> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Meta AI agents drive 49.7% of web traffic, targeting sensitive finance endpoints via cloud… - URL: https://f4n6.co.uk/security-feed/meta-ai-agents-drive-49-7-of-web-traffic-targeting-sensitive-finance-endpoints-via-cloud/ - Published: 2026-10-19T10:40:44.000Z - Updated: 2026-10-19T10:40:44.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary DataDome's AI Traffic Report Q3 2026 records AI agent traffic across its network at nearly 25 billion requests in Q3 2026, up 41.5% quarter on quarter, with Meta-ExternalAgent and Meta-WebIndexer together accounting for 12.4 billion requests, or 49.7% of AI agent traffic. Meta's Muse agent generated 29.1 million requests in its first 12 days of full availability (22 September to 3 October), and in a sampled subset 8.9% of its requests reached sensitive endpoints including login, payment, account creation, cart and form pages, with forms taking 81% of that sensitive traffic. No CVE, exploit or malicious actor is identified in the source; this is automated agent traffic from named commercial bots, not an intrusion. The risk to EMEA financial services is operational: bot-management and capacity policies built on prior-quarter averages are out of date, and agents that browse through a regular browser without a declared bot name are not covered by per-bot allow/block controls. The figures are single-sourced to DataDome's own network telemetry and have not been independently corroborated. ## 2\. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item. ## 3\. Technical analysis & attack chain This item describes automated traffic from commercial AI agents, not an intrusion. There is no initial-access vector, no exploited component and no payload. The relevant mechanism is how the agents reach endpoints and why existing bot controls miss them. 1. Meta operates two declared crawler identities, Meta-ExternalAgent and Meta-WebIndexer, which generated a combined 12.4 billion requests in Q3 2026\. Meta-WebIndexer overtook Meta-ExternalAgent in September, which DataDome reads as continued investment in AI answer generation. 2. OpenAI, Anthropic and Amazon each run separate bots for training-data collection, AI search indexing and on-demand page retrieval. Each bot has a distinct name, so a site owner can allow or block it individually. 3. Meta's Muse is a personal AI agent that runs inside a dedicated cloud virtual machine containing a browser. DataDome classifies it as agentic browser traffic because requests are browser-driven rather than a scheduled crawl. 4. In a sample of Muse traffic, 99.3% of requests came from cloud and CDN infrastructure. Daily traffic patterns matched user activity rather than a crawl schedule. 5. In that sample, 8.9% of requests reached sensitive endpoints: login, payment, account creation, shopping cart and form pages. Forms took 81% of the sensitive traffic, about eight times the volume of login pages. 6. Agentic browser traffic in the dataset rose from 12.5 million requests in August to 58.2 million in September. Excluding Muse it more than tripled to 38.7 million. ChatGPT's cloud browser generated the most traffic in the category in September; Muse took 33% of the month's total after full availability on 22 September; Comet's traffic fell 65% from July to September. The control gap is the operative finding. Per-bot allow/block settings only work against agents that declare a bot name. Agents that browse through a regular browser without using those names are not covered, and because Muse traffic originates from cloud and CDN ranges, policies that trust residential or ISP-based traffic will not distinguish it from a data-centre client. DataDome's Jerome Segura states that organisations need to validate agent identity, understand intent, and decide which agents to allow and what they are authorised to do. Confidence caveat: every figure above comes from a single vendor's network telemetry (DataDome, reported by Help Net Security). The 8.9% sensitive-endpoint share and the 99.3% cloud/CDN share are drawn from a sample of Muse traffic, not the full population, and the sample size is not given. Treat the percentages as directional until corroborated against your own edge logs. ## 4\. Mitigation & containment P1 within 24h - Pull the last 30 days of edge and WAF logs and segment automated traffic by user-agent and by source ASN. Identify requests to login, payment, account-creation, cart and form paths that originate from cloud and CDN ranges rather than residential or ISP ranges. This is the population the source says