Estimated reading time: 5 minutes
AI agents are logging in, signing up, and checking out for real customers. Arkose Labs found only 2.3% of legitimate agent sessions carried a verified signature. When someone misuses an agent, CEO Kevin Gosschalk says, the loss usually sits with the business.
Personal AI agents moved from reading the web to transacting on it in the third quarter, Arkose Labs found. They logged in, signed up, and checked out on behalf of real people.
Almost none said who they were. Only 2.3% of legitimate AI agent sessions carried a verified Web Bot Auth signature. That is the cryptographic standard that lets a site confirm which agent product sent a request.
The figures come from Arkose Labs’ first State of Agentic AI Trust Report, covering 1 July to 30 September. Arkose sells fraud and bot prevention to technology, financial services, gaming and travel companies, including Meta, Roblox and Expedia. The report draws on its production traffic for logins, registrations, checkouts, password resets and one-time passcodes. It publishes shares and multiples only.
Roughly one in every 5,200 protected sessions came from a named AI agent. By 30 September, 65.2% of Arkose customers saw AI agents on their protected flows. That figure includes newly detected personal agents.
How AI Agents Get Identified
“We identify agents from what the session does and the environment it runs in, such as the browser it drives and the timing of an AI reasoning loop, rather than from what it says about itself,” Gosschalk said in written answers to my questions.
ChatGPT agent signed 78.4% of its sessions, the only agent to sign at scale. Even a signature leaves gaps.
“A signature tells a business which company operates the agent, not who the user is or whether they approved the action,” Gosschalk said. Full verification needs three layers, he said. The first is the agent’s identity. The second is proof that a specific customer delegated the task. The third checks that the session behaves like a real customer.
AI Agents Versus Bots
Arkose classified 77.4% of AI agent sessions as legitimate, compared with 7.9% of known bot sessions. The report counts named agent products as AI agents and all other automation as bots.
That definition accounts for “a meaningful part” of the gap, Gosschalk said. Named agent products are mostly mainstream consumer tools, while homemade attack agents land in the bot column.
“The narrower finding still holds: commercial agents carry the same surface signals as attack bots, yet most of their sessions aren’t attacks,” he said. The non-legitimate agent sessions came mostly from agentic tools anyone can run.
Two personal agents show the pattern. Meta launched Muse on 8 September, and its sessions grew more than 30-fold that month. Instinct rotates its device fingerprints across home and mobile networks, the same tradecraft attackers use. Arkose rated 96.8% of Instinct sessions medium or high risk, and 24.9% of Muse sessions. Neither had a session linked to an attack.
AI Agents On The Flows Fraudsters Use
Across all traffic at protected endpoints, 70.5% of registration sessions were fake-account attempts. A third of sign-ins were illegitimate. And 17.7% of checkouts were card testing or payment fraud.
“The endpoint fraud figures cover all traffic and show the risk on flows agents now use, not fraud agents caused,” Gosschalk said.
I asked what gives away a Muse checkout made with a stolen card. “At the agent level, often nothing, just as with a human doing the same thing,” he said. Account history, payment mismatches, and velocity give it away. Because Muse runs on a small set of stable fingerprints, abuse at scale “piles up and surfaces quickly,” he said.
Who Carries The Loss When AI Agents Are Misused
“Today the loss usually sits with the business, and the legal position is unsettled,” Gosschalk said. “A lot of companies we are speaking with are uncertain and this is leading to them being less willing to accept agentic traffic logging in.”
Arkose backs its platform with a $1 million warranty. It covers the attack types and conditions in each customer’s contract. “It doesn’t extend to agents carrying out tasks a customer requested and the business’s policy allowed,” Gosschalk said.
Cyber Insurance News found the same open question when consumer AI agents began shopping for insurance. Who pays when the machine gets it wrong remains unsettled.
The evidence may get thinner. Muse is set to add end-to-end encryption, so even Meta won’t see a user’s instructions. Then neither the website nor the agent’s maker can see what the agent was told. Its behavior becomes “the only evidence of intent,” the report says.
FAQ – AI Agents
How many AI agents identify themselves?
In Arkose Labs’ Q3 2026 data, only 2.3% of legitimate AI agent sessions carried a verified Web Bot Auth signature.
What is Web Bot Auth?
A cryptographic standard that lets a website verify which agent product sent a request. It does not identify the user or confirm the user approved the action.
Are most AI agent sessions legitimate?
Arkose Labs classified 77.4% of AI agent sessions as legitimate, compared with 7.9% of known bot sessions.
Were Meta’s Muse or Instinct used in attacks?
Neither had a session linked to an attack in Q3, although Arkose rated 96.8% of Instinct sessions medium or high risk.
Who pays when an AI agent is misused?
Arkose Labs CEO Kevin Gosschalk says the loss usually sits with the business today, and the legal position is unsettled.
Does Arkose’s warranty cover agent fraud?
It covers attack types and conditions in each customer’s contract. It does not extend to agents carrying out tasks a customer requested and the business’s policy allowed.
Related Cyber Insurance Posts
- Travelers Flags Shadow AI as the Cyber Risk Already Inside the Building(Opens in a new browser tab)
- Stolen Credentials Outlive The Malware That Stole Them(Opens in a new browser tab)
- Blumira Adds Microsoft 365 Threat Response Feature for Faster User Lockouts(Opens in a new browser tab)
- The Ransom Bot Is Not Haggling – It Is Taking Away Your Thinking Time(Opens in a new browser tab)
- When Your AI Calls The Insurer’s AI, Who Owns The Mistake?(Opens in a new browser tab)