---
title: "AI agent detection: who is really on your site? | PostCliq"
description: "Muse, Instinct and Grok Bot now visit websites without saying who they are. What that means for your analytics, firewall and enquiry form, and what to do."
url: "https://postcliq.com/blog/ai-agent-detection"
---

# AI agent detection: Muse, Instinct and Grok Bot stopped saying who they are

Three popular AI assistants now visit websites looking like people. Identity is becoming the price of entry: reward agents that sign their requests, slow the ones that act like machines, and keep your enquiry path open to both.

By [Nirmal Gyanwali](https://postcliq.com/blog/author/nirmal-gyanwali) Updated 7 November 2026 8 min read

On this page

1. The short answer
2. What did Fingerprint find?
3. How much of your traffic could be an AI agent?
4. Why are AI agents hiding their identity?
5. How do AI agents identify themselves when they want to?
6. Does Google Analytics count AI agents as visitors?
7. Should a small business detect AI agents at all?
8. Where is this heading?
9. What to do next
10. Frequently asked questions

## The short answer

Key takeaways

- Fingerprint said on 4 November 2026 that Muse, Instinct and Grok Bot reach websites without a verifiable identity. Grok Bot signed its requests until around 9 October 2026, then stopped.
- Fingerprint says Instinct logs in with a person's own credentials and texts them for the SMS code when a site asks for one.
- Some agents do identify themselves. ChatGPT's cloud browser signs every request with Web Bot Auth, and Meta and Sierra's draft Personal Agent Protocol is built on agents saying who they are.
- Google Analytics 4 removes known bots automatically, but an agent posing as a person is not a known bot. It can land in your reports as a visitor, and you cannot see how much was removed.
- Our view: identity will become the price of entry. Reward agents that sign their requests, rate-limit the ones that act faster than a person could, and make your enquiry path work for both.

## What did Fingerprint find?

Fingerprint found that three consumer AI agents act on websites while looking like ordinary people. Its 4 November announcement describes agents that give no verifiable identity, do not sign their requests, and in Muse's case alter the browser fingerprint and suppress the automation flags most bot detection relies on. Its detection now labels this traffic as inferred agents, separate from agents that sign their requests ( [Fingerprint's release, via AiThority](https://aithority.com/security/fingerprint-expands-bot-detection-to-uncover-hidden-muse-instinct-and-grok-bot-traffic-as-ai-agents-increasingly-conceal-their-identities/) ).

The detail differs by agent, and it is worth reading closely, because each one fails a different check a website might rely on.

| Agent | Who makes it | Signs its requests? | How it looks to your site |
| --- | --- | --- | --- |
| Muse | Meta | ✕ No | A real browser on a cloud computer, with an altered fingerprint and automation flags suppressed |
| Instinct | Spear Street Technology | ✕ No | A person logged in with their own credentials, including the SMS code the agent texts them for |
| Grok Bot | xAI | ✕ No, since about 9 October 2026 | A real, visible browser that can route through its user's own connection |
| ChatGPT cloud browser | OpenAI | ✓ Yes, Web Bot Auth | A signed request your CDN can verify against OpenAI's published keys |

Source: [Fingerprint on Grok Bot , on Instinct, on Muse, and OpenAI Help Center](https://fingerprint.com/blog/how-to-detect-grok-bot/)

Grok Bot is the telling case. Fingerprint says it used to announce itself by signing its requests with Web Bot Auth, and that around 9 October 2026 those signatures stopped. In Fingerprint's words, it "stopped saying its name". Because it runs a real, visible browser and can use its owner's connection, the usual tells of automation and data-centre addresses may not appear.

Instinct shows what that means in practice. Fingerprint's announcement cites a CNN report that Instinct pinged the restaurant booking platform Resy hundreds of times an hour on behalf of one user, which ended in that user's account being deactivated. The person wanted a table. Resy saw abuse.

Two caveats. Fingerprint sells bot detection, and the behaviour it describes has not been independently confirmed: the release carries no statement from Meta, Spear Street or xAI. Fingerprint itself says its label reflects a missing identity, not proven malice.

