CHICAGO--(BUSINESS WIRE)--Fingerprint, the industry leader in device intelligence, today announced expanded bot detection capabilities that identify traffic inferred to be undeclared AI agents, including Meta's Muse, Spear Street's Instinct and xAI's Grok Bot. As more AI agents operate without identifying themselves, Fingerprint provides browser-level visibility to recognize previously unidentified automated traffic, distinguish it from legitimate human activity and enable businesses to determine which interactions to allow, limit or block.
The AI Agents Operating Without Declaring Their Identity
More than half of all web traffic in 2026 is no longer human, which is largely due to AI agents acting on behalf of consumers or enterprises. While industry standards such as Web Bot Auth were designed to let AI agents cryptographically prove their identity, a growing wave of prominent agents are choosing to operate undeclared or are actively shifting away from signed traffic:
- Muse provides no verifiable identity, alters its browser fingerprint and suppresses the standard automation flags that traditional bot detection tools rely on. Fingerprint’s research team shipped detection for traffic inferred to be Muse roughly two weeks after the agent was announced, and subsequently identified Muse activity on a major bank’s login flows that the bank’s other security vendors failed to flag.
- Instinct logs into websites using human credentials, including by requesting multi-factor authentication (MFA) codes from the user via SMS, without signing its traffic via Web Bot Auth. In one high-profile case reported by CNN, Instinct pinged restaurant reservation platform Resy hundreds of times every hour on behalf of a user, resulting in account deactivation.
- Grok Bot can sign in to websites, work through inboxes, and finish multistep tasks for real users. It used to announce itself on arrival by signing its requests with Web Bot Auth, but around October 9, 2026, it stopped.
“More AI agents are visiting websites without disclosing their identity, and some that used to, like Grok Bot, have stopped,” said Dan Pinto, CEO and Co-founder of Fingerprint. “That lack of transparency is already a widespread issue: Fingerprint’s recent report found that 79% of financial institutions have caught a malicious bot or scraper posing as an AI assistant. Fingerprint can identify traffic inferred to be Muse, Instinct and Grok Bot without any assistance from their developers, giving enterprises the ability to uncover previously undetected AI agent activity and make informed decisions about which traffic to allow, limit or block.”
How Fingerprint’s Bot Detection Smart Signal Identifies Humans, AI Agents and Bots
Legacy bot management tools force businesses into either blocking all automated traffic, which risks turning away paying customers’ AI assistants, or allowing unrecognized automation, which exposes login flows and payment methods to abuse. Fingerprint checks the network edge and/or the browser to reveal what is behind every visit: a human user, a known automated bot, an AI agent that cryptographically proves who it is, an undeclared AI agent that hides its identity or a spoofed bot masking its identity.
With Fingerprint’s Bot Detection Smart Signal, security and fraud teams can:
- Read changing signals: Identify visitors and surface intent cues even as device and browser signals evolve. Fingerprint’s dedicated global research team continuously analyzes emerging agentic frameworks to ship new detections within days as browsers and AI agents change their behavior.
- Move beyond "bot or not": Distinguish malicious automation and human fraud from trusted returning visitors, verified AI agents and undeclared AI agents. Fingerprint labels traffic inferred to be specific agents such as Muse, Instinct and Grok Bot along with high, medium or low confidence tiers.
- Reveal full network and device context: Combine agent inference with granular telemetry, including IP address, Autonomous System Number (ASN), ASN type and whether a request came from a data center and which one. This context helps companies evaluate the true risk of every session.
Availability and Resources
Detection for Muse, Instinct and Grok Bot is available today through Fingerprint Bot Detection via the Fingerprint JS Agent, Server API, Rules Engine and the Fingerprint MCP Server.
About Fingerprint
Fingerprint detects the intent of human and agentic visitors. Our device intelligence platform identifies over 1 billion unique devices every month and processes hundreds of signals to help fraud teams distinguish trusted visitors from bad actors at speed and scale. Over 6,000 companies, including innovators like Plaid, Booking.com, Dropbox, Trustpilot and Checkout.com, use Fingerprint every day to recognize high-risk activity in real time, prevent fraud attacks and deliver frictionless user experiences.
Read More:
AI Agents in Cybersecurity: What’s Working Today and What’s Not?
