If your margins depend on late-funnel ads, agents move the sale away from your ad auction. Amazon and Google earn a large share of their profit from ads at the very bottom of the funnel: the sponsored listing at the top of a search for running shoes, or a competitor’s ad shown when you search for a brand by name. Those ads rarely create new purchases, since the shopper has already decided to buy, and their job is to decide which seller gets the sale. An agent that reads the catalog and picks a product skips the sponsored slot entirely, so total commerce stays about the same while the ad revenue disappears. That is a big part of why Amazon blocks Muse.

The Amazon math shows why blocking is the fiscally responsible move for them (Amazon FY2025 annual report):

• Amazon’s two retail segments, North America and International, earned about $34B of operating income on $588B of revenue in 2025, a margin of roughly 5.8%
• Advertising brought in $68.6B in the same year, about 9.6% of Amazon’s total revenue, and it is reported inside those retail segments
• Amazon doesn’t disclose its ad margin, though analysts describe it as rivaling AWS. At a 50% margin, ads alone would produce about $34B of profit, the entire profit of the retail business
• Above a 50% ad margin, Amazon’s retail business without ads loses money

Every agent that shops on Amazon without seeing a sponsored listing chips away at the line that keeps retail profitable. Amazon’s public reasons for blocking are that agents should identify themselves and stay away from customer credentials, which are real concerns with technical fixes like signed agents and delegated logins, while the ad problem is one that no protocol solves. Amazon’s own behavior points the same way, since it has started selling sponsored placements inside Rufus, its in-house shopping assistant: ads keep working inside agents you own and stop working inside agents you don’t.

Both approaches are understandable. But both are also blanket policies, and that is where the trouble starts.

• Allow all agents: you risk inviting fraudsters handing stolen cards and liability to agents, or fraud dressed up like AI assistants.
• Block all agents: you’ve turned away a paying customer because they delegated the purchase to software.

Realistically, most ecommerce merchants will want something in between, and that requires knowing which sessions are agents in the first place.

What agents mean for fraud

Fraud teams should assume bad actors will route attacks through agents, because agents make both third-party and first-party fraud easier to get away with.

Third-party fraud: the blame gets spread out. If you got hold of a stolen credit card today, your first move would be to hand it to an AI agent and let the agent check out. The purchase comes from the agent provider’s cloud machine, which thousands of legitimate users share, so your own device and network stay out of the picture. When the chargeback lands, the blame is split across the cardholder, the agent provider, the merchant and the payment platform, and the person who started it is the hardest one to find.

First-party fraud: “my AI did it.” Real customers now have a believable excuse for disputing a purchase they regret: they didn’t buy it, their agent did. Dispute rules were written for purchases a person either made or didn’t make, and they haven’t settled who is responsible when a person’s own agent placed the order. Knowing which sessions were agent-driven, and keeping a record of exactly what the person approved, is what lets you win those disputes.

Considerations for agentic banking and fintechs

Everything above applies to banks and fintechs with higher stakes, since the transactions are money movement. A card purchase can be charged back, while a P2P transfer, a wire or a crypto withdrawal is usually gone once it clears.

• Agents look like account takeover. A cloud agent logs in from a new device on a datacenter IP using stored credentials, which is the exact pattern ATO models are built to stop. Amazon said in its lawsuit against Perplexity that it had to lock real customer accounts after detecting Perplexity’s Comet agent, then repair them later, because an unidentified agent and an attacker looked the same. Without agent identification, banks either lock out good customers or loosen the rules that stop ATO
• Money movement is where the damage happens. Adding a new payee, changing payout details, raising a transfer limit and sending a first payment to a new account are the moments a hijacked or manipulated agent can do the most harm, including prompt injection attacks that trick a legitimate agent into paying the wrong person
• Account opening at agent speed. Agents fill out applications far faster than people, which makes synthetic identity and money mule schemes cheaper to scale
• Authorization disputes. “My agent sent that payment” will start showing up in fraud claims, and banks will need a record of what the customer approved

For most banks the answer looks like ecommerce: let agents handle low-risk tasks like checking balances, pulling statements and paying known billers, and have the person step in for anything that sends money somewhere new. More on how to do that below.

There are four ways to spot an agent, and they fall into two groups: the agent tells you who it is, or you work it out yourself.

When the agent declares itself

1. Cryptographic signatures (Web Bot Auth). The agent signs each request with a private key, and the site checks the signature against the operator’s published keys.

• Good: a valid signature can’t be forged, so it proves the request came from that operator, and it’s cheap to check
• Bad: coverage is limited because signing is opt-in, and today it’s mostly cloud agents from large providers that sign. The absence of a signature tells you nothing, since personal agents like Muse and malicious bots don’t sign. A signature also identifies the operator, so you still don’t know which person is behind the request

2. User agent declaration. The agent puts its name in the user agent string, like Googlebot or ClaudeBot. This is what Amazon’s terms ask agents to do.

• Good: easy to read, widely used by crawlers and research agents, and a free signal when it’s there
• Bad: it’s opt-in like signatures, so coverage is limited, and anyone can type “Googlebot” into a user agent string. A declaration needs confirming with network or behavior before you trust it

Self-declaration is the strongest proof when an agent offers it, though most of the agents fraud teams worry about skip it. Device, network and behavior cover the rest, and behavior is the hardest to fake.

When the agent doesn’t declare itself

3. Device and network signals. Look at where the traffic comes from (known agent IP ranges, cloud hosting providers, datacenters) and what it runs on (headless browsers, automation frameworks, device details that don’t add up).

