AI agents surge on protected transactions, Arkose says

Arkose Labs has published its Q3 2026 State of Agentic AI Trust Report, which finds that personal AI agents are increasingly carrying out online transactions for consumers.

According to the report, 97.7% of legitimate AI agent sessions included no verified identity disclosure, while more than 65% of Arkose Labs customers encountered AI agents on protected transactions such as logins, registrations and checkouts.

The traffic was observed across banking, gaming, technology and travel sites, based on production data gathered between July and September. The report says AI agents now appear across the customer journey, including on login and registration flows in every industry measured.

One sharp change came from Meta's Muse, described as a personal AI agent built for consumer use. Sessions from Muse rose more than 30-fold in September, far outpacing other agents, which remained broadly flat.

The report argues that businesses face a new problem as consumer-facing AI agents become more common in routine digital activity. The challenge is no longer only identifying automation, but deciding whether an automated session reflects a legitimate customer action or a malicious attempt at fraud.

Arkose Labs classified 77.4% of AI agent sessions as legitimate, compared with 7.9% of known bot sessions. At the same time, it noted that the automated flows used by AI agents overlap with those commonly targeted by attackers, with 70.5% of registration sessions identified as fake-account attempts.

Intent versus appearance

The findings also point to a gap between how some agents appear and what they do. Arkose Labs said Instinct was designed in a way that made 96.8% of its sessions appear medium or high risk because it used techniques commonly associated with bad actors. Yet neither Instinct nor Muse had a single session linked to an attack.

That distinction matters for companies deciding whether to allow or block automated traffic. A blanket approach risks excluding genuine customers using AI tools on their behalf, while a permissive approach could leave organisations open to account abuse, fake registrations and other forms of fraud.

Part of the challenge, the report says, is that some agents do not clearly identify themselves. Muse appears on networks as a Chrome browser, making it harder for conventional controls to distinguish it from ordinary web traffic.

Arkose Labs groups agents into three categories: self-disclosing good agents, non-disclosing good agents and malicious agents. It describes Muse as an example of a non-disclosing good agent.

Kevin Gosschalk, Founder and Chief Executive Officer of Arkose Labs, said the findings reflected a wider concern among security leaders. "At a recent banking industry summit, the CISO of one of the world's largest banks said that, for the first time in his career, a technology has arrived ahead of the controls."

He said the report underscored how hard it has become for companies to distinguish legitimate, revenue-driving agents from malicious ones. "The State of Agentic AI Trust Report echoes this and makes it clear how difficult it has become for companies to distinguish legitimate, revenue-driving agents from malicious ones," Gosschalk said.

The data suggests the issue is spreading quickly rather than remaining confined to a narrow set of digital services. By the end of the third quarter, 65.2% of Arkose Labs customers had seen AI agents on protected flows.

Mitchell Davies, Lead Researcher in the Arkose Cyber Threat Intelligence Research team, said the presence of automation alone is no longer the deciding factor. "Every agent we track shows signs of automation somewhere. This was never the question."

He said businesses now need to focus on purpose and context. "The real question is, what did the agent come to do? What is its intent? Each company must decide how to handle them accordingly, taking their industry and risk posture into consideration. For example, a bank will have different controls in place than a retailer," Davies said.