current policies miss. - Inventory which declared bots (Meta-ExternalAgent, Meta-WebIndexer, ClaudeBot, GPTBot and the other named agents) you currently allow, and confirm the allow rules are scoped to the paths each bot legitimately needs rather than site-wide. P2 within 72h - Add rate limits and challenge (CAPTCHA or proof-of-work) on form and checkout endpoints for cloud-origin clients that do not present a declared, verified bot identity. The source puts forms at 81% of sensitive agent traffic, so this is where the volume lands. - Where the bot operator publishes verification (IP ranges or reverse-DNS for the declared crawlers), enforce it so a spoofed user-agent cannot inherit an allow rule. The source notes companies do not always explain upfront how each bot treats robots.txt, so do not rely on robots.txt as an access control. - Re-baseline capacity and bot-management thresholds against Q3 volumes; the source states plans based on the previous quarter's averages are out of date. P3 within 7 days - Define an explicit agent policy: which agents are allowed, on which paths, and what they are authorised to do (read-only browse versus form submission or account creation). Segura's recommendation to validate identity and intent maps directly to this. - Instrument detection for the behavioural pattern in §5 so agent traffic to sensitive endpoints is alerted on rather than discovered in a quarterly report. ## 5\. Indicators of compromise No atomic indicators of compromise are available in the source material. The source describes observable traffic behaviours but gives no IPs, domains, user-agent strings, hashes or file artefacts. The bot names below are legitimate commercial crawler identities, not malicious indicators; they are listed for allow/block policy work, not for blocking by default. ### Behavioural indicators | behaviour | where to observe | confidence | | ------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------- | -------------------------------- | | High-volume requests from cloud and CDN ASNs to form, login, payment, cart and account-creation paths | Edge/WAF logs, ASN enrichment | Medium (single-sourced, sampled) | | Browser-driven request cadence matching user activity rather than a fixed crawl schedule | Edge logs, request timing per session | Medium (single-sourced) | | Requests carrying Meta-ExternalAgent or Meta-WebIndexer user-agent at high volume (49.7% of AI agent traffic in Q3) | Edge/WAF logs, user-agent field | Medium (single-sourced) | | Browser-based agent traffic without a declared bot user-agent | Edge logs, user-agent absent or generic browser string from cloud ASN | Medium (single-sourced) | ## 6\. Detection Insufficient indicators to author detection rules. The source provides no file artefacts, command lines, registry keys, process behaviour or distinctive strings belonging to a threat. The only named values are legitimate crawler user-agents and product names, which are not threat artefacts and would produce rules that match reporting about the traffic rather than the traffic itself. Detection should instead be built on the behavioural indicators in §5 using your own edge telemetry. ## 7\. Sources - Help Net Security, "Half the AI bot traffic hammering your website comes from Meta", 2026-10-19\. https://www.helpnetsecurity.com/2026/10/19/datadome-ai-agent-traffic-report/ - DataDome, AI Traffic Report Q3 2026 (cited within the above; not independently retrieved). ## 8\. Adverse Trace position No CVE is associated with this item and no exploitation is recorded, so there is no vulnerability severity to assign; the source describes legitimate commercial agent traffic, and we do not treat it as an attack. The client impact is real but operational: a meaningful share of automated requests now lands on forms and checkout flows from cloud infrastructure, and per-bot controls do not cover browser-based agents that omit a bot name. The figures are single-sourced to DataDome's network and sampled, so we assess them as directional and recommend clients validate the pattern against their own edge logs before changing allow/block policy. Adverse Trace will re-check the DataDome report and any independent telemetry for corroboration of the 8.9% sensitive-endpoint and 99.3% cloud-origin shares, and will issue a follow-up if corroborated figures differ materially or if a named agent is linked to credential-stuffing or payment fraud activity. --- [Read the original source →](https://www.helpnetsecurity.com/2026/10/19/datadome-ai-agent-traffic-report/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*