Last week's The Latest in Agent Traffic looked at where AI agents run and when they work. This week's data from the Arkose Labs Global Consortium adds two more questions: who vouches for an agent, and how it reaches your site.
One agent began signing its traffic so sites can verify where it came from. Another changed its route after news of tighter usage limits.
Meta Muse starts signing: 0% to 34% of sessions
Last week we reported that ChatGPT was the only agent we saw using Web Bot Auth, a standard that lets an agent sign its requests so a site can verify who sent them. That changed on Nov. 6.
Meta Muse sent its first signed session at about 3:47 a.m. UTC. Within roughly three hours, about a third of Muse sessions carried a Web Bot Auth signature, and the share held at about a third for the rest of the 24-hour window.
The rollout is uneven. Only some Muse variants sign, and which ones differ by customer. On some sites nearly every Muse session is signed, while on others fewer than 10% are, which points to a staged rollout. Muse volume did not step up when signing began, so this is a change in behavior, not growth in traffic.
The change matters because of what a signature proves. Before, we recognized Muse from its fingerprint and network behavior, which is strong evidence but still our inference. Now Muse signs its requests and we check each signature against Meta's published keys.
Every signature we checked verified against Meta's own keys, so for those sessions the agent's origin is attested, not inferred. Muse is now self-disclosing for part of its traffic.
Grok Bot changes routes after the Nov. 1 usage limit news
On Nov. 1, Elon Musk wrote on X: "The cost of serving Grok Bot was unsustainably high relative to revenue." Reports said usage limits had tightened. Across the Arkose Labs Global Consortium, Grok Bot sessions averaged 24% lower on Nov. 1 to 3 than on Oct. 24 to 27. The decline began before Nov. 1 and continued with no single-day drop, so Musk's statement is context, not the whole explanation.
The bigger story is the mix. Sessions routed through Cloudflare IP space rose 149%, or about 2.5x, while everything else fell 72%. Cloudflare's share of Grok Bot traffic went from 22% to 72%. That starting point is consistent with edition 1, which put Grok Bot at 21.6% data-center share.
The agent is still there. It is reaching sites differently. A route can shift within days, so a rule built on where an agent connects from can stop working when the route changes. Judge agents by what they attest and how they behave, not by where they connect from.
What this all means for your business
A signed agent is attested by its own keys, so you can allow it on purpose. An unsigned agent can still be classified from its behavior, but that is inference, not proof. While rollouts like Muse's are partial, businesses will see both from the same agent. Grok Bot shows the other side: when the route an agent takes changes, controls that depend on where traffic comes from lose their footing, while controls built on attested origin and observed behavior hold.
Which side of that line is your traffic on?
See how Arkose Agent Trust Manager classifies each AI agent and lets you set policy for what it can do.
About the data
All figures come from the Arkose Labs Global Consortium, Arkose Labs' network of customer traffic.
- Meta Muse signing: hourly share of Muse sessions with a Web Bot Auth signature, Nov. 5 to 6, 2026 (last 24 hours to 14:00 UTC on Nov. 6)
- Grok Bot session and route shift: Oct. 24 to Nov. 3, 2026, with the Nov. 1 to 3 average compared against the Oct. 24 to 27 average, all customers combined
