Cequence finds Meta's Muse AI agent bypassing security at scale

Cequence Security has published research showing that Meta's Muse personal AI agent, launched on 8 September 2026, appeared in traffic across more than half of the customer environments the firm studied within two weeks of its debut. The security vendor says most of those businesses would have had no idea the agent was present, because Muse presents itself to standard security tools as an ordinary Chrome browser rather than an AI agent.

The findings accompanied the general availability of Agent Trust, a new capability within Cequence's Application and API Protection platform, designed to give enterprises granular control over AI agent traffic rather than forcing a binary allow-or-block decision.

What Cequence observed

Analysing traffic across customers in financial services, retail, travel and software from 1 to 24 September 2026, Cequence found that Muse traffic at the median customer grew nearly sixfold within roughly two weeks of first appearing. The agent runs a real Chrome browser in the cloud, routes its requests through a consumer VPN, and does not sign or label its traffic as agent-originated. Cequence said it identified Muse through behavioural signals, including a browser version update that went from zero to more than 90 per cent of Muse traffic within a matter of days, which the firm attributes to Meta hosting and updating those browsers centrally.

At financial institutions in the study, Muse successfully logged into customer accounts and completed multi-factor authentication on users' behalf. In one travel and hospitality case from late September, a customer's security team began blocking roughly one in five Muse requests, targeting only those that appeared anomalous, while allowing the agent's remaining traffic to proceed unimpeded.

Ameya Talwalkar, co-founder and chief executive of Cequence, framed the commercial stakes clearly: "Saying no is no longer the safe answer, because customers are choosing agents and will take their spending wherever those agents are welcome. Our job is to make yes the safe answer."

Market context and competitive read-across

The Muse findings crystallise a challenge that the API security and bot-management market has been anticipating but has rarely had to handle at this scale. Traditional bot defences rely on signals such as headless browser fingerprints, non-human timing patterns, or the absence of a completed purchase. Muse undermines each of those heuristics: it uses a real browser, behaves like an engaged shopper, and in a small share of sessions completes a transaction.

Agent Trust addresses this through a combination of an agent inventory that surfaces undisclosed agents, an issuer registry for verifying agent identity claims, a behavioural profile built per agent using what Cequence calls its Intent Graph, and transaction-level enforcement that can challenge or rate-limit a specific action rather than terminating the agent session. The platform's existing API discovery layer means it can detect when an agent shifts from ordinary browsing to systematic price-and-stock scraping across every product endpoint.

The broader competitive landscape for AI agent governance is nascent but moving quickly. Established API-gateway vendors, WAF providers and specialist bot-management firms are all converging on agent identity and behavioural controls as agentic AI adoption accelerates. Standards efforts around agent identity, including work on verifiable credential frameworks and emerging proposals for agent-to-server authentication headers, remain fragmented, which is why Cequence has designed its issuer registry to be protocol-agnostic.

For enterprise security teams, the practical implication is that MFA completion is no longer a reliable signal of human presence, and purchase completion is no longer a reliable signal of non-bot behaviour. Both assumptions are baked into a significant number of fraud and abuse detection models currently in production. Revisiting those models will become an urgent item for CISOs as agentic AI adoption broadens through 2027.