Executive summary
Only 2.3% of legitimate AI agent sessions carried a verified Web Bot Auth signature; ChatGPT agent was "the only agent that signed at scale". 77.4% of AI agent sessions were classed as legitimate, versus 7.9% of known bot sessions.
Key findings
- 97.7% Most legitimate agents are unverified
Share of legitimate AI agent sessions with no verified Web Bot Auth signature. - 78.4% ChatGPT agent signs
Share of its sessions that were signed. - 65.2% Agents are widespread on protected flows
Share of customers who saw AI agents on protected flows on September 30. - 70.5% Registration sessions are mostly fake
Share of registration sessions that were fake-account attempts.
Methodology
Arkose's own production traffic from July 1 to September 30, 2026, with test and internal accounts excluded, limited to five protected actions. Muse's pre-September 22 figures are reconstructed from stored data, and the Muse and Instinct profiles rest on eight hours of data.
Arkose Labs published the report on October 20, 2026, covering July 1 to September 30. PPC Land analysed it.
How to read it
Arkose sells fraud-prevention products that compete with others in this area, and the data is its own production traffic. Raw session counts, customer numbers and sample sizes are not published, and some reach figures compare a four-day average with a single day.