Meta has been attaching cryptographic signatures to a growing number of web requests sent by its Muse personal agent and its Meta-WebIndexer crawler since around October 12, according to Jérôme Segura, VP of Threat Research at bot-management company DataDome, who described the observation in a LinkedIn post on October 30, 2026. The signatures use Web Bot Auth, a protocol that lets a website check that an automated visitor really comes from the company it names. Meta has not announced the change.

In Short

Meta has started putting a kind of digital signature on some of the website visits made by its Muse assistant and by one of its search crawlers, so that sites can check those visits genuinely come from Meta. This matters because Muse browses and shops for people from cloud servers and, until now, did not say who it was, which made it hard for shops and publishers to tell it apart from impostors. Only a small share of the visits carry the signature so far, so websites still have to rely on other ways of spotting the rest.

What Segura saw

The observation is short, and it is Segura's own. "It looks like Meta started silently testing Web Bot Auth since around Oct. 12 and has been ramping up the requests it signs for at least two of their agents: Meta-WebIndexer and Muse," he wrote in the post, published on the afternoon of October 30, UTC.

He was careful about what he did not know. "AFAIK, there was no public or official announcement," Segura wrote, "and it seems like WBA requests may have been labeled under the Meta-ExternalTest user-agent string at first." Meta's public web crawler documentation, as it stood on October 31, lists five automated agents: FacebookExternalHit, Meta-ExternalAgent, Meta-ExternalFetcher, Meta-ExternalAds and Meta-WebIndexer. It does not list a Meta-ExternalTest agent. Nor does it mention Web Bot Auth, HTTP message signatures or a signature key directory. The only verification method the page describes is based on IP addresses.

Volume remains the limiting factor. "We still only see a relatively small number of requests from Meta signed using Web Bot Auth, which means client-side fingerprinting detection is still required for optimal coverage," according to Segura. The post gives no count, no percentage and no breakdown between the two agents. DataDome, he added, has "already added support to validate Web Bot Auth requests from Meta" for its customers.

Segura joined DataDome in July 2025 after more than 12 years at Malwarebytes. He also wrote DataDome's Q3 2026 AI traffic report, published on October 15, which put Muse at the centre of its findings. Benjamin Fabre, DataDome's co-founder and chief executive, responded under the post: "Great finding Jérôme Segura and good to see Meta going in that direction!" By the morning of October 31, the post had drawn 49 reactions, five comments and four reposts.

The claim is hedged in two ways. It covers "at least two" agents, which leaves open whether others are also signing; Meta-ExternalAgent, which collects pages for model training, is not named. And the word "testing" is Segura's inference from traffic, not a description Meta has given.

How signing works

Web Bot Auth is a profile of HTTP Message Signatures, the standard published as RFC 9421 in February 2024. Cloudflare proposed it on May 15, 2025. A signing agent adds three headers to each request: Signature, Signature-Input and Signature-Agent. The receiving site, or the security vendor in front of it, fetches the agent operator's public keys from a directory published at a fixed path, /.well-known/http-message-signatures-directory, and checks the signature against them. If it validates, the request came from whoever controls the private key. If it does not, the request is an impostor or a malformed one.

The protocol has moved from proposal to standards track. The IETF approved a working group charter on October 23, 2025, and adopted the protocol as a working group draft on September 1, 2026. Cloudflare published a registry format for bot and agent authentication on October 30, 2025, which lets sites look up signature directories from a curated list rather than discovering each one separately. By August 28, 2026, Cloudflare's automated review of new verified bot applications validated Web Bot Auth signatures automatically, alongside checks of IP lists and reverse DNS.

What a signature does not carry is just as important. It says who sent the request. It says nothing about why, or whether the agent will behave. That gap is what Cloudflare's October 16 plan addresses: it will grade verified bots on conduct, assigning lower trust bands to those that ignore robots.txt or HTTP 429 slow-down responses.

Why Muse was hard to identify

Muse has had an identity problem since its US release on September 8. Within two weeks, Amazon had blocked the agent from shopping on Amazon.com. Among the grievances Amazon listed, according to GeekWire, was that the agent did not identify itself when it browsed.

Security vendors have said the same thing in their own data. DataDome's Q3 report described Muse as an agent that does not declare itself, even as it counted 29.1 million Muse requests on DataDome's network between September 22 and October 3 and put Muse at 33% of all agentic browser requests in September. HUMAN Security, whose data had Muse at 72% of daily AI agent requests on its network, did not say whether Muse signed its requests. Profound, in research published on October 2, wrote that Muse and the rival Instinct agent do not identify themselves by name when they browse websites.

