On October 20, 2026, Arkose Labs published The State of Agentic AI Trust Report, Q3 2026, which finds that only 2.3% of the AI agent sessions it classified as legitimate between July 1 and September 30 presented a verified Web Bot Auth signature. The other 97.7% arrived with no verified disclosure of which agent product sent them, even as AI agents reached login, registration and checkout flows at 65.2% of the company's customers.

In Short

AI assistants that log in, sign up and shop for people are now turning up on most of the websites a fraud-prevention company protects, and almost none of them prove who they are. That matters to any business selling online, because a helpful agent acting for a real customer and a fraud bot can look nearly identical to a website's defenses. The figures come from Arkose Labs, which sells tools to sort one from the other, and the company publishes only percentages, with no raw session counts or customer numbers.

What Arkose Labs published

The report is a web page on the Arkose Labs site, presented as a quarterly study and built on the company's own production traffic. An accompanying press release, datelined San Mateo, California, October 20, 2026, describes Arkose Labs as "the leader in agent trust and orchestration." The release headline puts the central finding in one line: personal AI agents, including Meta's Muse, "Identify Themselves Less Than 3% of Time While Handling Sensitive Transactions at Scale."

Every number in the report is Arkose Labs' own. None has been independently audited, and the company sells the products that address the problem the report describes - its footer lists an Agent Trust Manager and a Bot Manager among the components of the Arkose Titan platform. The report also states plainly that "Every figure is a share or a multiple; no raw counts are published." It does not say how many customers contributed traffic, how many sessions were analysed, or how many AI agent sessions sit behind any of its percentages.

The page opens with an anecdote rather than a statistic. "At a recent banking industry summit, the CISO of one of the world's largest banks told the audience that, for the first time in his career, the technology has arrived ahead of the controls," according to the report. The bank and the executive are not named. Kevin Gosschalk, founder and CEO of Arkose Labs, repeats the story in the press release and adds: "The State of Agentic AI Trust Report echoes this and makes it clear how difficult it has become for companies to distinguish legitimate, revenue-driving agents from malicious ones."

The press release headline that circulated by email reads "97.7% of legitimate AI agent sessions lack verified identity," which matches the report. Two smaller differences in wording do appear. The release says "fewer than 3% of these agents" disclose themselves, while the report measures sessions, not agents - a distinction that matters because one agent, discussed below, signs most of its own sessions. The release also says "more than 65% of customer sites" saw agents; the report's figure is 65.2% of Arkose Labs customers, counted on a single day.

How the data was collected

The methodology section is short but specific on several points. The data is "Arkose Labs production traffic only," with test, internal and analyst accounts excluded. Customers are anonymised to industry; agent products are named.

The scope covers protected actions only, which the methodology lists as "login, registration, checkout, password reset and one-time passcode." The window runs from July 1 to September 30, 2026. According to Arkose Labs, agent traffic "was concentrated among technology, SaaS and telco customers, which accounted for most AI agent sessions in Q3." That concentration is relevant to every headline figure, since the industry mix of Arkose Labs' customer base shapes the averages.

The report draws hard lines between categories:

  • AI agent: a session identified as a named AI agent product, such as Muse or Perplexity Comet, covering both good and malicious agents.
  • Personal AI agent: a consumer agent, such as Muse or Instinct, "that opens a real browser and completes tasks for a person."
  • Bot: any other declared or identified automation that is not an AI agent product, counted separately.
  • AI crawler: automation that reads and indexes pages for AI models, also counted separately.
  • Verified disclosure: a valid Web Bot Auth signature.

A malicious agent session is defined as one "assigned an attack risk category." Claude Desktop browser traffic is excluded from the headline figures because, according to the methodology, "its detection also counts people logging in to Claude itself."

Agents detected for the first time during the quarter are, according to Arkose Labs, "reported as newly observed, not as growth." That rule sits awkwardly next to the Muse figures, which are discussed in detail below.

Finding one: almost nobody signs

Web Bot Auth is the cryptographic standard that lets a site verify which agent product sent a request. Cloudflare proposed it in May 2025, and PPC Land reported in November 2025 that Cloudflare had unveiled a registry format for bot and agent authentication so that sites could look up agents' public keys at scale. Adoption has been the open question ever since.

