.png)
AI agent traffic across DataDome’s network grew 41.5% quarter over quarter to nearly 25 billion requests in Q3 2026, according to the company’s AI Traffic Report Q3 2026. Meta’s Muse generated 29.1 million requests between September 22 and October 3, its first 12 days of full availability. In a sample of Muse traffic, 99.3% of requests came from cloud and CDN infrastructure.
Nearly half of the AI agent traffic recorded in 2026 through September occurred in Q3. The growth had left capacity plans and bot-management policies based on the previous quarter’s averages out of date.
Meta leads AI agent traffic
Meta-ExternalAgent and Meta-WebIndexer generated a combined 12.4 billion requests in Q3, accounting for 49.7% of AI agent traffic recorded. Meta-WebIndexer overtook Meta-ExternalAgent in September, which is interpreted as a sign of continued investment in AI answer generation. ClaudeBot ranked fourth for the quarter, overtaking GPTBot.
Top AI agents per month (Source: DataDome)
OpenAI, Anthropic and Amazon each use separate bots to collect training data, index pages for AI search and retrieve pages when users ask questions. Each bot has a distinct name, allowing website owners to allow or block it individually. These controls do not cover AI agents that browse websites through a regular browser without using those bot names.
This separation gives publishers a way to refuse model training while remaining accessible to AI search and answer services. It also helps AI companies develop search results with current information and source links, reducing their reliance on Bing, Google or Brave.
Each additional bot gives publishers another access setting to manage. Companies do not always explain upfront how each bot treats robots.txt, the file website owners use to communicate rules for automated access.
Agentic browser traffic nearly quintuples
Agentic browser traffic in the dataset rose from 12.5 million requests in August to 58.2 million in September. Excluding Muse, traffic more than tripled to 38.7 million requests.
ChatGPT’s cloud browser generated the most traffic in the category in September. Muse accounted for 33% of that month’s total after becoming fully available on September 22. Comet’s traffic fell 65% from July to September.
Muse is a personal AI agent that operates inside a dedicated cloud virtual machine containing a browser. DataDome includes it in the agentic browser category because its traffic is browser-driven.
Its daily traffic patterns were consistent with user activity instead of a scheduled crawl. In the sample, 8.9% of requests reached sensitive website endpoints, including login, payment, account creation, shopping cart and form pages. Forms accounted for 81% of that sensitive traffic, receiving about eight times as many requests as login pages.
“Muse is the first mass-market example of where agentic traffic is heading. It works from its own cloud virtual machine, so nearly all of its requests look like data-center traffic rather than a user’s device, and a meaningful share lands on forms and checkout flows,” said Jerome Segura, VP of Threat Research at DataDome.
“Policies that trust residential or ISP-based traffic won’t catch agents like this. Organizations need to validate agent identity, understand intent, and decide deliberately which agents to allow and what they’re authorized to do.”
from Help Net Security https://ift.tt/wI5fevU
0 comments:
Post a Comment