DataDome

Meta's Muse personal agent is bringing Agentic Browsing to the masses and it's worth highlighting why that matters. Agentic browsing is an AI that doesn't just read the web for you, it uses it for you. It opens a real browser, keeps cookies and a logged-in session from one step to the next, clicks through multi-step flows, fills in forms and checks out. For the past year, a lot of the conversation about how AI agents would access websites focused on MCP and other structured ways for sites to hand content to agents on their own terms. Muse's adoption and future developments puts this into perspective. In our latest research, we looked at how Muse actually shows up in web traffic. To a website, every Muse session looks like a plain Chrome browser on Linux. It doesn't identify itself through Web Bot Auth, nor does it come from officially documented IP ranges. This is not (and won't be the last) cloud browser running in a VM. Yet, the challenges remain the same to properly profile it without blocking it by accident. And once you do, the bigger question becomes understanding its intent so website owners can decide whether they want to allow it or not.

The agentic web is moving fast, and Meta’s Muse is one of the clearest signals yet. Our Threat Research team has been identifying Muse by analyzing complex client-side signals from the browser itself. Across live sessions, the environmental overlap is striking, revealing a highly consistent sandboxed setup behind traffic that otherwise looks like ordinary Chrome. And the growth is already significant: since September 23, peak Muse traffic across our network has increased about 2.5x. What makes Muse especially interesting is that it does not declare itself. There is no dedicated User-Agent, published IP range, or signed identity signal. But even identifying the agent is only part of the challenge. The real question is intent. A legitimate agent completing a checkout and a fleet of agents scraping a catalog can look very similar. Our latest Threat Research breaks down what Muse means for the agentic web: 👉 https://lnkd.in/gjgdiY56

Our 2026 State of Bot and Agent Security Report is out, and one of the biggest takeaways is how fast malicious traffic is growing: 9x that of human traffic. The attacks themselves will be familiar to most security teams: scalping, scraping, DDoS, and fake account creation. What needs a closer look is the scale. Credit to Galileo, our threat research team, for doing the analysis across traffic from 20,000+ websites and 75k+ domains across our customer base. That gives us a view beyond any one company or sector. Most teams see only their own slice of the problem: their traffic, their incidents, and their customers. The value of this report is in connecting those slices and showing how automated threats are moving across industries and geographies. Read our report now: https://lnkd.in/dwpXV48c

Modern e-commerce platforms face increasingly sophisticated automated threats — from account takeover and payment fraud to large-scale scraping and malicious bots. DataDome provides real-time protection across your retail websites, applications and APIs, helping businesses identify and block malicious activity before it impacts customers or revenue.

For retailers and e-commerce businesses, automated threats can impact far more than website performance. Account takeovers, payment fraud, scraping and malicious bots can put customer accounts, transactions and revenue at risk. DataDome helps businesses detect and stop sophisticated automated threats in real time — while keeping the checkout experience seamless for legitimate customers.

💭 I'm sure most would agree that fraud in ecommerce is something we have generally mastered over the past 2 decades, and managed to keep mostly under control. ⚠️ Agentic AI is mixing up the cards, and creating massive new opportunities, all with significant new risks. 🚀 With Google rolling out agentic checkout, a Paypal/Google agentic commerce solution, Amazon piloting "Buy for me", Perplexity announcing agentic shopping and Visa/Mastercard developing their agent trust protocols, it is undeniable agentic commerce will represent an important portion of revenue for merchants. Even just this year, the % of bot traffic has quadrupled, reaching 10% of bot traffic in Q3. Agentic AI supercharges existing fraud threats, but also brings new risks we must prepare for: 🟣 Highly scalable automated ATOs and credential stuffing attacks 🟣 Fully orchestrated fraudulent account creation (including deepfaked IDs) 🟣 New ATOs, targeting agent takeover rather than account 🟣 MCP server attacks With this transformation of how customers interact with our platforms comes many questions: ❓ Who, in the organization, is responsible for the management of agents, and the defense against fraudulent ones? ❓ Who is liable for the losses if an agent is hijacked or taken over? Fraud teams should start checking a few crucial elements to assess their readiness: ✅ Regarding Agentic AI and agent management, are the roles well defined between fraud, cybersecurity, compliance and other teams? Do we have a documented AI policy? ✅ Can we identify the agents visiting our site? Once that's done, can we understand those agents' intent and detect malicious behaviors? ✅ Do we have the right skillsets in the fraud team to build to antifraud rules and investigate agent-related fraud cases? ✅ Do we have the right technology in place to detect agent takeover and block unwanted or untrusted AI agents? 👂 I'm curious to hear where you feel agentic AI is going in 2026. Do you think it will keep growing? Is the threat real? Do you see those new types of attacks today? 📖 Also, if you want to do a full assessment of your organization's readiness, I will leave a link to DataDome's latest "Guide to Readying Your Business for Agentic Commerce" in the comments below. Go have a look. It is a great introduction to Agentic AI's potential, and the necessary steps to be ready for it. 👇 #fraud #fraudprevention #agenticai