## How much of your traffic could be an AI agent?

Nobody can tell you for your own site from the outside, and the honest figures are partial. What the published data shows is that agents are already a meaningful share of automated traffic, that they arrive fast, and that most of them do not look like the bots your tools were built to catch.

Agents at the door, autumn 2026

**Over 50%** of internet traffic is now non-human, by Cloudflare's measure [Cloudflare, July 2026](https://blog.cloudflare.com/agentic-internet-bot-report/)

**33%** of agentic browser requests DataDome saw in September came from Muse, measured over only nine days [DataDome, via PPC Land, Oct 2026](https://ppc.land/metas-muse-gains-a-33-share-of-ai-browser-traffic-in-9-days-datadome-finds/)

**99.3%** of Muse requests in DataDome's sample came from cloud and CDN providers, not home connections [DataDome, via PPC Land, Oct 2026](https://ppc.land/metas-muse-gains-a-33-share-of-ai-browser-traffic-in-9-days-datadome-finds/)

DataDome did not publish its sample size or explain how it attributed requests to Muse, and Cloudflare's figure covers its own network. Read them as direction, not as a number for your business. The direction is clear enough: personal agents went from launch to a third of agentic browser traffic in weeks, and they did it without a name badge.

## Why are AI agents hiding their identity?

Because declaring yourself gets you blocked. Amazon cut Muse off from buying on Amazon.com on 20 September 2026 and said one reason was that the agent does not identify itself when it browses ( [PPC Land](https://ppc.land/amazon-blocks-metas-muse-ai-agent-from-shopping-on-its-site/) ). JPMorgan Chase confirmed in October that it does not permit third parties to access customer accounts ( [CNBC](https://www.cnbc.com/2026/10/13/jpmorgan-ai-agents-account-access.html) ). An agent that announces itself is easy to refuse. An agent that looks like a person gets the errand done, at least until the site notices. We set out the choice Amazon and Walmart made in different directions in our guide to [whether to block AI agents](https://postcliq.com/blog/block-ai-agents) .

There is also money in the background. On 3 November Fortune reported Elon Musk saying Grok Bot's running costs were unsustainably high relative to its revenue, and OpenAI's head of ChatGPT's consumer business described its Dots agents as "on the compute heavy side" ( [Fortune](https://fortune.com/2026/11/03/musk-says-grok-bots-costs-are-unsustainably-high-while-openai-admits-dots-are-compute-heavy-is-the-personal-ai-agent-push-dead-on-arrival/) ). An agent that runs a whole browser on a cloud computer for every errand is expensive. Being blocked halfway through a booking and starting again is more expensive still.

Our view: hiding is a phase, not a settled strategy. It works while few sites can tell the difference. As detection vendors label these agents and large platforms write rules for them, the cheaper path for an agent maker will be to identify itself and be let in on known terms. The open question is how long that takes, not which way it goes.

## How do AI agents identify themselves when they want to?

With a cryptographic signature on every request, and soon with a published protocol for what they may do once inside. Two pieces matter for a business website.

**Web Bot Auth.** The agent signs each HTTP request with a private key and publishes the matching public key at a fixed address, `/.well-known/http-message-signatures-directory` . Every request carries `Signature` , `Signature-Input` and `Signature-Agent` headers, and your CDN checks them against the published key. A user-agent string can be copied by anyone. A valid signature cannot ( [Cloudflare developer docs](https://developers.cloudflare.com/bots/reference/bot-verification/web-bot-auth/) ).

OpenAI already does this. Its help centre says ChatGPT's cloud browser signs every outbound request under the HTTP Message Signatures standard, RFC 9421, with a `Signature-Agent` of `https://chatgpt.com` . Cloudflare, Akamai, HUMAN and Vercel recognise and verify it automatically. OpenAI also notes that at launch the cloud browser cannot sign in to websites or complete payments.

