Meta launched Muse in September 2026, and within a week it was the top free app in Apple's U.S. App Store. Muse logs in, browses, compares products, and checks out for the person who asked it to. On a merchant's side of the screen, that session arrives on a device with no history, with a valid username and password, and with none of the usual signs of a person at the keyboard. Most fraud stacks read that combination as a generic bot or account takeover.
Two questions follow, and merchants have to answer both at once. Is this session an attacker or a customer's assistant? And if it's an assistant, what should it be allowed to do?
AI agents are the new actor on the Internet. They blur the line between “good bots” and “bad bots”. Once you know which tool is acting, what it is doing, and whom it is acting for, you can stop fraud and abuse without slowing down or turning away legitimate users. That approach follows your risk policy and complements your KYC process.
Sardine now names the agent behind a session, starting with Meta's Muse and ChatGPT. With a name on the session, you can set policy for each agent and the action it takes, and stop treating all automation as one bucket.
Key takeaways
- Meta Muse sessions arrive with valid credentials, no device history, and automated behavior. Those are the same signals that trigger account takeover scores for actual fraud. Knowing which agent is behind the session is what separates a blocked customer from a caught attacker.
- Sardine identifies Meta Muse and ChatGPT agents by name using BotName. That name gives merchants something specific to act on rather than treating all automation as one undifferentiated bucket.
- Not all agents announce themselves. Agents that sign their requests are straightforward to name. Agents that run a real browser and present as ordinary visitors, like Muse, are identified through behavioral and infrastructure signals instead.
- The right response to agent traffic is not a blanket allow or block. Different actions carry different risk levels. Policy should follow what the agent is attempting, with browsing treated differently from login, account changes, and checkout.
- BotType is coming soon and will group recognized agents into categories. That means merchants can write one rule covering every agent in a class rather than updating rules each time a new agent launches.
What is Meta Muse? How its shopping agent reaches your site
Muse is a personal agent. Instead of answering one question at a time, it completes multi-step tasks across email, calendar, payments, dining, and shopping. Meta says Muse runs on a secure virtual machine with its own browser. Where a service offers a public API, Muse uses it with credentials the person provides. Where no API exists, Meta says the agent can use the service through a browser "the way you would."
That second path is the one merchants see. Muse opens a real browser on Meta's infrastructure, loads your pages, and interacts with them like a visitor. Amazon says Muse doesn't identify itself when it browses, and Amazon blocked it from shopping on Amazon.com after Meta declined to exclude the site. Meta says Muse asks the person for approval before sensitive actions, such as placing an order.
For a merchant, the practical point is that a customer is behind the session, but nothing in the request says so.
How agents differ from bots
An AI agent is software that acts for a specific person, such as logging in, browsing, and buying on their behalf. A bot is automation that runs without a specific person behind each action, such as a crawler or a scraper. At the network level the two look the same, because agent traffic doesn't travel through a separate channel.
Agents also differ from each other in how they show up.
- Agents that self-declare. Some announce themselves, for example through request headers or signed requests. Standards for agent identity are still emerging, and these agents are the easiest to name.
- Agents that look like ordinary browsers. Others run a real browser and present as a regular visitor. Muse falls here, so identifying it relies on other signals instead of a declared identity.
So fraud teams have to decide how much to trust each agent and each action it takes. One rule for all automation would treat a customer’s shopping agent the same as a scraper.
Why Meta Muse sessions look like account takeover
A normal returning customer shows up on a device you've seen before, from a familiar network, and moves through a form at human speed. A Muse session breaks each of those patterns.
- New device. The browser runs in Meta's cloud environment, so the device has no history with the account.
- Network signals. Traffic can carry proxy or VPN indicators that a home connection wouldn't.
- Valid credentials. The login succeeds, because the customer handed Muse real credentials.
- Automated behavior. Pages load, forms fill, and carts build in ways that differ subtly from real users.
- Remote software signals. When a person watches or takes over the agent's browser, the session can also register as remote access.
Each signal is a standard account takeover indicator. Together, they produce a high-risk score for a session that a real customer authorized. Teams that block the pattern outright turn away customers who chose to shop through an assistant. Teams that ignore it leave the door open to fraudsters who use the same pattern with stolen credentials.
