Anonymous AI shopping agents are a gift to fraudsters

Imagine a store where nearly every customer walks in wearing a mask, and the security guard is told to figure out who is a shopper and who is a thief by watching how they walk. That is roughly where agentic commerce stands today, and the numbers should make anyone selling online a little uneasy.

On October 20, 2026, Arkose Labs published its Q3 2026 State of Agentic AI Trust Report. As PPC Land reports, only 2.3% of the agent sessions the company classified as legitimate presented a verified Web Bot Auth signature. The other 97.7% gave no verified disclosure. Agents reached login, registration and checkout flows at 65.2% of Arkose's customers.

One caveat up front: Arkose sells the tools that fix this problem, the data is its own, and it publishes percentages without raw counts. Treat the figures as a direction signal, not a census. The direction, though, is hard to argue with.

The honest agents are the exception, not the rule

The most telling detail is who does sign. According to the report, ChatGPT agent signed 78.4% of its sessions and was the only agent that did so at scale. Even so, the network-wide rate stayed at 2.3%. One well-behaved product can't move the needle when the rest of the market stays silent.

And the silent ones aren't obscure. Arkose's own pages describe Meta's Muse as appearing on networks as a Chrome browser, and say agents like it have no signature and no special user agent. By Arkose's account, Muse sessions grew 35x in the four weeks after Meta shipped it free to US consumers on September 8. Nobody integrated anything. The agent simply used the login form that was already there.

We think that's the crux. The industry spent years imagining agents politely using APIs with clean guardrails. What arrived instead are agents that drive the ordinary web, acting for real people, with no reason to announce themselves. Voluntary disclosure assumed a cooperative market, and the market didn't cooperate.

Intent-scoring is a patch, not a foundation

Arkose's answer is to classify by behavior, device and intent, not by identity. It's a sensible pitch, and for now it's probably necessary. Its lead researcher Mitchell Davies puts it well: every agent shows some automation, so the real question is what the agent came to do.

But look at what that means in practice. Defenders must reverse-engineer each agent from mouse-movement traces and network fingerprints, and agents change builds without warning. Arkose itself notes that in the first half of October Muse moved toward residential networks and Grok Bot stopped signing its requests. That is an arms race, and arms races favor whoever can afford to iterate. Fraudsters can.

Worse, the cost of getting it wrong is lopsided and invisible. Block a legitimate agent and, as Arkose puts it, the sale never shows up as a loss because the session just ends. Wave everything through and you've handed over a blank check. Small retailers, without a fraud team, will most likely default to one extreme or the other.

There's also a quiet incentive problem. If undisclosed agents slip past defenses more easily than signed ones, disclosure becomes a handicap for honest vendors. That's backwards.

Make disclosure the price of admission

The plumbing exists. Web Bot Auth lets an agent cryptographically sign its requests, and, according to ecommerceparadise's summary, Cloudflare proposed it in May 2025 and the IETF draft is still an Internet-Draft with no RFC number. It's unfinished, and unfinished standards are a poor excuse for waiting, but they are probably a real reason adoption is thin.

Our view: the identity layer should work like a license plate. Anyone can drive, but the car has to be identifiable. That means three things.

• Major agent vendors should sign by default, and say so publicly when they don't.
• Merchants and payment networks should give signed agents a faster lane, so honesty pays.
• Regulators and card networks should consider pushing toward mandatory disclosure for agents that move money, since voluntary schemes look stalled.

Signing isn't a cure-all. Arkose's own page warns that an agent can present a valid signature and still attempt something you never allowed, so identity must be paired with authorization and intent checks. A verified bot is accountable, though, and that's the point: someone can be held responsible when it goes wrong.

The verdict: if you run an online store or a bank flow, don't wait for a standard to be finished. Find out which agents already hit your checkout, set policy by flow rather than a blanket block, and demand signatures from vendors. Anonymous agents transacting at scale are not a technical curiosity. Unless disclosure becomes the norm, they're an open invitation.