Muse is the web’s busiest agent — and websites are footing the bill

Cloudflare’s November 5 paper says sites bear the primary cost of AI-agent visits in nearly every case it lists, and Muse — at 72% of AI agent requests — is the biggest visitor. It proposes identity and rate-limiting standards, with some controls already live.

Reported byppc.land (opens the original story)

In this brief: 4 sections 2 min read

- Paper by Bryan Becker, “Agents aren’t humans (but they kinda are)”, published November 5.
- Lists 14 problems AI agents create for websites; “in nearly every challenge above, the site bears the primary cost.”
- Examples: shops that can’t tell if a purchase was authorised, login forms hammered by software holding real credentials, articles summarised by a bot that never loads an ad.
- Muse accounts for an average of 72% of daily AI-agent requests, 5.2x the volume of ChatGPT Agent.
- Arkose Labs found 97.7% of legitimate AI agent sessions carry no verified identity.
- DataDome counted 29.1 million Muse requests on its network between September 22 and October 3.
- Proposes a four-level scale of user identity: nothing, session, account, unique.
- Favours Web Bot Auth for agent identity and a rate-limiting scheme called MOLE that works without user identifiers.
- Calls for a machine-readable way to state what agents may do, since robots.txt wasn’t built for the job.
- A coalition called Trusted Agent Delegation will take the problems to standards bodies.
- Analytics for personal assistant traffic is live.
- Per-agent access policies can block agents only on pages carrying ads.
- Account Abuse Protection is in early access.
- Cloudflare published no traffic, dispute, or adoption figures for the new controls.

Read full analysis on ppc.land

Useful?