Arkose Labs' answer, for its network, is that adoption barely registers. In the third quarter, only 2.3% of legitimate AI agent sessions presented a verified Web Bot Auth signature. "The other 97.7% carried no disclosure at all," according to the report.

One product carries almost all of that 2.3%. ChatGPT agent signed 78.4% of its sessions, which the report calls "the only agent that signed at scale." Grok Bot for Enterprise also signs its requests, according to Arkose Labs, though no rate is given for it. "Even with this one major agent disclosing itself, the network-wide rate stayed at 2.3%," the report states.

There is a curious detail in the industry split. Outside technology companies, 92.8% of agent sessions carried no disclosure, according to Arkose Labs. That implies a disclosure rate of about 7.2% outside the technology sector - PPC Land's calculation - which is higher than the 2.3% network-wide figure. The report presents the 92.8% as evidence that the pattern "isn't limited to one part of our network," but it does not explain why technology customers, who carry most of the agent traffic, would see lower disclosure. Nor is it clear whether the 92.8% applies to all agent sessions or only the legitimate ones; the chart that carries the number describes it as "agent sessions."

Three populations

To sort agent traffic, Arkose Labs uses a three-way classification that Gosschalk first set out in a blog post titled "Population Two Arrives," dated September 10, 2026, and linked from the report.

Population One covers self-disclosing good agents. "They sign their requests with Web Bot Auth and publish where their traffic comes from, so a site can verify who they are," according to the report. ChatGPT agent and Grok Bot for Enterprise sit here.

Population Two covers non-disclosing good agents, which act for a real user but do not declare themselves. Muse, Instinct and agentic browsers such as Perplexity's Comet "running on people's own laptops fall here," according to the report. "What gives them away is how they behave, not where their traffic comes from."

Population Three covers malicious agents that run "account takeover, fake account creation, payment fraud and other attacks, usually from the cloud and at scale."

In the third quarter, according to Arkose Labs, legitimate agent traffic "sat almost entirely in Population Two." The press release adds an example of how agents present themselves: "Meta's Muse appears on networks as a Chrome browser."

Finding two: agents are not bots, by Arkose Labs' scoring

The second finding compares two groups the report keeps strictly apart. In the third quarter, 77.4% of AI agent sessions were classified as legitimate, compared with 7.9% of known bot sessions.

The report's argument rests on that gap. On the surface, AI agents "carry the same marks as bots: synthetic browsers, cloud infrastructure and machine-timed clicks," according to Arkose Labs, which is why "legacy bot defenses often block AI agents, and in the process turn away the real customers behind them."

Mitchell Davies, lead researcher on the Arkose Cyber Threat Intelligence Research (ACTIR) team, put the same point in the press release. "Every agent we track shows signs of automation somewhere. This was never the question," he said. "The real question is, what did the agent come to do? What is its intent?"

A caveat applies. The classification of "legitimate" is Arkose Labs' own, produced by its own detection, and the report does not describe the criteria beyond the definition that a malicious session is one assigned an attack risk category. The 77.4% figure also implies that 22.6% of AI agent sessions were not classified as legitimate - PPC Land's calculation - a share the report does not break down further in the sections that rendered in the copy reviewed.

Finding three: agents reach every flow

AI agents appeared on login and registration flows in all eight industries Arkose Labs measured: banking and fintech, travel and hospitality, e-commerce and retail, gaming and online gambling, social media and dating, technology, streaming media and education.

The reach figures need careful reading. The comparison is not quarter against quarter. It sets an average of four sampled days between July 15 and September 16 - a period before Arkose Labs began detecting personal AI agents - against a single day, September 30, which includes personal AI agents and Grok Bot. A customer counts only if it had at least 10 named AI agent sessions on a given flow in a day.

On that basis, the share of customers seeing AI agents moved as follows, according to the report:

Protected action Before personal-agent detection September 30
Login 62.1% 74.2%
Password reset 40% 77.8%
Registration 34.9% 55.6%
Combined login and signup 42.9% 57.1%
Search, quote, lookup 50% 50%
Checkout and payment 35% 40%
OTP and SMS send 43.1% 40%
Support forms 25% 50%
Any protected flow 50% 65.2%

Password reset nearly doubled, from 40% to 77.8%, and support forms doubled from 25% to 50%. Search and lookup flows did not move. One-time passcode and SMS flows fell slightly, from 43.1% to 40%. Personal AI agents alone reached 50% of customers on September 30, according to Arkose Labs.