The difficulty is partly architectural. Each Muse user's agent runs in its own cloud virtual machine with a full browser inside, so Muse behaves like a computer use agent operating from a data centre rather than from the user's phone. According to DataDome's Q3 sample, 99.3% of Muse requests came from cloud and CDN infrastructure, 81.2% from Cloudflare and 18.1% from Fastly. Only 0.6% arrived via consumer internet providers.

That detail matters for verification. For its declared crawlers, Meta's documentation tells site operators to recognise traffic by its origin on Meta's own network. There is no per-crawler file of IP ranges; operators have to look up the prefixes registered to Meta's autonomous system, AS32934. Traffic leaving Cloudflare and Fastly addresses cannot pass that test, whoever sends it. For an agent built the way Muse is built, a cryptographic signature is the only verification route on offer that does not depend on where the request comes from.

The unverified WebIndexer requests

Profound's research adds another layer. In its manual testing, some Muse sessions were preceded by requests from a bot identifying itself as meta-webindexer. Requests carrying that name had historically come from IP addresses publicly claimed by Meta. The ones tied to Muse sessions did not. Profound labelled them unverified and used them as a proxy for Muse activity, finding they rose 1,313% on US and Canadian retail sites against 827% elsewhere. PPC Land noted at the time that some of those requests could have come from third parties borrowing the name.

Segura's post names Meta-WebIndexer and Muse as the two agents now signing. It does not say whether the signed Meta-WebIndexer requests are the same off-network requests Profound observed. If they are, sites would for the first time have a way to tell a genuine Meta request from a forged one at those addresses. That is an open question rather than a finding.

A timing question

DataDome's own Q3 report and Segura's post sit close together. The report, published on October 15, said Muse does not declare itself. The post, published 15 days later, says Meta began signing Muse requests around October 12, three days before the report appeared.

The two are not in conflict. DataDome's Muse measurement window ran from September 22 to October 3, closing more than a week before the start date Segura gives. And by his account the signed volume has been small and growing since then, so the Q3 description of an undeclared agent is consistent with the period it measured. Arkose Labs' Q3 data, which found that only 2.3% of the AI agent sessions it classified as legitimate carried a verified Web Bot Auth signature, also ended on September 30.

Where adoption stands

Meta would not be the first large operator to sign agent traffic, but it would be among a small group. Arkose Labs described OpenAI's ChatGPT agent, which signed 78.4% of its sessions in the third quarter, as the only agent signing at scale. Google added Google-Agent to its list of user-triggered fetchers on March 20 and said it was experimenting with the protocol under the identity agent.bot.goog; its later guidance said it signs only a subset of requests. Amazon Bedrock AgentCore signs browser traffic with a service key.

That leaves a long tail of agents that do not sign at all. In August, threat intelligence firm GreyNoise found scanners on 824 IP addresses forging the names of 13 AI crawlers from eight companies, including ClaudeBot, to hunt for credential files. They were caught because none of the addresses matched the operators' published IP ranges, a method that only works when operators send traffic from their own networks. In December 2025, DataDome documented Grok sending 16 requests from 12 IP addresses for a single query, none of which identified as xAI or Grok.

Pressure to identify is not only technical. In June, New York lawmakers passed the Stealth Crawler Prohibition Act, a bill that would require AI crawlers visiting news sites to identify themselves with a user-agent string naming the product, its version and the company. A user-agent string can be copied by anyone, though. A signature cannot be forged without the private key.

Identity, then intent

Segura's post frames signing as the first half of a two-part test. "As AI agents like Muse start browsing and shopping for real people, businesses need to know which ones to trust," he wrote. "Signed requests verify that an agent is really who it claims to be. Identity is a key part of the picture, and paired with intent (what the agent is actually trying to do), it lets businesses welcome legitimate agents and keep impersonators out."

The second half is where DataDome makes its money. The company sells bot and agent detection built on behavioural analysis, and in October it joined Experian's Agent Trust programme to provide what the two companies call continuous intent verification for AI shopping agents. Its Q3 report recommended treating Web Bot Auth and checks against published IP ranges as the minimum requirement, with behavioural analysis layered on top. Segura's conclusion that fingerprinting "is still required for optimal coverage" is consistent with that position, and with the product his employer sells. It also follows from his own description of the volumes.

