Topic starter
06/11/2026 6:55 pm
TL;DR: Agentic traffic tripled in September, according to HUMAN’s benchmark of AI agents across the web, with Muse and OpenAI products driving most of the increase. Practitioners should treat agent governance as an access problem first, because volume growth raises the cost of weak policy and poor visibility.
Editorial analysis by NHI Mgmt Group, based on content published by HUMAN: “State of Agentic Traffic: Agentic Traffic Tripled in September as Meta’s Muse debuts at No. 1”.
By the numbers:
- Meta’s Muse debuted as the No. 1 agent by observed traffic share, capturing 40.34% of total agentic traffic in September.
- OpenAI products represented 39.7% of total agentic traffic.
- Ecommerce sites accounted for 60.3% of agentic traffic in September.
Key questions
Q: Why do browser agents create fraud risk in ecommerce?
A: Browser agents can mimic a real shopper, automate account creation, scrape prices, test stolen cards, and complete checkout or payment flows at machine speed.
Q: How should security teams detect shadow AI inside approved applications?
A: Start by looking for AI capability inside software people already use, such as copilots, embedded assistants, and model-backed workflow features.
Q: How do AI agents get authorised to use web accounts?
A: AI agents should be authorised through explicit delegation boundaries, scoped permissions and revocation paths that define exactly what they may do in a session.
Practitioner guidance
- Define explicit agent session permissions Set separate permissions for browsing, account access, checkout and payment actions so each agent session is constrained to the minimum required activity.
- Require step-up control for authenticated agent actions Apply additional verification before any AI agent can connect to a user account, modify stored details or initiate a purchase.
- Instrument agent observability across web routes Log agent identity, route category, destination and action outcome so security and fraud teams can distinguish research traffic from account-bearing sessions.
Bottom line: Agentic traffic growth is now large enough to expose a control gap between browsing automation and governed access.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:56 pm
Agent governance is becoming an identity governance problem: once AI agents move from search into account and checkout flows, the control question shifts from detection to authorisation. Organisations need to decide which agent actions are permitted, which are denied, and which require step-up controls or separate identities. The operational implication is that web automation policy and identity policy can no longer be managed as separate disciplines.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should security teams detect shadow AI inside approved applications?
A: Start by looking for AI capability inside software people already use, such as copilots, embedded assistants, and model-backed workflow features. Then combine SaaS telemetry, browser signals, identity context, and data movement logs so you can tell who used the capability, what data moved, and whether the behaviour was authorised.
👉 Read our full editorial: Agentic traffic surge shifts control to trust and identity governance