TL;DR: Agentic traffic tripled in September, with Meta’s Muse reaching 40.34% of observed traffic and OpenAI products combining for 39.7%, according to HUMAN’s benchmark. Research and discovery still dominate usage, but the growth in agent volume makes identity, access and policy controls harder to defer.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on HUMAN's research: Agentic traffic tripled in September as Muse and OpenAI products drove a sharp rise in AI agent activity across ecommerce and other sectors.
Why it matters: Identity, access and policy controls now shape how organisations govern AI agents, because traffic growth is outpacing the trust and authorisation models most sites still rely on.
By the numbers:
- Meta’s Muse debuted as the No. 1 agent by observed traffic share, capturing 40.34% of total agentic traffic in September.
- OpenAI products represented 39.7% of total agentic traffic.
- Ecommerce sites accounted for 60.3% of agentic traffic in September.
Context
Agentic traffic is the portion of web activity generated by AI agents rather than human users. That distinction matters because agent sessions often blend browsing, search, account access and transactional behaviour, which means existing bot controls and identity policies are forced to interpret machine behaviour without a clear trust model.
The governance gap is not simply volume. As more agents move from research into account management and checkout flows, organisations have to decide whether each agent gets its own identity, what it may do inside a session, and how to distinguish legitimate automation from abuse. agent identity models are becoming relevant because the operational question is no longer whether agents exist, but how they are authorised and observed.
Key questions
Q: How do AI agents get authorised to use web accounts?
A: AI agents should be authorised through explicit delegation boundaries, scoped permissions and revocation paths that define exactly what they may do in a session. In practice, organisations need to decide whether the agent acts as a separate principal or as a delegated extension of the user, then enforce that decision at authentication and action time rather than only at login.
Q: Why do browser agents create fraud risk in ecommerce?
A: Browser agents can mimic a real shopper, automate account creation, scrape prices, test stolen cards, and complete checkout or payment flows at machine speed. Fraud teams need session telemetry, device fingerprinting, behavioural anomaly detection, bot management, and step-up authentication at sensitive actions such as login, basket changes, and payment submission.
Q: How should security teams detect shadow AI inside approved applications?
A: Start by looking for AI capability inside software people already use, such as copilots, embedded assistants, and model-backed workflow features. Then combine SaaS telemetry, browser signals, identity context, and data movement logs so you can tell who used the capability, what data moved, and whether the behaviour was authorised.
Technical breakdown
How agentic traffic is classified across web sessions
Agentic traffic classification combines behavioural signals, user-agent attribution and, where available, publisher-level integration. That matters because many agents look like ordinary browser automation until the session is inspected in context. In practice, classification has to separate research-only browsing from higher-risk actions such as login, checkout and account management, because those routes carry different fraud and access implications. The key technical issue is that intent cannot be inferred reliably from headers alone; it emerges from repeated request patterns, destination endpoints and interaction timing. See the Shadow AI and AI Agent Discovery Guide.
Practical implication: Treat agent classification as a detection and policy problem, not a simple user-agent filter.
Why agent identity matters when traffic moves into accounts and checkout
Once agents move beyond browsing into authentication or user-account routes, the system is no longer just observing automation. It is handling delegated access. That creates a governance problem familiar from IAM and NHI programmes: each agent session may need a distinct identity, a scoped entitlement set and a revocation path. Without those controls, a browser agent can inherit more trust than the organisation intended, especially if users begin connecting it to personal or business accounts.
Practical implication: Bind agent sessions to explicit authorisation boundaries before allowing account or payment actions.
Why ecommerce is the first major pressure point
Ecommerce dominates agentic activity because it is naturally information rich, highly searchable and transaction-oriented. Agents can compare products, inspect listings and move toward checkout without needing deep contextual understanding. That makes ecommerce the first place where trust policies, fraud controls and customer experience collide. A site that tolerates agent browsing but cannot distinguish approved from unapproved purchasing behaviour will struggle once agent traffic becomes routine rather than exceptional. Read Zero Trust for AI Agents.
Practical implication: Separate allowed research automation from authorised purchasing workflows in policy and enforcement.
Threat narrative
Attacker objective: Exploit the trust granted to agent sessions to reach accounts, checkout flows or other high-value actions at scale.
- Entry occurs when AI agents are allowed to browse, search and interact with websites at scale using normal web session patterns.
- Credential access becomes relevant when those agents are permitted to authenticate, reuse user sessions or connect to personal and business accounts.
- Escalation follows if the site cannot distinguish benign research automation from actions that carry account or payment authority.
- Impact is measured in increased exposure to fraud, trust misuse and policy drift as agent traffic becomes routine across commerce flows.
Breaches seen in the wild
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
- AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Agent governance is becoming an identity governance problem: once AI agents move from search into account and checkout flows, the control question shifts from detection to authorisation. Organisations need to decide which agent actions are permitted, which are denied, and which require step-up controls or separate identities. The operational implication is that web automation policy and identity policy can no longer be managed as separate disciplines.
