Cequence Detects Meta's AI Agent Muse at Half of Customers

SANTA CLARA, Calif., Oct. 07, 2026 /CourierPR/ -- Within two weeks of Meta's launch of its personal AI agent, Muse, Cequence Security detected traffic matching Muse at more than half of the customers it studied. This discovery highlights the growing challenge businesses face in distinguishing between genuine customer traffic and AI-driven activity.

Cequence Security, a provider of application and API protection, conducted an analysis of traffic across various sectors, including financial services, retail, travel, and software, from September 1 to September 24, 2026. The findings revealed that Muse, which presents itself as a regular Chrome browser, significantly increased its presence at the median customer within the first two weeks of its launch.

Muse operates by running a real Chrome browser in the cloud, directed by an AI model that reads each page and decides what to click. It routes its traffic through a consumer VPN, making it indistinguishable from a human user to most security tools. Cequence identified the traffic through behavioral analysis, which picked up on signals such as a browser update that went from 0% to more than 90% of Muse traffic within days, indicating centralized hosting and updates.

The study also found that Muse was able to bypass multi-factor authentication at financial institutions, logging in to customer accounts and completing multi-factor authentication on users' behalf. This capability raises concerns about the security of customer data and the potential for misuse by malicious actors.

Moreover, Muse demonstrated the ability to browse and purchase like a typical customer. It searched, compared options, filled carts, and moved through checkout processes, with a small share of sessions resulting in completed purchases. This behavior is similar to that of bots, which businesses have long used to identify and block. However, the pattern of a visitor completing a purchase is no longer a reliable indicator of human interaction.

To address these challenges, Cequence Security introduced Agent Trust, a new capability in its Application and API Protection service. Agent Trust combines identity verification with behavioral detection, allowing businesses to block harmful actions while still allowing customers to use their services through agents like Muse. The system provides a live view of every agent in an organization’s traffic, including those that do not identify themselves, and can verify agent identity against trusted providers.

The launch of Agent Trust underscores the evolving landscape of AI-driven interactions in business. As AI agents like Muse become more prevalent, businesses must adapt their security measures to ensure they can distinguish between legitimate and malicious activity. The ability of Muse to pass through standard security checks and complete multi-factor authentication poses a significant challenge for organizations, highlighting the need for more sophisticated and nuanced security solutions.

In conclusion, the findings from Cequence Security’s study and the introduction of Agent Trust reflect the increasing complexity of modern cybersecurity challenges. Businesses must now consider the implications of AI-driven interactions and develop strategies to protect both their customers and their operations.