Two companies now generate nine in ten of the AI agent requests that reach the websites HUMAN Security protects. According to the October 2026 edition of HUMAN's State of Agentic Traffic benchmark, published on November 9, 2026, Meta and OpenAI accounted for 89% of agent requests during the month, a figure HUMAN rounds to about 90%, with Meta's Muse alone responsible for 59%. Total agentic traffic in October was 2.6 times its September level and roughly eight times its August level.

In Short

HUMAN Security's October data shows AI agent traffic on the sites it protects grew 2.6 times in a month, and Meta's Muse plus three OpenAI products now send about nine in ten agent requests. That matters to retailers, travel companies and publishers because the agents reaching their pages increasingly come from a handful of platforms that already reach people at scale, while standalone consumer agentic browsers such as Perplexity's Comet have shrunk to a sliver. Agents still mostly research rather than buy, with 85% of requests going to product and search pages and 1.9% reaching checkout, although the number of checkout requests roughly doubled in October.

From newcomer to majority in two months

The report, written by Aviad Kaiserman with analysis from HUMAN's Satori Threat Intelligence Team, is the latest in a monthly series that extends the company's annual State of AI Traffic & Cyberthreat Benchmark Report. Its central finding is the speed of Muse's rise.

Meta launched Muse on September 8, 2026 as a US-only personal agent able to run its own browser, fill forms, book travel and check out. Within two months, according to HUMAN, it went "from a new entrant to 59% of all agentic traffic." Its share rose 19 percentage points from September, which puts its September share at about 40% by PPC Land's calculation, and its traffic nearly quadrupled month over month. Muse now sends 3.7 times as many requests as ChatGPT Agent, the next-largest agent.

The adoption figures behind that traffic are large. Sensor Tower estimated that Muse passed 10 million US downloads within 40 days of launch, and on Meta's third-quarter earnings call on October 21, the company said more than 10 million people in the US and Canada had set up Muse personal agents, with about a quarter of them using it on any given day.

Other vendors measured the same surge with different yardsticks. HUMAN's own early observations, published on September 28, put Muse at an average of 72% of daily AI agent requests, a daily average over an unstated window rather than a full-month share. DataDome counted Muse at 33% of agentic browser requests in September, although it only detected the agent for the last nine days of the month. The October figure of 59% is therefore not directly comparable with either, but the direction is the same in all three.

OpenAI's three-product hand

OpenAI holds second place with three products in the top ten, together accounting for about 30% of agentic traffic. The detail matters more than the total, because the three moved in different directions.

ChatGPT Agent lost share, falling from 28.5% to 15.9% as Muse grew faster, yet its traffic still rose 44%. Codex Browser, which HUMAN describes as a developer-focused agentic browser, moved into third place: its share rose from 7.7% to 8.8% and its traffic nearly tripled, at 2.9 times. The Codex Chrome extension climbed from sixth to fourth, with its share rising from 3.3% to 5.2%. HUMAN gives no traffic multiple for the extension; by PPC Land's calculation from the two shares and the month's overall growth, its request volume roughly quadrupled.

The text figures add up to 29.9%, while the chart rounds ChatGPT Agent to 16% and the three products to exactly 30%. Meta and OpenAI's four agents hold 89% of requests between them.

Anthropic is the only other company with a meaningful presence. The Claude Chrome extension, which Anthropic first opened as a research preview to 1,000 Max plan users in August 2025, dropped one place to sixth. Its share halved from 7% to 3.5%, even though its traffic grew 30%. In May, the same extension had held 18.6% of agentic traffic in HUMAN's data. Anthropic also launched a second agent, Claude Duet, in research preview in October. "HUMAN Sightline detects Claude Duet, but its traffic is still very low while access is limited to the research preview," the report states.