**Personal Agent Protocol.** Sierra published a draft of the protocol, nicknamed Poppy, on 9 October 2026, three days after announcing it with Meta. The personal agent identifies itself "so the company always knows when an agent is acting for a customer". A business publishes one file at `/.well-known/poppy.json` describing what agents can do and how customers sign in. An agent can start as a guest, checking stock or a returns policy, and moves to account tasks only after the customer signs in and approves the access ( [Sierra](https://sierra.ai/blog/poppy) ). It is a draft, so build nothing on it yet. It is worth watching because Meta, which makes Muse, is one of its backers.

| Question | Web Bot Auth | Personal Agent Protocol |
| --- | --- | --- |
| What it proves | Which company's agent sent this request | Which agent, for which customer, with which permissions |
| Where the proof lives | Signature headers, keys at a well-known address | Agent identity plus a customer-approved session |
| What the business publishes | Nothing; the CDN verifies | A /.well-known/poppy.json file |
| Status, November 2026 | In use by ChatGPT's cloud browser | Draft, open to change |

Source: [Cloudflare , OpenAI Help Center, Sierra](https://developers.cloudflare.com/bots/reference/bot-verification/web-bot-auth/)

Identity is one half of the handshake. The other half is telling a trusted agent what it can do on the page, which is the job of the [WebMCP standard for marketing websites](https://postcliq.com/blog/webmcp) .

## Does Google Analytics count AI agents as visitors?

Some of them, and you cannot tell how many. Google says GA4 excludes known bot traffic automatically, identified through Google's own research and the IAB's International Spiders and Bots List. It also says you cannot switch that exclusion off and cannot see how much traffic it removed ( [Google Analytics Help](https://support.google.com/analytics/answer/9888366) ).

That works for crawlers that announce themselves. It does not work for an agent built to look like a person. An agent that runs a real browser also runs your analytics tag, so its visit can be counted as a human session, with a bounce, a page view or a form start attached. As these agents grow, part of the change you see in sessions, engagement or conversion rate may not be people at all.

This is why a [GA4 audit](https://postcliq.com/blog/ga4-audit-checklist) now needs a new question alongside the usual ones: if a burst of very fast, very direct sessions turns up from cloud hosting regions, is that a campaign, a scraper or someone's assistant doing their shopping? You will not answer it from GA4 alone. Your CDN or firewall logs, where signed agents show up by name, are the better place to look.

## Should a small business detect AI agents at all?

Yes, but to treat them well, not to keep them out. Most business websites do not sell concert tickets or restaurant tables in short supply. For them, an agent that reads the services page, compares prices and fills in the enquiry form is a customer arriving by a new route. The risk is not the agent. It is a firewall rule or a form that quietly refuses it.

We set out where those accidental blocks come from in our guide to [what agents need from a site, alongside llms.txt](https://postcliq.com/blog/llms-txt) , and Shopify has already shown the other side of the argument by [opening checkout to agents](https://postcliq.com/blog/shopify-agentic-commerce) . The sensible policy for most businesses has three tiers.

- **Signed agents get the front door.** If your CDN verifies Web Bot Auth, allow verified agents to read, search and enquire. Cloudflare and Akamai do this without custom work.
- **Unidentified agents get the same as a person, at a person's speed.** Let them read and enquire. Rate-limit actions that would be unfair at machine speed, such as booking scarce slots, which is what Fingerprint recommends for Instinct on limited-inventory pages.
- **Money and account changes get a human check.** Step up verification when anyone, agent or not, changes a password, an address or a payment method.

If your site runs on WordPress, the rule that challenges an agent usually lives in a security plugin or in the host's firewall, not in the page itself. That is where a WordPress specialist such as WP Creative would start when an enquiry form works for staff but not for the assistants their customers now use.

## Where is this heading?

Our view: within a year, being able to tell a signed agent from an anonymous one will matter as much to a website as telling Googlebot from a scraper did a decade ago. The pressure runs both ways. Platforms such as Amazon are refusing anonymous agents, and banks such as JPMorgan are keeping outside agents out of customer accounts. Agent makers face high running costs and cannot afford failed errands. Standards that let an agent say who it is and what it is allowed to do already exist in working and draft form.

