Personal AI agents are now handling sensitive transactions at scale. Almost none say who they are

A chief information security officer at one of the world’s largest banks recently told an industry summit something remarkable: for the first time in his career, a technology had arrived ahead of the controls. A new report suggests he was not exaggerating.

Arkose Labs’ State of Agentic AI Trust Report, Q3 2026 draws on production traffic from 1 July to 30 September. It finds that personal AI agents have moved quickly from reading the web to transacting on it. More than 65% of Arkose’s customer sites, spanning banking, gaming, technology and travel, saw agents logging in, signing up and checking out on behalf of real people. Fewer than 3% of those agents proactively said who they were.

From browsing to buying

The shift has been remarkably fast. Agents appeared on login and registration flows in every industry the report measured, and by the end of the third quarter, 65.2% of Arkose customers were seeing them on their protected flows.

Consumer products are driving the surge. On 8 September, Meta launched Muse, a personal agent that sends emails, books travel, opens a browser, fills in forms, negotiates and completes a checkout on the user’s behalf, and keeps working after the app is closed. Meta says it runs inside a dedicated cloud environment, the Muse Secure VM, while a separate agent called Sentinel monitors its behaviour and controls what can reach the internet. The arrival of that product shows up clearly in Arkose’s data. Muse sessions grew more than thirtyfold in September, dwarfing every other agent tracked, most of which stayed roughly flat.

Muse is also the report’s clearest example of a trust problem. It appears on networks as an ordinary Chrome browser, and it does not announce itself. Arkose classes it as a good agent, but one that does not disclose, and there lies the difficulty.

The disclosure gap

Arkose’s analysts sort agents into three groups: those that disclose themselves and are good, those that do not disclose but are good, and those that are malicious. The second group is by far the largest. Of the sessions the report judged legitimate, 97.7% carried no verified disclosure of any kind.

For a bank, a retailer or a travel firm, this is a genuine headache. The legitimate agent trying to buy a customer’s flight and the fraudster’s script testing stolen credentials may look nearly identical at the network level. Both present as a browser, both move faster than a human, and both use the same flows.

The report’s numbers show why blunt rules fail. Arkose found that 77.4% of AI agent sessions were legitimate, compared with just 7.9% of known bot sessions. Agents look like bots but should not be treated as them. Yet the same flows attract abuse: 70.5% of registration sessions in the study were fake-account attempts. Waving all automated traffic through invites fraud, and shutting it all out turns away real customers and the revenue they bring.

Looking hostile is not being hostile

The most striking finding concerns an agent called Instinct. Its design made 96.8% of its sessions appear medium or high risk, because it uses techniques commonly associated with bad actors. Yet neither Instinct nor Muse had a single session linked to an attack.

That should unsettle anyone who relies on appearance as a proxy for risk. Arkose’s lead researcher, Mitchell Davies, argues that every agent shows signs of automation somewhere, so automation was never the right question. What matters is what the agent came to do, and what its intent is. The answer, he says, will differ by sector: a bank will want different controls from a retailer.

A familiar fight, now in court

The question of how agents should present themselves has already reached the courtroom. In November 2025, Amazon sued Perplexity, alleging that its Comet browser agent disguised its automated sessions as ordinary Google Chrome traffic. Amazon said it had tried technical blocks and a cease-and-desist letter, and that Perplexity had purposely configured Comet to disguise its activity. Perplexity countered that the suit was a bald attempt by Amazon to block its own customers.

In March 2026, a federal judge in California temporarily barred Perplexity’s agent from Amazon’s platform, finding strong evidence that it broke US computer fraud law. A US appeals court has since overturned that order, in what was described as the first appellate ruling on whether agents acting for users can lawfully access online platforms. The court reasoned that it was Perplexity’s users, using its agents, who accessed Amazon, rather than Perplexity itself.

The dispute is not settled, and it is worth keeping the cases apart: Amazon’s allegations concern Perplexity, not Muse, and Arkose does not suggest Muse has done anything wrong. But both illustrate the same underlying tension. A platform wants to know who, or what, is at the door. An agent’s makers may not wish to announce it, or may not yet have a standard way to do so.

Industry is building identification, but adoption is early

Standards are emerging. Cloudflare proposed Web Bot Auth in May 2025, a method by which an agent supplies a stable identifier using public-key cryptography and signed HTTP requests. Visa built its Trusted Agent Protocol on it, and Mastercard did the same for Agent Pay, with American Express also planning to use it. The aim is to let merchants admit legitimate agents while stopping fraudulent traffic at the front door.

Yet Arkose’s data suggests the gap between what is possible and what is practised remains wide. If fewer than 3% of agents are identifying themselves in live traffic, voluntary disclosure is nowhere near the norm.

The bottom line

Meta’s own design choices show the other half of the problem. Safeguards such as an isolated virtual machine, a monitoring agent and approval for sensitive actions concern what an agent is allowed to do. Arkose’s findings concern what the businesses on the receiving end can know about it. Those are different questions, and the second remains largely unanswered.

The CISO’s remark captures the moment. Agents are already handling logins, sign-ups and checkouts at scale, and the controls that would tell friend from foe are still being built. Until they arrive, companies will have to judge agents by their intent rather than their appearance, and as Instinct shows, the two rarely match.