Meta's crawlers under scrutiny

The test arrives while Meta's crawling is contested on other grounds. Meta's revised Commercial Terms contain a clause authorising the company to send crawlers to websites associated with businesses that use its products. After complaints from publishers, Meta pushed the effective date from October 30 to November 20.

Signing does not touch that dispute. A signature tells a site that a request is Meta's; it says nothing about what Meta does with the content collected. It does make the inventory of Meta's agents harder to blur, at least for the agents that sign. Meta runs several, with different jobs. Meta-ExternalAgent collects pages both to train models and to index content. Meta-WebIndexer, according to Meta's documentation, exists to improve the quality of Meta AI search results. Meta-ExternalFetcher retrieves individual links at a user's request, and Meta's documentation warns that it may bypass robots.txt rules.

The two signing agents are also among the busiest on the web. DataDome counted 12.4 billion requests from Meta-ExternalAgent and Meta-WebIndexer combined in the third quarter, 49.7% of all AI agent traffic on its network. In September, Meta-WebIndexer led with 2.63 billion requests against 2.48 billion for Meta-ExternalAgent. Against that volume, DataDome recorded 51,000 Meta AI referrals in the quarter.

Why this matters for marketers and publishers

For retailers, the immediate question is whether to let Muse in. Amazon chose to block it. Walmart, by contrast, introduced Agent Profiles on October 21, with per-agent spending limits and a beta gateway promising verified identities. Either decision depends on being able to recognise the agent in the first place. A Muse request carrying a valid signature can be allowed, rate-limited or blocked on purpose, rather than caught or missed by a heuristic. An unsigned one cannot.

The scale behind those decisions is no longer small. Sensor Tower estimated that Muse reached 10 million US downloads between September 8 and October 17, with 2.5 million US daily active users by October 16. Visits generated by those users arrive from Cloudflare and Fastly addresses, and according to DataDome, device and home-IP signals cannot separate them from other cloud-hosted traffic. A verifiable signature is one way for a measurement or fraud-filtering system to pick out a real shopper's agent rather than discard it with the rest.

For publishers, the stakes run through Meta-WebIndexer. It builds the index behind Meta AI answers, and decisions about whether to allow it in robots.txt only mean something if the visitor using that name is genuinely Meta. Forged crawler names are a documented problem. Signed requests would close that gap for the share of traffic that carries them.

That share is the catch. Segura describes it as "relatively small." Until Meta signs most of what its agents send, or says publicly that it intends to, sites face two populations of Meta traffic: one they can verify, and a larger one they cannot.

What remains unknown

Several facts are missing from the public record. How many requests carry signatures, and how fast the share is growing, is not stated. Where Meta publishes its key directory has not been disclosed in Meta's documentation. Whether Meta-ExternalAgent, Meta-ExternalFetcher or Meta-ExternalAds will sign is not known. Nor is it clear whether "Meta-ExternalTest" will appear in Meta's crawler list, or was a temporary label for the trial.

Meta has not explained the test publicly. Will it document the signing before November 20, when its new crawling terms take effect?

Timeline

Summary

Who: Meta, whose Muse personal agent and Meta-WebIndexer crawler are signing some web requests; Jérôme Segura, VP of Threat Research at DataDome, who reported the observation; and the retailers, publishers and security vendors that need to identify Meta's automated traffic.

What: According to Segura, Meta has been testing Web Bot Auth without announcement and signing a growing but still relatively small number of requests from at least Muse and Meta-WebIndexer, possibly under a "Meta-ExternalTest" user-agent string at first. DataDome says it now validates those signed requests for its customers. Meta's crawler documentation does not mention the protocol or the test label.

When: Signing began around October 12, 2026, according to Segura, who described it in a LinkedIn post on October 30, 2026. Meta's revised crawling terms are due to take effect on November 20, 2026.

Where: On websites receiving Meta agent traffic, as observed across DataDome's customer network. Muse launched in the US on September 8, and almost all of its traffic leaves from Cloudflare and Fastly infrastructure rather than Meta's own network.

Why: Muse has been criticised, and blocked by Amazon, for not identifying itself, and its cloud-hosted traffic cannot be verified through Meta's IP ranges. Cryptographic signatures give sites a way to confirm genuine Meta requests and reject impostors, though until most requests are signed, detection based on behaviour and fingerprinting remains necessary.