AI agent security: Cequence takes on Meta’s Muse and the bots that act like customers
Cequence Security has launched Agent Trust, a capability in its Application and API Protection platform that verifies AI agents which identify themselves and detects the ones that do not. To make the case, it published research with a sharp edge: within two weeks of Meta’s 8 September launch of its Muse personal AI agent, Cequence found traffic matching Muse at more than half of the customers it studied. Most of those businesses, it says, would not have known.
The reason is simple and uncomfortable. Muse presents itself as an ordinary Chrome browser rather than an AI agent, so to standard security checks it looks like a person. Cequence identified it only through behavioural analysis. The finding is a vivid illustration of a problem now arriving at speed: AI agents that act on behalf of real customers are indistinguishable from bots — and, increasingly, from attackers using stolen agent credentials.
What Cequence found
Cequence says it analysed traffic across customers in financial services, retail, travel and software from 1 to 24 September 2026, and that Muse traffic grew nearly sixfold from the first week to the last, depending on the industry. Muse, it notes, runs a real Chrome browser in the cloud, directed by an AI model that reads each page and decides what to click, and routes its traffic through a consumer VPN. It does not sign its requests or identify itself as an agent.
Three findings stand out. First, at financial institutions, Muse logged into customer accounts and completed multi-factor authentication on users’ behalf, with confirmed successful sign-ins — which means, for those businesses, a successful MFA login no longer proves a human is on the other end. The MFA finding deserves emphasis because it removes a control many businesses treat as settled. Multi-factor authentication proves that whoever holds the second factor is the account holder; if an agent completes it on the user’s behalf, the check confirms a valid session, not a human.
That does not make MFA useless — it still stops an attacker without the second factor — but it means AI agent security cannot rest on authentication alone. Second, Muse browsed like a bot and bought like a customer: most sessions browsed and left, the pattern long used to spot bots, while a small share ended in a completed purchase. Third, a travel and hospitality customer began blocking nearly one in five Muse requests, targeting only the ones that looked abnormal, while letting the rest through.
Samples and Methods Not Disclosed
Those are Cequence’s figures, drawn from its own customers, and the sample and method are not disclosed. The finding matters for AI agent security because it shows the traffic is already widespread, not hypothetical. But the direction is corroborated by events: Meta launched Muse on 8 September as a personal agent that can send email, book travel and shop, and by late September Amazon had blocked it from buying on its site.
Why AI agent security is the new problem
For years, bot defence rested on a workable assumption: automated traffic was mostly hostile, so you blocked it, and human traffic was legitimate. AI agents break that assumption. A Muse session is automated, signs in with legitimate credentials, and by most legacy definitions is a bot — yet it is usually a paying customer’s assistant doing exactly what it was asked to do.
That creates a genuine dilemma. Block the agent, and you turn away a customer who chose to shop through it; let every agent through unchecked, and you also admit every attacker carrying a stolen agent token. The old detection signals weaken at the same time: a completed purchase no longer distinguishes a buyer from a bot, and a passed MFA no longer proves a person. AI agent security, in other words, is less about spotting automation and more about judging intent. The abuse case sharpens the stakes.
An attacker who steals an agent credential can replay it from their own infrastructure, presenting a valid identity while behaving nothing like the agent it claims to be. Legacy defences that trust a passing identity check would wave it through. That is why behavioural profiling sits alongside identity verification in Cequence’s design — the credential gets an agent in, but the behaviour decides whether it stays. That combination — identity plus behaviour, judged action by action — is Cequence’s definition of AI agent security, and it sets a more demanding standard than the bot defence it replaces.
How Agent Trust works
Cequence’s answer is to combine two layers it already ran separately. The first is identity: a “detected agents inventory” that lists every agent in an organisation’s traffic, including ones like Muse that do not identify themselves, and an “issuer registry” that verifies an agent’s identity against providers the organisation trusts. The registry is protocol-agnostic — supporting a new agent-identity framework means registering an issuer, not waiting for a product update.
