Meta’s Muse is the first of its kind—a personalized AI agent that lives on users’ devices, handling tasks like sending email, ordering groceries, and negotiating lower bill payments. In fact, it’s so good at acting on humans’ behalf that it’s quite difficult for websites to identify it as a bot, rather than a human user.
Meta says that Muse navigates browsers just like human users, meaning it doesn’t look like an artificial intelligence agent, and there’s currently no regulation requiring AI assistants to identify themselves when they visit public sites. But Muse is at the top of a slippery slope—one that leads to questions of legal liability, traceability, and brand trust erosion.
The internet is used to bots. Muse is a whole new animal
Bots and traditional search engines like Google retrieve users’ requested information via processes known as crawling and scraping. They look for results that align with the user’s query, produce a list ranked by relevance, and end the session there.
AI assistants like ChatGPT and Claude enter the game by visiting websites to find the information. They use unique identifiers in their user agent strings so webmasters can determine who, or what, is visiting and control access via a robots.txt file.
But Muse is different. It browses like a human, navigating pages, scrolling, moving the cursor, and clicking buttons. But unlike ChatGPT, it doesn’t declare itself as an AI agent through the user agent strings. With the right tech tools, brands can pick up some discernible behavioral signs to help detect Muse with some probability.
First, Muse’s cursor doesn’t move in natural curves. This is a decidedly nonhuman behavior. Then there are the pauses. Both Muse and humans pause while they browse, but Muse takes an “all or nothing” approach. It either doesn’t pause at all or pauses for several minutes at a time. Humans pause just long enough to read and process information, usually just a few seconds.
These signals—the cursor curvature and the pausing pattern—certainly aren’t foolproof giveaways. And, critically, not all brands get so granular when they monitor user behavior. Only those using fairly advanced behavioral data analysis stand a chance at being able to identify Muse and other agents for what they are.
That puts them at risk.
The problem with truly agentic browsing
There are several reasons why incognito agent browsing could spell trouble for brands.
First, we know that agents don’t always get it right. They don’t always execute users’ instructions perfectly, and sometimes they’re way off base. In one case that’s since gone viral, Muse shared its user’s home address with ostensible strangers on Facebook Marketplace even after the user had explicitly forbidden it from doing so.
Imagine what kind of havoc agents could wreak when attempting to manage bank accounts, book travel, and shop within a defined budget. If the agents don’t look like agents on the back end, how is a brand to know when these mistakes happen? Who will be liable if agents do the wrong thing?
And what if agents are specifically instructed to do the wrong thing? Bad actors could use agents at scale to, for instance, scalp tickets and wipe out a limited drop for a popular artist’s concert, forcing prices sky-high. Or they could clear out entire retail catalogs in a matter of minutes. These platforms likely have protections in place against bot activity, but not activity that’s seemingly human. If the agents don’t look like agents, brands might not know something is wrong until it’s too late.
Soon Muse won’t be the only agent flying under the radar. All the major generative AI players are developing their own versions of personal agentic assistants. Brands and agentic providers need to find a safe path forward—one that protects brands, welcomes agents, and lets users delegate their tasks as desired.
The future we should aim for
Of course, some might say that we already have the solution to this problem. Brands simply need to implement advanced behavioral data analysis tools so they can identify agentic browsing with a high degree of confidence.
I’m all for these tools, whose benefits extend far beyond agent identification. But the tools aren’t perfect. More importantly, such a solution puts the onus on brands, when really it should be on agent providers and the regulators who purport to keep the internet safe.
Agentic assistants need ID tags, plain and simple. We need to know when an agent is acting on a human’s behalf. We need clear-as-day traceability so we can determine accountability if things go wrong. These tags will in no way interfere with the agent’s ability to get things done, or the speed at which it performs. More clarity is better for everyone.
But also, knowing when the user is an agent will allow brands to deliver better experiences for them. We all know that brands customize their web pages and apps based on the individual user. Whether it’s the language used, the ads displayed, or the products recommended, brands try to cultivate bespoke experiences to make each user feel valued and at home.
Why wouldn’t we want the same for agents? We, human users, presumably want agents to succeed in their quests. Wouldn’t they have a better chance at doing so if they were browsing a site or an app that was specifically designed with their strengths and limitations in mind? Wouldn’t there be less chance of error?
Imagine hosting a dinner party but not having any idea about who’s attending. You’d wouldn’t know what to make, or whether there were any allergies or dietary restrictions to accommodate. You wouldn’t know who to cook for.
It’s the same with brands creating digital experiences. They need to know who they’re hosting so they can make the appropriate accommodations. Everyone is welcome and everyone introduces themselves at the door. There’s no downside.