Comet and the fading standalone browser

The sharpest reversal belongs to Perplexity. Its Comet browser led agentic traffic with a 41% share in August. That fell to 9.4% in September and 3.6% in October, as Comet slipped from third place to fifth. It was the only top-ten agent whose traffic shrank in October, and its request volume is down about 30% since August, according to HUMAN, while total agentic traffic grew about eight times. PPC Land checked that figure against the shares: 3.6% of a total eight times larger is about 70% of the August volume, consistent with the stated decline.

Comet's position earlier in the year was stronger still. In HUMAN's May data, it held 47% of agentic traffic, ahead of OpenAI's Atlas at 20.3%. Perplexity had made Comet free worldwide on October 2, 2025, after a three-month limited release. On March 9, 2026, a federal court in San Francisco issued a preliminary injunction against Perplexity using Comet's agents to access password-protected Amazon accounts.

Comet is not the only standalone product to fade. Genspark's agentic browser dropped out of the top ten "after a months-long decline," according to the report. OpenAI said on July 9 that it would fold Atlas into a new ChatGPT Work agent, and HUMAN dates the sunset of the standalone browser to August.

HUMAN's reading of the shift is explicit. "Standalone consumer agentic browsers are fading, as consumers move to agents built into platforms they already use," the report says, adding that users are moving to agents "from companies that already reach them at scale." That is an interpretation, not a measurement: the data shows market shares, not why people switched. The report also carves out an exception. "Developer-focused agentic browsers are a different story," it notes, pointing to Codex Browser's near-tripling.

Two newcomers and two unnamed agents

Two agents entered the top ten for the first time. Google Agent (Gemini), which according to HUMAN Google launched on October 8, reached eighth place with 0.8% within weeks. Google had added a user-triggered fetcher called Google-Agent to its crawler documentation on March 20, 2026, and had offered Chrome auto browse to US AI Pro and Ultra subscribers from July 14. The report does not say which of Google's agentic surfaces its figure covers or how HUMAN identifies it.

xAI's Grok Agent, launched on August 11, debuted in ninth place with 0.7%.

The chart in the report names eight agents and an "Other" slice of 2.4%. With Google in eighth and Grok in ninth, the agents in seventh and tenth place go unnamed; both sit inside that 2.4%.

Where the agents went

Every sector HUMAN tracks received more agent traffic in absolute terms. The distribution, however, is heavily skewed. According to the report's sector chart, October's shares were:

  • Ecommerce: 59.88%
  • Travel: 19.25%
  • Media: 19.13%
  • SaaS: 1.24%
  • Financial services: 0.24%
  • Streaming and gaming: 0.19%
  • Education: 0.05%
  • Healthcare: 0.01%
  • Federal and government: 0.01%
  • Ads: 0.00%

Ecommerce held what HUMAN calls a stable 60% share, and its traffic grew 2.5 times. Travel took second place for the first time, with traffic up 2.9 times and its share rising from 17.1% to 19.3%. Media fell to third, its share sliding from 21.1% to 19.1%, though its traffic still grew 2.3 times. The margin between second and third place is 0.12 percentage points.

Travel's rise lands on a sector that HUMAN has already described as a target for automated fraud. In a guide covered by PPC Land in October, the company reported that the most heavily targeted travel businesses saw attempted carding at 17.6% of checkout traffic in 2025. The October benchmark does not break out fraudulent agent activity by sector.

SaaS is small at 1.24%, but it is the fastest grower: its traffic nearly quadrupled in one month and is about 15 times its August level. The report does not say which agents drive it.

Financial services, streaming and gaming, and healthcare grew more modestly, by 57%, 62.7% and 59.5% respectively. Together with education and government, those sectors account for half of one percent of agent traffic. The chart also lists a category labelled "Ads" at 0.00%; the report does not define it.

Two caveats apply. HUMAN categorises sectors by destination, not motive: "Sector and route categorization reflects the destination endpoint, not the agent operator's intent." And the shares describe the applications HUMAN protects, whose mix across industries the company does not disclose. A heavy ecommerce weighting may say as much about HUMAN's customer base as about where agents go on the wider web.