The second is behaviour. Cequence’s Intent Graph builds a profile of how each agent behaves, request by request, and compares it against what that agent’s role implies. The point is that identity alone is insufficient: if an attacker steals an agent credential and replays it from a script, the credential still checks out, but the behaviour does not match. The platform then enforces at the transaction level — blocking, rate-limiting or challenging a specific action rather than the agent behind it. An agent that normally checks order status but suddenly pulls price and stock for every product gets its scraping stopped while the agent keeps working for its customer.
The fight over identification
Cequence is not solving this alone, and the industry has not agreed on how. Cloudflare has proposed Web Bot Auth — cryptographically signed HTTP requests built on the IETF’s HTTP Message Signatures standard — and now recognises “signed agents”; AWS WAF Bot Control supports the same approach. Several agent-identity frameworks compete, including Skyfire, Visa’s Trusted Agent Protocol, Google’s AP2 and the OpenAI–Stripe Agentic Commerce Protocol.
Amazon’s stance makes the stakes concrete. Its Conditions of Use require shopping agents to identify themselves openly and not mimic human browsing — exactly what Muse does not do — and it blocked Muse on that basis, alleging that Muse stores customer credentials and scrapes account data. Meta disputes the characterisation. The dispute is not really about one agent; it is about whether sites get to decide which automated visitors to admit, and on what evidence. The standards gap is the reason vendors hedge. Web Bot Auth gives sites a cryptographic way to confirm that a request came from a named agent platform, but it says nothing about which user directed it or whether that user is trustworthy.
Cequence’s point is that a verified identity still has to be watched, because the same signature can front a well-behaved assistant or an abusive script. AI agent security, on that view, is an ongoing judgement, not a one-time gate.
The consumer-agent land grab
Muse is one of a wave. Amazon runs Alexa for Shopping, built to keep purchase decisions inside its own walls; Google, Walmart, Disney, Uber and OpenAI all have or plan personal shopping agents, and OpenAI launched its own always-on agents, “Dots,” three weeks after Muse. Mastercard predicts one in ten shoppers will use a personal AI agent by 2030. Meta monetises Muse through subscriptions and a transaction fee, which is why it wants the agent to be useful enough that people route decisions through it.
That commercial logic is what makes Cequence’s pitch land. If agents become a sales channel, blocking them outright costs revenue, and the security team’s instinct — block anything automated — becomes a business liability. Cequence’s framing, that the job is to “make yes the safe answer,” is a vendor’s, but the tension it describes is real.
What to watch
For security teams, the practical questions are whether behaviour-based agent detection holds as agents proliferate, and whether the identity standards converge or fragment. For businesses, the test is whether they can serve agent-borne customers without admitting attackers — a balance that will show up in fraud metrics, not launch announcements. And, for the agent platforms, the open issue is whether they adopt signed identification voluntarily or are pushed into it by sites like Amazon that can simply refuse them.
What the announcement does and doesn’t establish
It establishes a generally available product, a plausible mechanism and a concrete research finding that Muse traffic is widespread and hard to see. It does not establish the size or reliability of Cequence’s sample, prove that Agent Trust catches what it claims, or resolve the identification dispute between Meta and Amazon. Moreover, it is an early answer to a problem the market has only just started to feel.
The honest summary is that Meta’s Muse has made the AI agent a customer and a bot at once, and Cequence is selling the tooling to tell the difference — or to act on the action rather than the actor. Whether behaviour-based governance scales as agents multiply is the question the next year of deployments will answer.
Editor’s Note: This article draws on the company’s announcement and public materials, plus Meta‘s own Muse announcement, independent press coverage and public standards documentation on agent identification. The Muse traffic findings are Cequence‘s own research; the sample and methodology are not disclosed, and Meta and Amazon did not comment for this article. No interview was conducted. See the source list in the publication package.