The two cases can look identical at the session level, which is why identification has to come first.
AI agent detection: how Sardine names the agent behind a session
Sardine returns a named label when it recognizes a specific bot or AI agent. The BotName field carries that name, such as Muse or ChatGPT, so you can write rules by the specific tool, for example low risk for tools you've approved and high risk for everything else.
A name gives your team something specific to act on. You can see how much Muse traffic reaches your login, search, and checkout pages, compare its conversion and fraud outcomes against other traffic, and write rules that apply to Muse specifically. Without a name, that traffic sits inside a general automation bucket that you can only block or allow as a whole.
Sardine’s team creates signals based on actual traffic. Agents that self-declare are straightforward to identify by name, while agents that present as ordinary browsers are identified through different signal signatures, with confidence varying by agent.
Group agents with Bot Category
Writing a separate rule for every bot name takes more work with each new agent that launches. BotType (coming soon) builds on BotName and additional signals to group recognized automation into categories, so you can write one rule for a whole class of traffic. AI agents and tools will receive their own BotType designation, which lets you treat them differently from other automation.
Agents need their own category. Treating a shopping assistant like a scraper blocks revenue, and treating it like a search crawler gives it access to account and payment flows that crawlers never touch. With a category, one rule covers every agent you recognize today and the ones that launch next month.
AI agent rule engine policy set by action
If you can recognize legitimate agent traffic, you can give agentic transactions more approval where it makes sense and watch them closely where it doesn't. An agent label shouldn't produce a single allow or block decision. Different pages carry different risk, so the policy should follow the action:
- Allow browsing and product research. Reading catalog pages exposes little, and it's where agent-driven discovery starts.
- Decide which agents you trust at login. When a customer hands an agent their credentials, the agent stores them, often without the customer realizing it. Anyone who takes over the customer’s account with that agent can then reach their account with you. At login, you’re deciding whether the agent protects those credentials. You can answer that differently for each agent you recognize. For agents you don’t yet trust, consider a step-up check or read-only access. The agent can only use a code sent to the customer if the customer passes it along. When Sardine tested a ChatGPT agent purchase, the agent stalled at two-factor authentication.
- Review changes to account details. New shipping addresses, email changes, and payout or payment method updates are where takeover fraud cashes out, whether an agent or a person makes them.
- Apply order limits at checkout. Cap order value, quantity, and velocity for agent sessions until you've seen how your customers use them.
Start with limits and step-up checks instead of blocks. A customer who chose to shop through an assistant is still your customer, and a block impedes them.
Where this is available
BotName is currently available to all merchants today, with BotType coming soon.
What's coming next
You can write the rules you need for agent traffic today, but keeping them current as the number of AI agents grows is the harder part. Sardine is working on a faster way for teams to turn their internal risk policy into rules that run in the rule engine and power decisions. At the same time, the list of agents and tools Sardine can name keeps growing, as the team confirms that each one has a signature strong enough to label with confidence. That gives your rules more agents to work with as the policy behind them evolves.
FAQs
Is Muse a bad bot?
Muse acts for a real customer, which is what the agent category covers. An agent can still be misused, so the category is a starting point for policy and not a verdict on any one session.
Can I block Muse?
Yes, but blocking removes customers who chose that channel. Amazon blocked Muse from its store and says it is in talks with Meta. Most merchants will want a narrower policy, such as allowing browsing and adding checks on login and payment.
How are agents different from other automation?
Agents act for an individual customer in real time, so their traffic follows customer behavior and includes real purchases. Scrapers and credential-stuffing tools run at volume with no purchasing customer behind them.
Which agents does Sardine name today?
BotName recognizes Muse and ChatGPT's agent, along with other known bots. New agents are added as they gain adoption.
Does this work for mobile apps?
The bot fields signals, including BotName and BotType, come from Web SDK data, so native iOS and Android SDK traffic doesn't return them. Native SDKs return environment and application tampering signals instead.
Where can I read more about agentic commerce?
Our whitepaper, Rethinking Fraud Prevention for Agentic Commerce, covers how agent-driven checkout changes fraud controls.
How do I get started?
Contact us to take a deeper dive into bot and agent detection, or reach out to your Sardine account team if you're already a customer.
Read more about Sardine bot detection → https://www.sardine.ai/bot-detection
