TL;DR: Bot-detection firm HUMAN Security says AI agents from Meta and OpenAI made almost 90% of all agent traffic hitting the websites and apps it protects in October. Meta’s Muse alone accounted for 59% of that traffic after nearly quadrupling its request volume in a single month, while standalone browser agents like Perplexity’s Comet kept losing ground. Most of the traffic is still window shopping rather than buying, and a growing share of Muse’s requests are arriving with no way for a site to verify who sent them.
Two companies now run the show
HUMAN Security publishes a monthly State of Agentic Traffic report built from the sites and apps it protects, and the October edition has a number worth sitting with: agents built by Meta and OpenAI generated close to 90% of every agent request the company logged. Total agent traffic across the report was roughly eight times higher than in August and about 2.6 times higher than September, which tells you how quickly this category is moving even without the Meta and OpenAI split.
It’s worth being precise about what’s being measured. HUMAN counts requests, not visits or purchases, so a single agent session browsing a product page, running a search, and loading an image could register as several separate requests. The report also only covers traffic on HUMAN-protected properties, not the open internet, so it’s a sample rather than a full census. Still, the sample is large enough that the shift it’s showing is hard to dismiss as noise.
Muse nearly quadrupled in a month
Meta’s Muse is the story inside the story. Its share of agent requests jumped 19 percentage points from September to October, and the actual number of requests it sent nearly quadrupled over that span. Muse now sends 3.7 times as many requests as ChatGPT Agent, its closest competitor, which is a remarkable climb for a product Meta only launched on September 8.
OpenAI isn’t exactly losing here either. Its agents made up about 30% of total requests across three separate products in the top 10. But the internal math inside that 30% tells its own story: ChatGPT Agent held 28.5% of all agent requests in September and sent 44% more requests in October, yet its share still fell to 15.9% because Muse was growing even faster. OpenAI’s Codex Browser moved from 7.7% to 8.8% of requests, and the Codex Chrome extension climbed from 3.3% to 5.2%, so the company’s overall footprint grew, it just got outpaced by one product.
Other names further down the list show how crowded the field has gotten even as two companies dominate it. The Claude Chrome extension’s share dropped by half, from 7% to 3.5%, despite the extension sending 30% more requests in absolute terms, simple proof that a rising tide doesn’t lift every boat equally when the tide itself is rising faster elsewhere. Google’s Gemini agent, which HUMAN says launched October 8, debuted at number eight with 0.8% of requests. xAI’s Grok Agent entered the top 10 for the first time at number nine with 0.7%.
Standalone agent browsers are fading fast
The report’s clearest loser is the standalone browser-based agent. Genspark’s agent fell out of the top 10 entirely. Perplexity’s Comet, which made up 41% of all agent requests back in August, dropped to 9.4% in September and then to just 3.6% in October, a roughly 30% decline in raw request volume since August, the only top-10 agent to shrink in absolute terms during the month. OpenAI had already discontinued its own standalone ChatGPT Atlas browser back in August.
HUMAN’s read on this is that people are choosing an agent based on a platform they already use, or another product from the same company, rather than seeking out a dedicated browsing agent. That tracks with what we’ve seen elsewhere this year as United Airlines moved to block AI agents from booking flights over security concerns. Sites and platforms are increasingly treating agent access as something to manage deliberately rather than something that just shows up, and a built-in agent tied to a company you already trust has an easier time clearing that bar than a separate app asking for the keys.
Agents are still browsing, not buying
Despite all the checkout-automation hype around agentic commerce this year, the actual numbers remain modest. In October, 85% of all agent requests landed on product and search pages, up from 81% the month before. Requests to checkout and payment pages actually fell, from 2.4% of the total down to 1.9%. HUMAN’s own framing is that these agents “still browse far more than they buy,” though the report notes checkout-bound traffic has been climbing fast in percentage terms even if it remains a sliver of the whole.
Ecommerce sites held a steady roughly 60% share of total agent requests. Travel came in second, and for the first time in this report’s history it outperformed media as a category, edging ahead of news and entertainment sites for agent attention.
Muse just made itself harder to verify
There’s a wrinkle here that matters more to site owners than to shoppers. Muse identifies itself to websites using something called Web Bot Auth, a signature system that lets a site confirm an agent is who it claims to be. According to security vendor DataDome, Muse shifted its signing keys from Meta’s own domain over to muse.ai between November 7 and November 9. Any site that had its bot-protection rules locked to meta.com specifically would now see Muse’s requests show up as unverified, since there’s no signature to check against the old key.
It gets messier. DataDome’s own network showed that as of November 10, about half of Muse’s requests carried no signature at all, meaning there was nothing to verify in the first place even for sites that had updated their rules. That’s a meaningful gap for a product that, per this same HUMAN report, is sending more agent traffic than anyone else on the internet. Meta has said Muse’s browsing activity “will appear as your activity” on the sites it visits, which raises the stakes further: without a reliable signature, a site genuinely cannot tell whether a given pageview came from a person or from an agent acting on that person’s behalf. This is part of why Meta’s rollout of Muse to Apple Watch and Wear OS earlier this month is worth watching too, since every new surface Muse runs on is another place generating this kind of unverifiable traffic.
The bottom line
HUMAN’s report also points out something that should worry anyone running a website heading into Black Friday: most analytics tools on most sites still can’t reliably tell an AI agent apart from a human visitor. If your traffic reports look unusually healthy this holiday season, there’s a real chance some of that “healthy” is Muse or ChatGPT Agent clicking through product pages on nobody’s actual behalf. Bot protection teams now have a short, specific list to check against before peak shopping season rather than a vague sense that “AI traffic” is rising. Whether that list stays this short through 2027 is another question entirely, given how fast Muse went from launch to dominant in nine weeks.
The Teck Hustlers Editorial Team covers technology, business, finance and gaming news for readers who want the story behind the headline. Every article is researched, written and edited by our in-house team, checked against company announcements, filings and reputable reporting, and updated when new facts emerge. We focus on what each development means for founders, professionals, investors and everyday users. Have a tip or a correction? Reach us through our contact page.