Two inconsistencies in the source are worth recording. The methodology limits the scope to five protected actions, yet the chart includes search, support forms and a combined login and signup category. And because part of the increase reflects new detection coming online rather than new agent behaviour, the before-and-after columns do not measure growth on a like-for-like basis - a point the report's own "newly observed, not as growth" rule would seem to require.

The volume figure is modest. In the third quarter, according to Arkose Labs, "roughly one in every 5,200 protected sessions came from a named AI agent," or about 0.02% of protected sessions by PPC Land's calculation. "The share is still small. The reach is not," the report states.

Finding four: Muse

Meta put Muse inside WhatsApp and a standalone app on September 8, 2026, with each user's agent running on its own cloud virtual machine. According to Arkose Labs, Muse sessions grew more than 30x in September, while Perplexity Comet, ChatGPT agent, Grok and Gemini Spark "held roughly flat."

A chart in the report shows daily sessions flagged by Arkose Labs' AI agent and browser detections from September 2 to October 1, 2026, indexed so that the single highest day across all agents equals 100. Muse reaches that peak. No absolute numbers are given. The chart, by the report's own note, "runs one day past the end of Q3."

The methodology adds context that changes how the 30x figure reads. Arkose Labs detection for Muse went live on September 22. Muse figures before that date "come from applying the same detection rule to stored fingerprint data, and from Sept. 26 onward the live detection and the reapplied rule match exactly," according to the report. Two weeks of the September curve, in other words, are a retrospective reconstruction, and the report does not say how closely the reapplied rule matched live detection between September 22 and 26.

Instinct, the second personal agent, also grew quickly, peaked around September 19 and dipped by month end, according to Arkose Labs. The established agents grew 37.8% from July to September. Perplexity Comet, which carried the most agent sessions over the quarter as a whole, cooled 30.1% over the same period. "The market is churning: newcomers can take the lead in weeks, and leaders can fade just as quickly," the report states.

Those movements line up with what other vendors have reported. HUMAN Security data covered by PPC Land showed Muse averaging 72% of daily AI agent requests in its early observations, at 5.2 times the volume of ChatGPT Agent. DataDome's Q3 report found that Muse took a 33% share of agentic browser requests in September despite being measured for only nine days, while Comet fell. Sensor Tower estimates showed Muse passing 5 million downloads in its first three weeks.

One point the report does not address: Arkose Labs' company boilerplate lists Meta among the businesses it protects, alongside Roblox and Expedia. The report names Muse as Meta's product and analyses its traffic, but it says nothing about that commercial relationship.

Finding five: risky-looking is not the same as hostile

The fifth finding contrasts the technical designs of Muse and Instinct, two personal agents that, according to Arkose Labs, "do the same job, but they run on opposite designs."

Muse "operates from the cloud on a small, stable set of device fingerprints," according to the report. Instinct "connects through home and mobile networks and keeps rotating its device fingerprints, the same tradecraft attackers use to dodge reputation checks." That makes Instinct, in Arkose Labs' terms, "a Population Two agent that looks like a Population Three agent."

The headline number follows. Instinct's design made 96.8% of its sessions look medium or high risk, according to Arkose Labs. "Yet neither Instinct nor Muse had a single session linked to an attack." The press release subheadline rounds the figure to "Nearly 97%" and describes those sessions as "Presented as Adversarial," a stronger word than the report's "medium or high risk."

The sample behind the 96.8% figure is narrow. According to the methodology, "Muse and Instinct technical profiles come from the first eight hours after detection went live (Sept. 22 to 23 UTC)." The report does not state whether the finding that neither agent had a session linked to an attack covers the same eight hours or the full quarter.

The description of Muse as cloud-hosted matches DataDome's finding that 99.3% of sampled Muse requests came from cloud and CDN infrastructure. It conflicts with research from Profound, which PPC Land covered on October 11, stating that both Muse and Instinct route traffic through residential internet connections. Arkose Labs' account places only Instinct on home and mobile networks.

The behavioural testing in Gosschalk's September 10 blog post adds detail the report itself omits. According to that post, both agents flagged fabricated financial sites as illegitimate; Muse refused to fill forms with a made-up identity while Instinct allowed it; and both would log into a bank account and transfer funds, with a warning to double-check amounts.

