The most useful number in agent identity right now is an adoption number, and it is very small. Arkose Labs’ State of Agentic AI Trust Report, Q3 2026, published on 21 October, found that 2.3% of legitimate AI agent sessions presented a verified Web Bot Auth signature — meaning 97.7% of the good agents arrived with nothing a site could check.
What happened
Arkose, which sells bot detection and agent-trust tooling, published quarterly measurements drawn from traffic across its customer base. The figures that matter for KYA:
- Disclosure is near-zero. Only 2.3% of sessions it classified as legitimate AI agents carried a verified Web Bot Auth signature in Q3 2026. Web Bot Auth is the emerging IETF proposal in which an agent signs its own HTTP requests with a key a site can look up in a published key directory — the closest thing agent traffic has to a caller ID.
- Agents are not bots, statistically. 77.4% of AI agent sessions were classified as legitimate, against 7.9% of known bot sessions. Blanket blocking would therefore hit mostly wanted traffic.
- They have reached the front door. Agents appeared on login and registration flows in every industry measured; by the end of Q3, 65.2% of Arkose customers saw agents on their protected flows.
- One agent changed the shape of the traffic. Sessions from Meta’s Muse, the consumer personal agent, grew more than 30x in September, while most other agents stayed roughly flat.
- Looking hostile is not the same as being hostile. Instinct’s design made 96.8% of its sessions score medium or high risk because it uses techniques attackers also use — yet neither Instinct nor Muse had a single session linked to an attack in the period.
- Intent stays invisible. Verifying that an agent is something says nothing about what it came to do, and agents use the same flows attackers target: 70.5% of registration sessions were fake-account attempts.
Why it matters for KYA
This is the first broad public measurement of the gap KYA describes, and it cuts in an uncomfortable direction for anyone who assumed the identity problem was being solved by standards alone.
The plumbing exists; almost nobody turns it on. Web Bot Auth, HTTP message signatures, workload identity, delegated credentials — the building blocks are drafted and shipping in infrastructure. But 97.7% of legitimate agent traffic presents no verifiable claim about who is calling. A relying party that wants to make a KYA decision today is, for the overwhelming majority of agent sessions, deciding on behaviour rather than on identity.
Classification is not verification. Arkose sorts traffic into “legitimate agent” and “bot” using behavioural signals, and its data shows how well that works: an agent built in a way that looks like an attack tool can still be entirely benign, and a benign-looking session can be hostile. Behavioural scoring is a useful prior. It is not an attestation, and it produces no record a third party can audit.
The commercial incentive is still missing. An agent that signs its requests gets nothing obvious in return today — no preferential treatment, no faster path, no guarantee of access. Disclosure only becomes normal when being verifiable is cheaper than being unverifiable, which means sellers treating a verified agent differently from an anonymous one. That is a policy decision for the relying party, not a feature of the protocol.
Muse is the stress test. A single consumer agent growing thirtyfold in a month is what adoption looks like when it is bundled with a platform rather than sold as an agent. Sites will meet these agents whether or not they have a verification programme, and the first encounters will be unverified.
Two caveats. The data is Arkose’s own, drawn from its customer base rather than a neutral sample, and it is published by a vendor whose product is agent trust management — treat the direction as informative and the exact percentages as vendor-measured. And “verified Web Bot Auth signature” measures one specific mechanism; an agent could hold a delegated credential that Arkose cannot see, so 2.3% is a floor on disclosure as measured, not a ceiling on agent identity work.
The practical takeaway for a team shipping agent-facing services: assume the first million agent sessions are anonymous, keep a behavioural fallback, and start deciding now what a verified agent would be allowed to do that an unverified one is not. Without that decision, signing changes nothing.
Sources
- Arkose Labs, “The State of Agentic AI Trust Report, Q3 2026”, 21 October 2026 — arkoselabs.com.
- IETF, Web Bot Auth architecture draft (HTTP message signatures for automated agents) — datatracker.ietf.org.
Note: all figures are as published by Arkose Labs from its Q3 2026 customer traffic; no independent audit of the dataset has been published.
Know Your Agent (KYA) explains agent identity, verification and accountability. This is an explainer, not legal or compliance advice — see our Sources & methodology. New to KYA? Start with What is Know Your Agent? and the glossary.