Agentic traffic reveals a new trust boundary for consumer systems: the surge in browser-based agent activity shows that approval models built for humans are being stretched across machine-driven sessions. That creates a practical gap between recognising a session and trusting it. The practitioner conclusion is that policy has to follow the action, not just the source IP or browser fingerprint.
Verification trust gap: the key failure mode is not that agents exist, but that organisations cannot yet map agent identity to explicit privileges at the moment of use. When a session can browse, compare and eventually transact without a durable governance model, access reviews become less useful than issuance-time controls. Practitioners should treat this as a boundary-setting problem for every connected agent.
Mass-market agent adoption will test current control assumptions first in ecommerce: commerce is the easiest environment for agents to enter because product discovery is already structured and transaction paths are already automated. That means fraud teams, identity teams and digital commerce owners will feel the pressure before most other functions do. The field should expect agent policy, not agent volume, to become the differentiator.
From our research library:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- Read next: Agentic AI Identity Guide
What this signals
Verification trust gap: the next control frontier is not whether organisations can detect an agent, but whether they can bind that agent to a narrowly scoped entitlement set before it reaches authenticated workflows. The wider the adoption of consumer agents becomes, the more policy has to move from site-level blocking to action-level authorisation.
As agent traffic grows, ecommerce and account-management teams will need to separate permitted browsing from permitted transacting. That shift will force IAM, fraud and digital commerce owners to agree on which sessions are allowed to inherit customer trust and which must be stopped or stepped up before they touch an account.
Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey. That gap suggests policy development is lagging well behind adoption, so programme owners should expect reactive governance to fail first at the account boundary.
For practitioners
- Define explicit agent session permissions Set separate permissions for browsing, account access, checkout and payment actions so each agent session is constrained to the minimum required activity.
- Require step-up control for authenticated agent actions Apply additional verification before any AI agent can connect to a user account, modify stored details or initiate a purchase. Read Zero Trust for AI Agents.
- Instrument agent observability across web routes Log agent identity, route category, destination and action outcome so security and fraud teams can distinguish research traffic from account-bearing sessions.
- Create allowlists for approved agent operators Permit only known agent operators and block newly observed agents until their behaviour, intent and account interaction profile are assessed.
- Separate commerce policy from human browsing policy Treat product discovery, authentication and checkout as distinct policy zones so automation cannot inherit transaction authority by default.
Key takeaways
- Agentic traffic growth is now large enough to expose a control gap between browsing automation and governed access.
- Muse and OpenAI products together account for a large share of observed agent activity, which makes policy decisions urgent rather than hypothetical.
- Practitioners should treat agent sessions as authorised principals only when identity, scope and action boundaries are explicit.
Related NHI Mgmt Group resources: Agentic AI Identity Guide · Zero Trust for AI Agents · Shadow AI and AI Agent Discovery Guide · AI Agent Observability, Audit and Incident Response Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Agent sessions gaining account or checkout authority create identity and privilege abuse risk. |
| ASI09 — Human-Agent Trust Exploitation | Growth in consumer agent traffic depends on users extending trust into account-bearing sessions. | |
| ASI10 — Rogue Agents | Unapproved or newly observed agents need governance before they interact with commerce systems. | |
| Recommendation — Scope each agent to explicit permissions and enforce privilege checks at every action boundary. Block trust inheritance by requiring step-up controls before agents reach sensitive workflows. Allow only approved agents and quarantine unknown operators until their behaviour is verified. | ||
| NIST AI RMF | GOVERN — AI Governance and Accountability | Managing AI agent activity requires clear governance for permitted behaviour and accountability. |
| Recommendation — Define ownership, approval criteria and escalation paths for agent actions across the organisation. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Agent traffic reaching accounts and checkout depends on authorisation controls at the session level. |
| Recommendation — Enforce least privilege for agent sessions and review entitlements before sensitive access is granted. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Agent-enabled account access can progress from initial session use into broader trust expansion. |
| Recommendation — Map agent abuse paths to credential access and lateral movement to prioritise detection coverage. | ||
Key terms
- Agentic Traffic: Traffic generated by software that can act on behalf of a user or process with some degree of independent decision-making. In fraud prevention, it includes both legitimate assistants and malicious automation, so the control question becomes intent and behaviour, not automation alone.
- Agent Session Chain: An agent session chain is a sequence of child sessions derived from a root session, where each hop records lineage back to the original authority. It allows an agent to split a long job into smaller, separately revocable units while keeping identity and scope tied to the same underlying agent instance.
- Delegated Access: Delegated access is permission granted to one identity to act on behalf of another user, service, or system. In NHI environments, this usually appears in OAuth-connected apps and automation tooling. It is powerful, but it must be tightly scoped and reviewed because it can persist long after the original business need ends.
- Session-level authorization: Session-level authorization is the practice of checking what a user or agent can do after a login session begins, not only at sign-in. It evaluates permissions during each request or action, using current context such as role, device, risk, or token scope, to reduce overprivileged access.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity and machine identity security. It gives security and identity practitioners a common framework for governing access, delegation and lifecycle control.
Published by the NHIMG editorial team on November 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org