Finding six: neither allow-all nor block-all

The sixth finding concerns the flows agents share with attackers. According to Arkose Labs, "70.5% of registration sessions were fake-account attempts." The report does not specify whether that figure covers all registration sessions on its network or only those with automation present.

"Businesses can't wave all automated traffic through or shut it all out; doing so turns away real customers and the revenue they bring," according to the report.

The copy of the report reviewed for this article did not render the body of this section, the comparison chart for finding five, or the recommendations section titled "What businesses can do now." The web page could not be retrieved separately. The figures above for findings five and six come from the key-findings summary, the methodology and the press release.

Why this matters for marketers

For advertisers and retailers, the report sharpens a question PPC Land has been tracking since September. When Amazon blocked Muse from shopping on its site, one of its stated objections was that Muse does not identify itself when browsing. Arkose Labs' data suggests that objection applies to almost every legitimate agent on its network, not just Meta's.

The consequences run in two directions. A retailer whose bot defences block an unidentified agent at checkout loses a sale placed by a real customer, and, as Gosschalk argued in his September post, the business may not learn the block happened. A retailer that waves all agent traffic through exposes registration flows where, by Arkose Labs' count, 70.5% of sessions were fake-account attempts.

Analytics teams face a related problem. If 97.7% of legitimate agent sessions carry no verified identity, then site analytics, conversion tracking and attribution tools that rely on user-agent strings or declared identities cannot reliably separate agent-driven visits from human ones. The proportion is small - one in about 5,200 protected sessions - but the growth curve for Muse alone shows how quickly that can change.

Industry efforts to fix this are moving on several fronts. Cloudflare said on October 16 that it would grade Verified bots on whether they obey robots.txt and slow down after HTTP 429 responses, shifting attention from who a verified bot is to how it behaves. Experian brought DataDome into its agent-verification programme on October 1 to add session-level intent checks. And HUMAN Security has been pitching AI agent visibility to marketing teams since April, arguing that automation is growing faster than human traffic.

Every one of those companies, Arkose Labs included, sells a product built on the premise that agent intent can be read from behaviour. The Arkose Labs report is evidence for that premise from a company with a stake in it. The open question - whether agent makers such as Meta will adopt signing standards like Web Bot Auth, or whether sites will have to keep inferring identity from fingerprints and timing - is one the report raises but cannot answer. Only one major agent, ChatGPT agent, currently signs at scale. Whether others follow will decide how much of this guessing remains necessary.

Many of these agents are, in mechanical terms, a computer use agent wrapped in a consumer app: software that opens a real browser and clicks through pages on a person's behalf. That design is what lets them reach login, registration and checkout flows built for humans, and it is also why, without a signature, they are so hard to tell apart from automation built to abuse those same flows.

Timeline

Summary

Who: Arkose Labs, a San Mateo, California fraud and bot-detection company, with comments from founder and CEO Kevin Gosschalk and Mitchell Davies, lead researcher on its ACTIR team. The agents analysed include Meta's Muse, Instinct, ChatGPT agent, Perplexity Comet, Grok and Gemini Spark.

What: The State of Agentic AI Trust Report, Q3 2026, which finds that 97.7% of legitimate AI agent sessions on Arkose Labs' network carried no verified Web Bot Auth signature, that 77.4% of AI agent sessions were classified as legitimate against 7.9% of known bot sessions, that 65.2% of customers saw AI agents on protected flows on September 30, and that Muse sessions grew more than 30x in September. All figures are vendor-published percentages with no raw counts, and some rest on short samples or reconstructed data.

When: The report and press release were published on October 20, 2026. The data covers July 1 to September 30, 2026, with a daily chart running to October 1 and Muse and Instinct technical profiles drawn from eight hours on September 22 to 23.

Where: Arkose Labs' production traffic across customers in eight industries, concentrated among technology, SaaS and telco businesses, limited to protected actions such as login, registration, checkout, password reset and one-time passcode flows.

Why: AI agents acting for real customers now reach the same flows fraudsters target, yet almost none prove which product they are. Businesses that block all automation risk turning away paying customers, while those that allow it all risk fake accounts and fraud - and the report argues that intent, not appearance, has to decide which is which.