Browsing, not buying

The report's page-level breakdown is the most useful part for anyone selling online. Agents in October were overwhelmingly researching. According to the chart:

  • Product and search pages: 85.2%
  • Content engagement: 4.3%
  • Account management: 3.2%
  • Authentication: 2.8%
  • Other: 2.4%
  • Checkout and payment: 1.9%

Product and search pages rose from 81% in September. Content engagement moved into second place, up from 3.6%. Account and transaction pages shrank as a share: account management fell from 7.1% in August to 4% in September and 3.2% in October, and authentication from 5.5% to 3.1% and then 2.8%. Miscellaneous traffic, which the chart labels "Other," rose from 3% in August to 5.8% in September before falling back to 2.4%.

Checkout and payment fell from 2.4% to 1.9% of agentic traffic, but its volume grew 117% month over month, according to HUMAN. "Agents still browse far more than they buy," the report says, "yet the number of agent requests reaching checkout is rising fast."

Two inconsistencies in the source deserve mention. The key findings list at the top of the post reads "while just % reach checkout," with the figure missing; the chart and body text give 1.9%. And the published shares do not quite produce the stated growth. By PPC Land's calculation, a share that falls from 2.4% to 1.9% of a total that grew 157.5% implies checkout volume rose by about 104%, and even the most generous rounding of both shares only reaches about 114%. HUMAN does not publish the underlying volumes, so the gap cannot be resolved from the report.

The direction is consistent with earlier HUMAN data. Its annual report, covering 2025, found product and search pages at 77% of agentic activity and checkout pages at 2.31%. In late September, HUMAN said 84% of Muse requests went to product and search pages, and that Muse was 25% more likely than other agents to reach checkout in a recent sample.

The unit of measurement shapes how these figures read. HUMAN counts requests, and a single shopping task can generate dozens of product page loads before one checkout request. Session-based measurements give a very different picture: Microsoft Clarity, which counts sessions, found checkout steps in 25% of AI agent sessions against 15% for humans. A 1.9% request share and a 25% session share are not contradictory; they answer different questions.

The growth curve

A bar chart in the report sets out month-over-month changes in agentic traffic from May to October:

  • May: down 4.38%
  • June: up 14.84%
  • July: down 3.21%
  • August: up 27.06%
  • September: up 209.70%
  • October: up 157.51%

The May decline matches the 4.3% dip PPC Land reported in June, when HUMAN also recorded its blocking rate for agentic traffic climbing to nearly 9%. Multiplying the September and October changes gives the report's August comparison: 3.097 times 2.575 is 7.975, an increase of 697.5%. Chaining all six months, by PPC Land's calculation, puts October's volume at about 10.8 times April's.

HUMAN's chart carries a note: "Absolute volumes are not shown. Relative bar heights are reconstructed from the supplied monthly growth rates." The report gives no request counts, no number of protected applications and no split between allowed and blocked traffic.

The "8x" in this report is also not the same "8x" HUMAN used in April. The earlier headline, covered by PPC Land, referred to automated traffic growing eight times faster than human traffic across 2025. The October figure compares agentic request volume in October with August.

How HUMAN counts

According to the methodology section, the data reflects agentic traffic detected by HUMAN Sightline Cyberfraud Defense across applications protected by HUMAN during October 2026. Agent identification combines behavioural signal analysis, user-agent attribution and "publisher-level integration where available."

The unit is defined plainly. "All figures are measured in requests. A request is one action an agent takes on a site, such as loading a page or running a search. It is not a user or a session," the report states. It also separates agents from crawlers: "We do not infer agentic activity from crawler traffic." Crawlers, according to HUMAN, mainly serve model training, search indexing and chatbots, and so are not a reliable measure of how agentic AI is used.

