Cybersecurity company Cequence Security says traffic resembling Meta’s Muse personal AI agent appeared at more than half the customer organisations it studied, even though the software presented itself as an ordinary browser rather than explicitly identifying as an automated agent.
The company published its findings on 7 October after analysing traffic across monitored customers in financial services, retail, travel, software and other sectors between 1 and 24 September. It did not disclose the number of organisations in the sample, so the result cannot be extrapolated to half of all commercial websites.
According to Cequence, the median participating customer saw traffic attributed to Muse grow nearly sixfold within about two weeks of its first appearance. This describes observed activity within a selected vendor customer base, not a measured rate of growth for agent activity across the internet.
Muse, introduced by Meta on 8 September, uses a cloud-hosted browser to undertake tasks on a person’s behalf. Cequence says each agent operates through Chrome and can browse products, compare offers, complete forms and proceed through checkout using a consumer virtual private network connection.
Because requests resemble ordinary browsing, website operators cannot necessarily identify the visitor as an agent using conventional browser checks. Cequence says it relied on behaviour patterns, including unusually rapid changes in browser-version distribution that suggested centrally managed software.
Its researchers also observed activity at financial institutions in which sessions attributed to Muse successfully signed into customer accounts and completed multifactor authentication. Successful sign-in does not establish that an account was compromised: a customer may authorise software to use legitimate credentials and approve a requested action.
The finding nevertheless raises a practical distinction between establishing that access is permitted and understanding whether a particular automated action falls within the customer’s intentions. A login check alone may not establish whether the next request comes directly from a person or from software working for them.
In retail environments, Cequence reported sessions searching for products, comparing options, filling baskets and occasionally completing purchases. Most observed sessions involved browsing without a transaction, a pattern that could resemble conventional automated scraping to a security service.
Blocking all such activity would risk disrupting a customer who has chosen to use an agent to research or buy a product. Allowing every request without examination could create a different exposure if an agent accesses data or performs transactions beyond the user’s authorisation.
A travel and hospitality customer in the study began blocking nearly one in five requests attributed to Muse in late September, according to Cequence. Its security team reportedly targeted activity judged abnormal while allowing other requests from the same agent service.
That proportion is an enforcement choice at one monitored customer, not proof that one fifth of Muse requests were malicious or that any particular blocked request was part of a breach. Cequence has not published independent adjudication of those individual decisions.
The research accompanied the launch of Agent Trust within Cequence’s Application and API Protection platform. The company says the capability combines verification of agents presenting an identity with behavioural detection for agents that do not identify themselves.
Its described controls include an inventory of detected agents, a registry of trusted identity issuers, records of individual agent actions and the ability to challenge or restrict specific requests. Sensitive activities, such as changing account details, may receive additional confirmation from the account holder.
Those are product capabilities described by the supplier rather than independently verified reductions in fraud. An identity check can help identify a source, but organisations still need rules governing what an authenticated agent may do and how exceptions will be investigated.
Online businesses face operational choices as automated visitors become more capable. Retailers may want agents to compare stock and complete purchases, while financial services organisations may require tighter checks on account changes, payments and disclosure of customer information.
Those decisions extend into customer experience and dispute handling. Records showing the account used, instructions received and transactions attempted may help distinguish an authorised purchase from a contested or unexpected action, provided organisations can capture and retain appropriate evidence.
Cequence’s observations indicate that some website security systems may struggle to distinguish legitimate agent activity from ordinary customer browsing. The study does not establish the prevalence of undeclared agents across the wider internet, nor does it demonstrate that authentication through Muse is itself a security incident.
The commercial challenge is to accommodate customers choosing automated assistance while maintaining control over sensitive transactions. Further independent measurements will be needed to assess how widely the reported behaviour occurs and which protective methods work reliably in practice.
You must be logged in to post a comment.