Meta launched Muse about a month ago. Within days, the questions started pouring in, from customers and from companies we'd never spoken to.
One customer told us they'd blocked it at their CDN. It worked, and then it didn't.
I get it. Muse doesn't introduce itself. I get it. Muse mostly doesn't introduce itself. Meta has started signing a small share of its traffic with Web Bot Auth, but most of it still arrives unsigned, and there's no published IP range. When one of our engineers tried it from his iPhone, the traffic that reached the site came from a Linux machine in a cloud data center, wearing the same Chrome user agent as everyone else.
It's built to look like an ordinary visitor. So is most of the automation we've been catching for the last ten years. We've never used CAPTCHAs, so we've always had to tell from the browser itself, whatever it claims to be. We found what gives Muse away, and it’s in the Verified Bots and AI Agent directory for every customer.
Across our network, agent traffic is up 1320% on last year, and Muse is a big reason why.
So much has already been written about what Muse is and how to spot it. I want to talk about what matters once you can.
Muse isn't the user
Every Muse session runs on a copy of the same Meta-hosted cloud computer with a browser. As far as any device signal is concerned, millions of different people are one machine.
And they aren't just browsing.
Muse doesn't want anything, except insights from every user session. The person using it does. Most of those people are your customers. Some of them are holding someone else's password.
Allow or block is the wrong question
The industry has settled on a standard answer for agents. Keep a list, verify what you can, then flip a switch.
That's necessary, but it doesn't get you very far. Block Muse and you turn away customers who chose to shop that way. Allow it and you've let in everyone who uses it, including the people you've spent years keeping out. And the moment an agent is allowed in, it becomes the thing attackers dress up as.
Scoring the agent doesn't fix this. A reputation shared by millions of people tells you very little about any one of them. Guessing each visit’s intent gets closer, but Muse has no intent of its own. The person behind it does.
Earlier this year we wrote that identity without authorization is just better labeling. Muse takes that a step further. Even the agent's identity isn't the one that matters most.
Where trust actually lives
Muse acts for a real person, usually inside their own account. That account already has a history - where it logs in from, what it buys, what it's connected to. That's a record, not a guess.
So that's where we make the call. Kasada recognizes Muse and scores the account behind it on the same request, then passes that score to your application. You can step up authentication, hold the order or stop the takeover. A stolen password looks different from its owner, even when both arrive through the same agent.
You still set the rules for the agent itself. One customer lets ChatGPT find and show its content but won't let it submit an application on someone's behalf. We set Muse to no access by default because most customers who asked wanted it that way while they worked it out but you can change it whenever you're ready.
If you're deciding what to do about Muse
Start by finding out how much agent traffic you have and where it goes.
Then decide by endpoint, not just by agent. Search and product pages are one conversation. Login, signup and payment are a different one.
Assume anything you allow will be impersonated. A user agent string is a suggestion, not an identity.
Don't count on challenges. An agent might solve your CAPTCHA, fail it, or do it partially and give it back to the real user halfway through checkout.
And connect agent traffic to account risk. Verify the agent, then verify the person behind it. The agent tells you how someone got there. The account tells you who they are.
Meta will keep changing how Muse looks, and more agents will choose not to identify themselves. We'll keep finding them.
Common questions about Muse
Does Meta Muse identify itself? Mostly no. Meta has started signing a small share of Muse requests with Web Bot Auth, but most traffic is still unsigned. It doesn't publish IP ranges and sends a standard Chrome user agent, so you still have to recognize it with alternate approaches.
Can you block Muse? Yes, if you can recognize it. Blocking by IP or user agent won't hold for long. Kasada customers can block it, allow it, or limit it to certain endpoints.
Should you block Muse? Not everywhere. Keep it away from login, signup and payment until you understand how your customers use it, then open things up where it makes sense.
Can attackers pretend to be Muse? Yes. Anything you allow becomes worth impersonating. Kasada separates real Muse traffic from imitations.
Does Kasada use CAPTCHAs? No. We detect automation from signals inside the browser, so real people and the agents you allow never have to solve a puzzle.
