Developing
Arkose sells competing products; raw session counts and sample sizes are not published.
In 60 seconds
- 2.3% of legitimate AI agent sessions had a verified signature; ChatGPT agent signed 78.4% of its sessions and is "the only agent that signed at scale".
- 65.2% of customers saw AI agents on protected flows on September 30; 77.4% of agent sessions were classed legitimate versus 7.9% of known bot sessions.
- Muse sessions grew more than 30x in September; neither Muse nor Instinct had a session linked to an attack.
- 70.5% of registration sessions were fake-account attempts.
Impact Layer
- What changed
- Most legitimate AI agents visiting protected pages cannot prove who they are.
- Why it matters
- Sites cannot easily tell a customer's agent from abusive automation, so they may block both or allow both.
- Who is affected
- Security, fraud and e-commerce teams and anyone planning for agent traffic.
- Martech stack area
- AI, Data
- Stack impact
- Decide your policy for agent traffic and check whether your bot rules can read Web Bot Auth signatures.
- Business impact
- Moderate Vendor-published percentages from Arkose's own traffic for July 1 to September 30. Reach figures compare a four-day average with a single day, and Muse and Instinct profiles rest on eight hours of data.
- Related technologies
- What to watch
- More agents adopting signatures and independent measurements.
Arkose Labs, a fraud-prevention vendor, published The State of Agentic AI Trust Report, Q3 2026, on October 20, 2026, covering July 1 to September 30, according to PPC Land.
Key figures (vendor-published)
- 97.7% of legitimate AI agent sessions had no verified Web Bot Auth signature; 2.3% did.
- ChatGPT agent signed 78.4% of its sessions and was “the only agent that signed at scale”.
- 65.2% of customers saw AI agents on protected flows on September 30.
- 77.4% of AI agent sessions were classed as legitimate, versus 7.9% of known bot sessions.
- Muse sessions grew more than 30x in September, with no absolute numbers given.
- 70.5% of registration sessions were fake-account attempts; roughly one in 5,200 protected sessions came from a named AI agent.
Method and gaps
The data is Arkose’s own production traffic, with test and internal accounts excluded, limited to five protected actions. Reach figures compare a four-day pre-detection average with a single day, and Muse’s pre-September 22 figures are reconstructed. Raw session counts, customer numbers and independent verification are not given.
Our read
Signatures are the obvious fix, and almost no agent uses them yet. Until they do, you are guessing who is who.
Sources
- PPC Land: 97.7% of legitimate AI agent sessions carry no verified ID, Arkose finds (opens in a new tab)
Source for the report's figures, method and gaps.