Meta Is Quietly Signing Some Muse Web Requests, DataDome Finds
DataDome's threat research chief says Meta began testing Web Bot Auth signatures on Muse and Meta-WebIndexer traffic around October 12, giving sites a way to…
By Icarus5 min read
Meta has begun attaching cryptographic signatures to some of the web requests sent by its Muse personal agent, according to bot-management firm DataDome, in an unannounced test that would give websites a way to verify Muse traffic for the first time. The finding comes from Jérôme Segura, DataDome’s vice president of threat research, who described the observation in a LinkedIn post on October 30, as reported by PPC Land.
Segura wrote that Meta started silently testing Web Bot Auth “since around Oct. 12” and has been ramping up the signed requests for at least two of its agents: Meta-WebIndexer and Muse. He added that, as far as he knows, there was no public or official announcement, and that the signed requests may initially have carried a Meta-ExternalTest user-agent label. Meta has not confirmed the test publicly, and its public crawler documentation does not mention Web Bot Auth, HTTP message signatures, or a signature key directory.
Web Bot Auth is a profile of HTTP Message Signatures, the standard published as RFC 9421 in February 2024 and proposed by Cloudflare in May 2025. A signing agent adds Signature, Signature-Input, and Signature-Agent headers to each request. The receiving site, or the security vendor in front of it, fetches the operator’s public keys from a directory published at a fixed path and checks the signature against them. If it validates, the request came from whoever controls the private key. If it does not, the request is an impostor or a malformed one.
Why Muse Was Hard to Identify
Muse has had an identity problem since its United States launch on September 8. Within two weeks, Amazon had blocked the agent from shopping on Amazon.com, and among the grievances Amazon listed, according to GeekWire, was that the agent did not identify itself when it browsed. DataDome’s own third-quarter report described Muse as an agent that does not declare itself, even as it counted 29.1 million Muse requests on DataDome’s network between September 22 and October 3 and put Muse at 33% of all agentic browser requests in September.
The difficulty is partly architectural. Each Muse user’s agent runs in its own cloud virtual machine with a full browser inside, so Muse behaves like a computer-use agent operating from a data centre rather than from the user’s phone. In DataDome’s third-quarter sample, 99.3% of Muse requests came from cloud and content-delivery infrastructure, with 81.2% from Cloudflare and 18.1% from Fastly, and only 0.6% from consumer internet providers. Meta’s documentation tells site operators to recognise its declared crawlers by their origin on Meta’s own network, looking up prefixes registered to Meta’s autonomous system, AS32934. Traffic leaving Cloudflare and Fastly addresses cannot pass that test, whoever sends it. A cryptographic signature is the verification route on offer for an agent built the way Muse is built, and it does not depend on where the request comes from.
Retailers and banks have been deciding, one by one, whether to let agents in: Walmart introduced per-agent profiles in October, while The RealReal tightened its bot defenses after Muse held its listings out of reach and JPMorgan moved to block outside agents from customer accounts. Either decision depends on being able to recognise the agent in the first place. A Muse request carrying a valid signature can be allowed, rate-limited, or blocked, rather than caught or missed by a heuristic. An unsigned one cannot.
What Remains Unknown
The finding has limits. Segura describes the signed volume as relatively small, and his post gives no count, no percentage, and no breakdown between the two agents. DataDome says it has already added support to validate Web Bot Auth requests from Meta for its customers, but until Meta signs most of what its agents send, or says publicly that it intends to, sites face two populations of Meta traffic: one they can verify, and a larger one they cannot.
Several other facts are missing from the public record. Meta’s documentation does not disclose where it publishes its key directory. Whether Meta-ExternalAgent, Meta-ExternalFetcher, or Meta-ExternalAds will sign is not known. Nor is it clear whether Meta-ExternalTest will appear in Meta’s crawler list, or was a temporary label for the trial. The word testing is Segura’s inference from traffic, not a description Meta has given.
A signature also settles only half the question. It says who sent the request, not why it was sent or whether the agent will behave. Segura put it this way: “As AI agents like Muse start browsing and shopping for real people, businesses need to know which ones to trust. Signed requests verify that an agent is really who it claims to be. Identity is a key part of the picture, and paired with intent (what the agent is actually trying to do), it lets businesses welcome legitimate agents and keep impersonators out.”
Meta would not be the first large operator to sign agent traffic, but it would be among a small group. Arkose Labs described OpenAI’s ChatGPT agent, which signed 78.4% of its sessions in the third quarter, as the only agent signing at scale. Google has said it is experimenting with the protocol under the identity agent.bot.goog and signs only a subset of requests. Amazon Bedrock AgentCore signs browser traffic with a service key.
DataDome’s third-quarter report, published October 15, said Muse does not declare itself, while Segura’s post says signing began around October 12. The two are not in conflict: DataDome’s Muse measurement window ran from September 22 to October 3, closing more than a week before the start date Segura gives, and the signed volume has been small and growing since then.
What to watch is whether Meta documents the signing before November 20, when its revised commercial terms covering crawlers take effect, and whether the signed share grows from a small test into the default. Until then, the story is narrow but real: Muse, the agent that arrived unannounced from the cloud and did not say who it was, has started carrying identification on at least some of its requests, and the sites deciding whether to let it in finally have something to check.
