AI agents from Meta and OpenAI made nearly 90% of the agent requests reaching sites and apps protected by HUMAN Security in October, according to the company’s monthly State of Agentic Traffic report. Meta’s Muse accounted for 59% on its own.
In October, total agent requests were approximately 8 times greater than in August and roughly 2.6 times greater than September’s. This report includes agent requests on HUMAN-protected sites and apps but does not include all internet traffic; each request represents an action by the agent, such as a page load or a search.
The majority of these requests accessed product and search content. There was a very small portion that reached the checkout area.
Meta And OpenAI Agents Made Most Of The Requests
Muse’s share of agent requests rose 19 percentage points from September, and the number of requests it sent nearly quadrupled. The report says Muse now sends 3.7 times as many requests as ChatGPT Agent, the next-largest agent. Meta launched Muse on Sept. 8.
OpenAI accounted for about 30% of total requests with three of the top 10 agents. ChatGPT Agent had 28.5% of requests in September, but despite sending 44% more requests, its share dropped to 15.9% as Muse grew faster, according to the report. The Codex Browser application increased from 7.7% to 8.8% and the Codex Chrome extension went up from 3.3% to 5.2%.
The Claude Chrome extension had a 50% drop in share, going from 7% to 3.5%, though it had a 30% increase in number of requests. Google’s newly released Gemini agent (launched Oct. 8, per HUMAN) came in at No. 8 with 0.8%. xAI’s Grok Agent was new to the top 10 at No. 9 with 0.7%.
Standalone Agent Browsers Lost Share
Genspark’s browser-based agent dropped off the top 10 list entirely; Perplexity’s Comet agent accounted for 41% of all agent requests in August but this figure declined to only 9.4% in September and then further to only 3.6% by October. Comet was also the only top-10 agent that experienced a drop-off in request volume during October, with a decline of approximately 30% since August. In addition, OpenAI discontinued its standalone ChatGPT Atlas browser in August.
The report attributes this downward trend to users selecting an agent based on either their familiarity with the platform or having used another product offered by the same company.
Most Requests Went To Product And Search Pages
In October, 85% of all agent requests in the report were directed toward product and search pages. This represents an increase over the previous month’s percentage when such requests totaled 81%. During the same period, requests made to checkout and payment pages decreased from 2.4% of the total to 1.9%.
According to the report, agents “still browse far more than they buy” but the number of requests making their way to checkout has been increasing at a rapid pace. The report’s page categorizations represent where a request ended up rather than what action was being taken, so a request arriving on a checkout page does not signify an order had been placed.
Ecommerce websites generated a stable share of approximately 60% of agent requests during this period, and travel was the second highest category, according to the report. Media generated the third largest portion among all categories tracked, marking the first time in this series that travel websites have outperformed media.
Identifying Muse
HUMAN uses a combination of behavioral data along with user-agent strings and, when available, publisher-level integration to determine what is agent generated, and it excludes crawler activity. The report says AgenticTrust has identified and verified Muse using HUMAN’s own proprietary research and digital signature validation. The report does not provide further breakdown on the percentage of Muse detected through each method.
In Meta’s engineering post on Muse, the company says Muse’s browsing “will appear as your activity” to the sites it visits.
Muse transferred its Web Bot Auth signatures from Meta’s key directory (meta.com) to its own (muse.ai) between Nov. 7 and Nov. 9, according to DataDome’s reporting on Nov. 11. Web Bot Auth allows agents to identify themselves by signing the request they are sending to a site, allowing the receiving site to verify the identity of who is making the request. At the time of my review on Nov. 13, the muse.ai key directory was active.
As of Nov. 10, half of Muse’s requests on DataDome’s network were being made without being signed, so there would be no signature to verify the source of the request. According to DataDome, sites that verify signatures and only accept those based on meta.com will now see Muse’s requests as having no verification. Both DataDome and HUMAN sell bot and agent identification services.
Why This Matters
For ecommerce and travel teams, HUMAN’s October report narrows down whose agents are sending most agent requests. In HUMAN’s data, two companies’ agents account for nearly nine in ten.
As Slobodan Manic wrote for SEJ in October, an agent like Muse gives robots.txt no name to match, so the decision about letting it in moves to bot protection. A bot rule that verifies signatures now needs Muse’s muse.ai directory, and in DataDome’s Nov. 10 count, about half of Muse’s requests carried no signature to check.
HUMAN’s report also says analytics tools on most sites can’t tell AI agents from human visitors. Muse and OpenAI’s three agents make a short list to raise with whoever runs bot protection before Black Friday.
Looking Ahead
The thing to watch is whether more of Muse’s requests start arriving signed. HUMAN says next month’s report will show how agents behaved over Black Friday and Cyber Monday.
Featured Image: jackpress/Shutterstock