• Good: works without the agent’s cooperation, and catches most cloud browser agents, since they run on machines in datacenters
• Bad: false positives from VPNs, corporate networks and privacy browsers, while residential proxies let bad bots pass as home users. Agents that run on the person’s own computer, like browser extensions and desktop agents, inherit that person’s real device and IP, so these signals see a normal customer

4. Behavior. Watch how the session moves: mouse paths, click timing, typing rhythm, scrolling and how fast it navigates between pages.

• Good: the hardest signal to fake, and it works wherever the agent runs, so it can tell a person on a corporate VPN from a script on a residential proxy
• Bad: it takes a large volume of sessions to train well, and it needs a few moments of interaction, so a session can look unidentified at first and get named as an agent a little later

Verisoul uses all four together. Signed agents get the strongest label, self-declared agents get confirmed against network and behavior, and agents like Muse that stay quiet get inferred from the combination of device, network and behavioral signals. Every session gets a bot score from 0 to 1 in real time, and the API tells you which method identified the agent so you can decide how much to trust it. Each agent’s page in the Agent Atlas shows how it identifies itself (or doesn’t) and which signals we use to catch it.

Why can’t I build this myself?

With enough time and resources, maybe you can. But a lot of industries need a solution ASAP.

When a security team builds its own agent rules, the first draft is almost always static. IP clusters. Proxy flags. A network risk threshold. This is great until you end up blocking real customers from using your platform.

That is because plenty of traffic can look suspicious on paper. Corporate networks, shared datacenter VPNs, cloud proxies, privacy browsers, etc. The missing piece is behavior. A person on a corporate VPN still moves through a webpage like a person.

Verisoul’s behavioral detection model was tuned on the sessions we see across our wide customer base. It’s been thoroughly tested to ensure we catch AI agents while avoiding false positives.

Verisoul’s API gives you two pieces of information about agents on every session: a bot score that says how likely the session is automated, and an agent object that says which agent it is whenever we can name it. The same fields show up in our dashboard as well. Here is a trimmed API response for a session that Muse was driving:

{
  "bot": 0.9891,                // how likely the session is automated
  "session": {
    "bot": {
      "mouse_num_events": 1079,
      "click_num_events": 146,
      "keyboard_num_events": 0
    },
    "agent": {                  // which agent it is
      "id": "meta_muse",
      "name": "Meta Muse",
      "provider": "Meta",
      "type": "ai_assistant",
      "detection_method": "inferred",
      "detection_signals": ["network", "device", "behavioral"]
    }
  }
}

1. The bot score (bot, from 0 to 1) tells you how likely it is that the session is automated, whoever is behind it. It combines environment checks (headless browsers, automation frameworks, tampered runtimes), behavior (the interaction counts above are a small slice of what the model reads) and network patterns. Bot score docs

2. The agent (session.agent) tells you who is driving. The fields to build rules on are:

• id: a fixed label like meta_muse (Meta Muse) or chatgpt_agent (Dots), which stays the same even if an agent rebrands and its display name changes
• type: ai_agent, ai_assistant, ai_crawler, crawler, headless_automation or other
• detection_method: signed, self_declared or inferred, which maps to the detection methods above and tells you how much proof sits behind the label
• detection_signals: which of cryptographic, network, device and behavioral signals the identification rests on

Sometimes we need to watch a session for a few moments before we can name the agent, so a session can show no agent at first and an agent later on, and once we identify one it stays on that session. See the agent detection docs, and browse the Agent Atlas for the full list of agent IDs you can write rules against.

Read together, the two fields sort sessions into clear groups:

• High bot score with a named agent: a known agent, so handle it according to who it is and what it’s trying to do
• High bot score with no agent named: automation we can see but can’t attribute, which is where scrapers and fraud bots usually sit
• Low bot score with no agent: a person

How to allow AI agents safely

Always know when an AI agent is operating - even if you allow them for certain actions. Let agents do the low-risk work, and have the person step in when money moves or the account changes.

Most of what an agent does on your site is harmless: searching, comparing, filling a cart, checking a balance. The risk sits in a handful of actions, so the safest way to welcome agents is to save the friction for those moments.

Suggested rules

Run new rules in monitor mode for a week or two first, so you can see how much agent traffic each one would touch before anything gets blocked.

Step-ups only a person can pass

A step-up only works if it reaches the person and the agent can’t complete it for them:

• Out-of-band passcode. Send a one-time code to a phone or app the agent can’t reach. App and push codes are stronger than SMS, which is exposed to SIM swaps, and email codes are weak if the agent can read the inbox
• QR code scan. Show a QR code in the agent’s session and have the person scan it with your mobile app, where they’re already signed in, which ties the action to a device they physically hold
• Account sign-in. Require a fresh login with a passkey or biometric before the sensitive action, which an agent working from a saved session can’t complete
• In-app approval. Push the exact details to the person’s app for a one-tap approval

Whichever step-up you use, show the specifics of what the person is approving. “Approve a $200 order from Acme Outdoors” gives you a record to point to when a dispute comes in, while “allow your assistant to shop” gives you very little.

Our goal is to give you the answers you need. You decide how far to open the door, for whom, and for which actions. (And yes, you can still slam it shut.)

We’re here to help

The agentic internet is scaling faster than most industries ever expected. Browse the Agent Atlas to see every agent we track, from Meta Muse to Grok Bot. If you would like to know how much of your traffic is driven by agents like Muse and you need help getting started, let’s talk.