Meta's Muse AI agent seen in half of customer traffic

Cequence Security said Meta's Muse AI agent appeared in traffic at more than half of the customer environments it studied. It also launched Agent Trust, a tool designed to identify AI agents and control specific actions they take.

The findings are based on traffic analysis across customers in financial services, retail, travel, software and other sectors over roughly three weeks. At the median customer, Muse traffic grew nearly sixfold within about two weeks of first appearing.

According to Cequence, Muse did not identify itself as an AI agent in those interactions. Instead, it presented itself as a standard Chrome browser, making it less likely that conventional security checks would distinguish it from a human user.

Cequence detected the traffic through behavioural analysis rather than an explicit identity signal. It said Muse used a real Chrome browser in the cloud and routed traffic through a consumer VPN, making sessions look similar to ordinary browsing activity.

What cequence found

The agent was able to sign in to customer accounts at financial institutions and complete multi-factor authentication on users' behalf, Cequence said. In those cases, successful authentication alone did not show whether the session was being driven by a person or an automated agent.

Cequence also said Muse searched for products, compared options, filled baskets and moved through checkout flows. A small share of those sessions ended in completed purchases, while many others browsed and then exited, resembling traffic patterns long associated with bots.

One example involved a travel and hospitality customer whose security team began blocking nearly one in five Muse requests while allowing the rest of the traffic to continue. Cequence said the approach focused on individual requests judged abnormal rather than excluding the agent entirely.

Cequence argued that the broader issue is how organisations classify traffic that may be legitimate in origin but difficult to assess. That challenge becomes sharper when an agent is trusted with account access and behaves in ways that overlap with both normal customer activity and automated abuse.

"AI agents like Meta's Muse are bots that act on behalf of real customers. Many businesses can't see them, and those that can are tempted to block them," said Hari Nair, Vice President of Product Management at Cequence.

"Agent Trust lets businesses block the action, not the agent. The agent keeps working for its customer, and the one request that crosses a line gets stopped, slowed or challenged," Nair said.

Product response

Agent Trust sits within Cequence's Application and API Protection product. The service combines identity verification with behavioural monitoring to detect both declared and undeclared AI agents, the company said.

Cequence said the product includes a live inventory of agents seen in an organisation's traffic, verification of agent identity against trusted providers, and a request-by-request activity record. It also applies transaction-level policies that can block, rate-limit or challenge a single action rather than shut out the entire agent session.

This matters when an agent may be acting properly for most of a session but then starts making requests that appear outside normal bounds, Cequence said. It gave the example of an agent that usually checks order status but then begins collecting price and stock data across an entire product catalogue, which could indicate scraping activity.

For sensitive account changes, the system can require confirmation from the account holder on their own device, according to Cequence. It added that its API discovery tools help identify which endpoints handle functions such as login, checkout, pricing and stock checks.

Wider pressure

The growth of consumer-facing AI agents is adding pressure on companies to decide whether to permit this kind of access to digital services. Security teams must weigh the potential for new customer traffic against the risk that agents could mask malicious behaviour or make attribution harder when credentials are compromised.

Cequence said the dilemma is as much a governance issue as a technical one, particularly in sectors where customers already expect account access, transactions and service requests to happen with limited friction.

"Every CISO is about to hear the same question from the business, which is whether the company can let AI agents in. Saying no is no longer the safe answer, because customers are choosing agents and will take their spending wherever those agents are welcome. Our job is to make yes the safe answer," said Ameya Talwalkar, Co-founder and Chief Executive Officer of Cequence.