That points to a web with two lanes. Agents that sign in get trusted, faster access, the way verified search crawlers do now. Agents that hide get treated as unknown visitors and slowed down when they act like machines. The businesses that win enquiries from both lanes will be the ones whose content is readable in plain HTML, whose facts are clear, and whose contact path works without a mouse. That is the post-click problem again, with a new kind of visitor. Our guide to [AI personal assistants and your website](https://postcliq.com/blog/ai-personal-assistants-websites) covers what those assistants do once they arrive.

## What to do next

1. **Run the** [**agent readiness check**](https://postcliq.com/free-tools/can-ai-agents-read-my-site) to see whether your firewall, robots.txt and page content let an agent in and let it read.
2. **Ask your host or CDN whether it verifies Web Bot Auth.** If it does, allow verified agents and check the bot log for signed visitors by name.
3. **Find your accidental blocks.** Look for CAPTCHAs, human-verification buttons and aggressive firewall rules on the pages agents need most: services, pricing and contact.
4. **Rate-limit, do not ban.** Where something is scarce or sensitive, slow down actions faster than a person could make, rather than blocking a whole class of visitor.
5. **Annotate your analytics.** Note when agent traffic is likely to have started, so a jump in fast, low-engagement sessions is not mistaken for a campaign problem.
6. **Test your enquiry form without a mouse.** Fill it in with the keyboard alone and submit it. An agent needs the same clear path.

## Frequently asked questions

### What is AI agent detection?

AI agent detection is telling an AI agent acting for a person apart from a human visitor or an ordinary bot. Some agents make it easy by signing their requests with Web Bot Auth. Others, according to Fingerprint, look like real browsers and give no identity, so detection relies on behaviour and device signals instead.

### What is Web Bot Auth?

Web Bot Auth is a way for a bot or agent to prove who sent a request. It signs each request with a private key and publishes the public key at a well-known address, so a CDN can check the signature. ChatGPT's cloud browser uses it. A user-agent string can be faked; a valid signature cannot.

### Should I block AI agents I cannot identify?

For most business websites, no. Blocking a whole class of visitor turns away customers who sent an assistant on their behalf. Let unidentified agents read and enquire at a person's pace, rate-limit actions on scarce items, and add a human check to payments and account changes.

### Do AI agents show up in Google Analytics?

Some do. GA4 automatically removes known bots, but an agent running a real browser and posing as a person can be counted as a normal session. Google says you cannot see how much bot traffic GA4 removed, so check your CDN or firewall logs for agents that identify themselves.

## Can an AI agent get through to you? Check it free.

PostCliq checks firewall access, readable HTML, crawler rules and the enquiry path, and puts three fixes first.

Free. No credit card.

![Nirmal Gyanwali, founder and chief executive of WP Creative.](https://postcliq.com/authors/nirmal-gyanwali.jpg)

Written by

[Nirmal Gyanwali](https://postcliq.com/blog/author/nirmal-gyanwali)

Founder and CEO, WP Creative · Sydney, Australia

Nirmal Gyanwali has spent more than twenty years building websites, and most of that time watching them fail at the one job the business actually bought them for, which is turning a visitor into an enquiry. He founded WP Creative in Sydney in January 2016.

- [LinkedIn](https://www.linkedin.com/in/nirmalgyanwali/)
- [YouTube](https://www.youtube.com/@nirmalgyanwali)
- [Instagram](https://www.instagram.com/nirmalgyanwali)
- [TikTok](https://www.tiktok.com/@nirmalwpc)

## Keep reading

- [**Should you block AI agents? Amazon says yes, Walmart says come in**](https://postcliq.com/blog/block-ai-agents)
- [**What is WebMCP? Your contact form is about to become an agent's tool**](https://postcliq.com/blog/webmcp)
- [**llms.txt: what it is, who reads it, and whether your site needs one**](https://postcliq.com/blog/llms-txt)

[More on AI search and visibility](https://postcliq.com/blog/topic/ai-search) · [All articles](https://postcliq.com/blog)