Security firm says Muse traffic reached more than half of its customers within two weeks of launch
Cequence found Meta's agent passing as an ordinary Chrome browser, its traffic growing nearly sixfold, and clearing multi-factor authentication at financial…
By Icarus4 min read
Meta’s Muse spread across the web faster than most websites noticed. Security firm Cequence Security said on Wednesday that within two weeks of Muse’s September 8 launch, traffic matching Meta’s personal AI agent had reached more than half of the customers it studied, and most of those businesses would not have known it was there.
The numbers come from Cequence’s own traffic analysis, published alongside its new “Agent Trust” capability for its application and API protection platform. From September 1 to September 24, the company measured Muse traffic across customers in financial services, retail, travel, software, and other sectors, and found it grew nearly sixfold from its first week to its most recent week, depending on the industry.
The agent that looks like a person
Muse does not introduce itself. According to Cequence, each Muse user gets their own agent: a real Chrome browser running in Meta’s cloud, directed by an AI model that reads each page and decides what to click, with traffic routed through a consumer VPN. It does not sign its requests or identify itself as an agent, so to standard security checks it looks like a person browsing.
Cequence identified the traffic behaviorally. One signal: a browser update went from zero to more than 90 percent of Muse traffic within days, a pattern the company said points to Meta hosting and updating these browsers centrally.
The practical consequences show up at the web’s trickiest gates. At financial institutions, Cequence found Muse logging into customer accounts and completing multi-factor authentication on users’ behalf, with confirmed successful sign-ins. A successful multi-factor login, the company wrote, no longer shows whether a person or an agent is on the other end.
Shopping looked human too. Muse searched, compared options, filled carts, and moved through checkout; a small share of sessions ended in a completed purchase, while most browsed and left. That browse-and-leave pattern has long been the classic signal businesses use to spot bots, but Cequence argues that whether a visitor completes a purchase is no longer a reliable way to tell a bot from a customer.
Blocking the request, not the agent
The findings land in the middle of a live argument over how websites should treat agents. All Things Muse previously covered reporting from TechCrunch that sites including Walmart, Delta, United, Yelp, eBay, and Zillow have blocked or hindered Muse traffic, sometimes deliberately and sometimes through anti-bot machinery that mistakes the agent for spam.
Cequence offered one customer’s answer. A travel and hospitality business began blocking nearly one in five Muse requests in late September, targeting only the requests that looked abnormal while letting the rest of the agent’s traffic through. Muse itself remains allowed, the company said, presenting selective enforcement as the middle path between an outright ban and an open door.
The commercial side of the announcement is Agent Trust, Cequence’s bid for the business side of the counter: a live inventory of detected agents in a company’s traffic, verification of agent identity against trusted issuer registries, request-by-request activity logs, and policies that block, rate-limit, or challenge specific actions instead of the agent behind them. Cequence said the detection rules are already running for all its customers with no setup required.
Why it matters
The web’s anti-bot machinery was built for a different era: spam bots and scrapers, not agents carrying out a customer’s errands. Meta’s industry-side answer is the open agent-to-agent standard it is developing with Sierra and partners including Walmart, Stripe, and Shopify, which aims to separate legitimate customer agents from abuse.
Businesses, meanwhile, want their own tools on the business side of the counter. As CEO Ameya Talwalkar put it: “Blocking agents outright will turn customers away, and letting them all through is a risk most security teams can’t defend.”
Muse users get the point directly: the agent’s invisibility cuts both ways. It keeps errands flowing where an obvious bot would be stopped, but it also means websites cannot easily distinguish your agent from an attacker using stolen credentials. Identity is the question both camps are trying to answer — Meta and its partners in standards documents, security firms like Cequence in dashboards.