The report is built on HUMAN's AgenticTrust product, which the company sells as a trust and control layer for AI agents. According to the post, it identifies Muse and other agents "using proprietary research and digital signatures that cannot be spoofed." That claim sits against a wider identification problem. Arkose Labs found in October that 97.7% of legitimate AI agent sessions carried no verified identity, and DataDome observed Meta quietly signing some Muse requests with Web Bot Auth from around October 12, in what it described as a relatively small number of requests. Muse, ChatGPT Agent and the agentic browsers in the ranking all operate a browser on a user's behalf, each working as a computer use agent that can look much like a person in a server log.

HUMAN has a commercial interest in the problem it measures. The post ends with a request-a-demo pitch and argues that "on most sites, analytics tools can't distinguish AI agents from human visitors, let alone identify specific agents or classify their intent." The data is the company's own and has not been independently audited.

Why concentration matters to marketers

Nine in ten agent requests now come from two companies, and the larger of the two is one of the world's biggest advertising businesses. That changes who sits between a shopper and a merchant's product page.

The selection logic inside those agents is not neutral by default. Instruction text extracted by Profound in September indicated that Muse is told to fill its top shopping picks with well-known merchants. Meta also said on its October 21 call that it intends to be paid a fee based on the transactions Muse helps facilitate, without giving a rate. An agent that holds 59% of agent traffic and favours established brands matters to smaller retailers whose discovery depends on being chosen.

Merchants are setting terms in very different ways. Amazon cut Muse off from shopping on Amazon.com on September 20, citing unauthorised access, a position consistent with PSE Consulting research from 2025 that found Amazon the exception among major merchants that otherwise welcomed AI agents. Walmart chose the opposite approach, letting AI agents buy within customer-set spending limits such as $50 or $100. An audit by Blend found that 29 of 200 retailers refused its AI shopping agent. Cloudflare argued in early November that websites bear the cost in nearly all of 14 problems AI agents create.

Measurement is the other pressure point. If 85% of agent requests hit product and search pages, those pages are being read by software at a growing rate, and, if HUMAN's assessment of analytics tools is right, many of those visits are being counted as human. The figures from Shopify suggest commerce is following: the company reported that orders from AI searches grew 3.3 times year over year in the third quarter, from a base it did not quantify. Referral orders and agent requests are different measures, but both point to software sitting between shoppers and stores in a growing share of journeys.

What comes next

HUMAN says its November edition will show how agents behaved over Black Friday and Cyber Monday, the first holiday peak since Muse launched. That report should answer the question the October data leaves open: whether the doubling in checkout requests was the start of a shift from browsing to buying, or a modest rise from a very small base.

Two smaller threads are also worth watching. Claude Duet remains in limited research preview, and Google Agent reached 0.8% in a matter of weeks. Whether either can dent a market where the leader holds 59% and the runner-up 30% is a question October's numbers cannot yet answer.

Timeline

Summary

Who: HUMAN Security, through its Satori Threat Intelligence Team and author Aviad Kaiserman, measuring AI agents from Meta, OpenAI, Perplexity, Anthropic, Google and xAI on applications it protects.

What: The October 2026 edition of the State of Agentic Traffic benchmark. Agentic traffic rose 157.5% from September and about eightfold from August. Meta's Muse took 59% of agent requests and OpenAI's three products about 30%, while Perplexity's Comet fell from 41% in August to 3.6%. Ecommerce received 59.88% of agent requests, travel 19.25% and media 19.13%. Product and search pages took 85.2% of requests and checkout 1.9%, with checkout volume up 117% according to HUMAN, a figure the published shares do not fully support.

When: Published November 9, 2026, covering October 2026. The next edition is due to cover Black Friday and Cyber Monday.

Where: Across websites and applications protected by HUMAN's Sightline Cyberfraud Defense, with sector shares reflecting HUMAN's customer base rather than the whole web.

Why: The data shows agent traffic consolidating around platforms that already reach people at scale, led by an advertising company, while agents still spend almost all their requests reading product and search pages rather than buying. For retailers, travel firms and publishers, that concentrates influence over which pages agents read and which merchants they pick, ahead of a holiday season that will test whether agents start to buy.