of legitimate AI agent sessions presented a verified Web Bot Auth signature in Q3.
At a recent banking industry summit, the CISO of one of the world's largest banks told the audience that, for the first time in his career, the technology has arrived ahead of the controls.
AI agents are this technology.
This past quarter AI agents moved from reading the web to transacting on it: logging in, signing up and checking out on behalf of real people across multiple industries. Meanwhile the controls haven't caught up yet with less than 3% of these agents disclosing who they are.
Even when an agent's presence can be verified, it reveals nothing about what the agent came to do on the site. This leaves businesses guessing which agents are acting on behalf of customers and which are adversarial.
Drawing on Arkose Labs’ Q3 2026 data, this report’s findings replace the guesswork with evidence including where AI agents showed up, how they behaved, and what it takes to tell the helpful ones from the harmful.
Most AI agents acting for real customers arrive unannounced. In Q3, only 2.3% of legitimate AI agent sessions presented a verified Web Bot Auth signature, the cryptographic standard that lets an agent prove which product it is. The other 97.7% carried no disclosure at all.
To tell them apart, Arkose Labs sorts agent traffic into three populations:
In Q3, legitimate agent traffic sat almost entirely in Population Two, but one product breaks the pattern. ChatGPT agent signed 78.4% of its sessions, the only agent that signed at scale. Even with this one major agent disclosing itself, the network-wide rate stayed at 2.3%.
The pattern isn't limited to one part of our network. Technology companies make up a large share of the traffic that saw agentic AI traffic this quarter, but even among businesses in other industries, 92.8% of agent sessions carried no disclosure.
Automation signals show that something is a bot. They don't show what it intends. Telling a good agent on your website from a malicious one takes analysis that goes past "bot or human?"
This is because on the surface, AI agents carry the same marks as bots: synthetic browsers, cloud infrastructure and machine-timed clicks. It’s why legacy bot defenses often block AI agents, and in the process turn away the real customers behind them.
Look past those surface signals, and agents and bots separate sharply. In Q3, 77.4% of AI agent sessions were classified as legitimate (compared with just 7.9% of known bot sessions). This means that many of the agents that legacy defenses catch are legitimate traffic.
AI agents appeared on login and registration flows in all eight industries we measured: banking and fintech, travel and hospitality, e-commerce and retail, gaming and online gambling, social media and dating, technology, streaming media and education. They also spread fast across the customer base. Before Arkose Labs began detecting personal AI agents, half of customers saw AI agents on the sampled days. By Sept. 30, that reached 65.2%, and personal agents alone reached 50% of customers that day.
For scale: in Q3, roughly one in every 5,200 protected sessions came from a named AI agent. The share is still small. The reach is not.
Meta launched Muse, a personal AI agent that opens a real browser and completes tasks for its user, on Sept. 8. Within weeks it overshadowed every other agent Arkose Labs tracks. Muse sessions grew more than 30x in September, while Perplexity Comet, ChatGPT agent, Grok and Gemini Spark held roughly flat.
But Muse wasn't the only new agent. Instinct also grew quickly, peaked around Sept. 19 and dipped by month end. Meanwhile the established agents grew 37.8% from July to September, and Perplexity Comet, which carried the most agent sessions over the quarter as a whole, cooled 30.1% over the same period.
The market is churning: newcomers can take the lead in weeks, and leaders can fade just as quickly.
How an agent is built shapes how it looks to a website, and an agent can look risky without being hostile.
Two personal AI agents, Muse and Instinct, show the gap: they do the same job, but they run on opposite designs. Muse operates from the cloud on a small, stable set of device fingerprints. Instinct connects through home and mobile networks and keeps rotating its device fingerprints, the same tradecraft attackers use to dodge reputation checks. That makes Instinct a Population Two agent that looks like a Population Three agent.
Instinct looked risky in nearly every session, yet none was linked to an attack. A policy that acts on appearance alone would turn away a person running a real errand.
Agents arrive at the same doors attackers target every day. In Q3:
Because of this risk, businesses can't wave all automated traffic through. They can't shut it all out either: doing so turns away real customers and the revenue they bring. The best approach is to judge each session on what it attempts.
“Every agent we track shows signs of automation somewhere. This was never the question. Rather, the real question is, what did the agent come to do? What is its intent? Each company must decide how to handle them accordingly, taking their industry and risk posture into consideration. For example, a bank will have different controls in place than a retailer.”Mitchell Davies, Arkose Labs Cyber Threat Intelligence Research (ACTIR) team
The next wave of agents is splitting along the same line this report draws. Some are starting to identify themselves: Grok Bot for Enterprise signs its requests with Web Bot Auth, and Sigma switched this quarter from an undeclared agentic browser to one that identifies itself. Others aren’t. Google’s Gemini Spark, still in beta, doesn’t identify itself, and neither do the personal agents driving the most growth. Disclosure is spreading, but slowly. For now, expect most new agent traffic to keep arriving unannounced.
The bigger shift is where agents run. Today Muse, Instinct and other personal agents work by controlling a web browser. Arkose Labs expects the next phase to arrive as soon as Q4: agents that operate a person’s own phone or emulate Android inside their own virtual machines. Native-app and OS-level agents are already emerging, from AstroBot and other Android harnesses to agents built into Huawei and Xiaomi operating systems. On-device agents leave no virtual machine to fingerprint. In Q3, mobile agent traffic on protected flows was negligible, which gives a baseline to measure next quarter against.
Agents are also getting harder to see into. Muse is set to add end-to-end encryption, so even Meta won’t see the instructions a user gives it. When neither the website nor the agent’s maker can see what an agent was told to do, its behavior is the only evidence of intent.
Automation signals tell you what something is, not what it wants.
Welcome agents that sign with Web Bot Auth, but judge every session on behavior, signed or not.
Measure agent traffic on every protected flow, including sign-up, sign-in, checkout and support.
A new agent can become a top source of traffic within weeks, so policies built around today's agents will age fast.
This is the first edition of a quarterly report. Future editions will compare quarters, showing how agent traffic grows, how often agents identify themselves and which new agents arrive.
Data. Arkose Labs production traffic only. Test, internal and analyst accounts are excluded. Customers are anonymized to industry; agent products are named.
Scope. Protected actions only: login, registration, checkout, password reset and one-time passcode. Window: July 1 to Sept. 30, 2026. Every figure is a share or a multiple; no raw counts are published. Agent traffic was concentrated among technology, SaaS and telco customers, which accounted for most AI agent sessions in Q3.
Definitions. AI agents are sessions identified as a named agent product. Known bots and AI crawlers are counted separately and never counted as agents. Self-disclosure means a verified Web Bot Auth signature. A malicious agent session is one assigned an attack risk category.
New detections. Agents detected for the first time during the quarter are reported as newly observed, not as growth. Meta released Muse on Sept. 8. Arkose Labs detection for Muse went live on Sept. 22; Muse figures before that date come from applying the same detection rule to stored fingerprint data, and from Sept. 26 onward the live detection and the reapplied rule match exactly. Muse and Instinct technical profiles come from the first eight hours after detection went live (Sept. 22 to 23 UTC).
Claude Desktop browser. Claude Desktop browser traffic is excluded from the headline agent figures because its detection also counts people logging in to Claude itself.
Decide which AI agents to trust. Stop the fraud that costs you money.
© 2026 Arkose Labs. All rights reserved.
