On 7 October 2026 Cequence Security launched Agent Trust, a capability inside its Application and API Protection product, with a finding attached: within two weeks of Meta’s 8 September launch of its Muse personal agent, Cequence says it found traffic matching Muse at more than half of the customers it studied — and most of those businesses would not have known. Its point is that Muse presents itself as an ordinary Chrome browser rather than identifying itself as an agent, so to standard checks it looks like a person.
What Cequence found
Cequence analysed traffic across customers in financial services, retail, travel and software from 1 to 24 September 2026. It reports that, at the median customer, Muse traffic grew nearly sixfold within about two weeks of first appearing. The behaviours it highlights matter more than the volume:
- It passes as a regular browser. Each Muse user gets their own agent, which runs a real Chrome browser in the cloud, is driven by a model that reads pages and decides what to click, and routes traffic through a consumer VPN. It does not sign its requests or identify itself as an agent. Cequence says it detected the traffic behaviourally — for example, a browser update that went from 0% to more than 90% of Muse traffic within days, a sign the browsers are hosted and updated centrally.
- It gets through multi-factor authentication. At financial institutions, Cequence says Muse logged in to customer accounts and completed MFA on users’ behalf, with confirmed successful sign-ins. The consequence is blunt: a successful MFA login no longer shows whether a person or an agent is on the other end.
- It browses like a bot and buys like a customer. Muse searched, compared options, filled carts and moved through checkout, and a small share of sessions ended in a completed purchase. Whether a visitor completes a purchase is no longer a reliable way to tell a bot from a customer.
- The response was per-request, not per-agent. In late September, a travel and hospitality customer’s security team began blocking nearly one in five Muse requests — only those that looked abnormal — while leaving the rest of the agent’s traffic alone.
Together these show why agents are hard to govern: traffic that is almost always legitimate, invisible to standard checks and trusted with customer logins looks the same whether it comes from Muse or from an attacker replaying a stolen agent credential.
What Agent Trust does
Agent Trust pairs identity verification with the behavioural detection Cequence has long run across bot and API traffic:
- Detected-agents inventory — a live view of every agent in an organisation’s traffic, including agents like Muse that do not identify themselves.
- Issuer registry — verification of an agent’s identity against the providers an organisation trusts. Cequence says the registry is protocol-agnostic, so supporting a new agent-identity framework means registering a new issuer rather than waiting for a product update.
- Agent activity log and behavioural analysis — a request-by-request record, plus an “Intent Graph” that profiles each agent to separate the real one from an impostor.
- Transaction-level enforcement — policies that block, rate-limit or challenge a specific action rather than the agent behind it. For sensitive actions such as changing an account email, a Biometric Check asks the account holder to confirm on their own device whether they meant for their agent to act.
“AI agents like Meta’s Muse are bots that act on behalf of real customers,” said Hari Nair, VP of product management at Cequence. “Agent Trust lets businesses block the action, not the agent.”
Why it matters for KYA
Know Your Agent starts with identity, but Cequence’s numbers are a reminder that identity by declaration is not enough. The same finding cuts both ways: an agent that refuses to identify itself and an attacker using a stolen agent credential produce the same traffic. Neither carries a self-asserted, verifiable identity, so there is nothing on the wire to check.
That pushes a KYA posture beyond “ask who are you?” toward four controls that this episode makes concrete:
- Inventory — you cannot govern agents you cannot see, including ones that insist they are browsers.
- Verification against a trusted registry, not against whatever the caller claims.
- Enforcement at the action, so an agent that is welcome for order-status checks cannot quietly start scraping prices and stock.
- Evidence — a per-request record that lets a team explain, later, why it allowed or blocked a specific call.
The MFA detail is the one to carry into a security review: MFA is no longer proof of a human. It is proof that something holding the customer’s credentials completed the challenge. That is exactly the gap the phrase “know your agent” was coined to name.
Sources
- Cequence Security, 7 October 2026: Cequence launches Agent Trust so businesses can see AI agents and stop out of bounds actions — the company’s own release.
- Cequence Security: Agent Trust / bot management (product documentation).
Know Your Agent (KYA) explains agent identity, verification and accountability. This is an explainer, not legal or compliance advice — see our Sources & methodology. New to KYA? Start with What is Know Your Agent? and the glossary.