HUMAN Security Data Shows Meta and OpenAI Agents Generate 90% of Measured Agentic Traffic

Security vendor HUMAN Security reported that AI agents from Meta and OpenAI accounted for nearly 90% of agent requests reaching sites and apps under its protection in October 2026, providing a rare concrete metric on actual agentic AI deployment in production.

According to HUMAN’s monthly State of Agentic Traffic report, Meta’s Muse agent alone generated 59% of all agent requests in October, up 19 percentage points from September. Its request volume nearly quadrupled month over month. OpenAI’s three agents — ChatGPT Agent, Codex Browser, and Codex Chrome extension — together accounted for about 30%. ChatGPT Agent’s share fell from 28.5% to 15.9% even as its request volume grew 44%, because Muse grew faster [3].

Total agent requests on HUMAN-protected properties were approximately eight times higher than in August and 2.6 times higher than in September. The surge coincides with Muse’s launch on September 8 and continued growth through October [1].

What the data covers — and what it doesn’t

HUMAN’s measurements reflect agentic traffic detected by its Sightline Cyberfraud Defense across applications protected by the Human Defense Platform. The company identifies agents through a combination of behavioral signal analysis, user-agent attribution, publisher-level integration, and its AgenticTrust system, which uses proprietary research and digital signature validation [3]. Crawler traffic is excluded.

Each request represents one action an agent takes — a page load or a search — not a user or a session. The data covers only sites and apps using HUMAN’s protection, not the entire internet. HUMAN acknowledges that on most sites, analytics tools cannot distinguish AI agents from human visitors, let alone identify specific agents or classify their intent [3].

Standalone agent browsers are losing share

Perplexity’s Comet browser, which led with 41% of agent requests in August, fell to 3.6% in October. It was the only top-10 agent whose request volume declined, dropping about 30% since August while total agentic traffic grew roughly eightfold. Genspark’s agentic browser fell out of the top 10 entirely. OpenAI discontinued its standalone ChatGPT Atlas browser in August [1][3].

HUMAN attributes the decline to users choosing agents built into platforms they already use, from companies that already reach them at scale. Developer-focused agentic browsers are a different story: OpenAI’s Codex Browser nearly tripled its traffic in October [3].

New entrants, unsigned requests

Google’s Gemini agent, launched October 8, entered at eighth place with 0.8%. xAI’s Grok Agent, launched August 11, debuted at ninth with 0.7% [3].

Muse transferred its Web Bot Auth signatures from Meta’s key directory (meta.com) to its own (muse.ai) between November 7 and 9. As of November 10, about half of Muse’s requests on DataDome’s network were being made without signatures, meaning sites that verify signatures against meta.com would now see Muse’s requests as unverified [1]. Both DataDome and HUMAN sell bot and agent identification services.

Agents still browse far more than they buy

In October, 85% of agent requests went to product and search pages, up from 81% in September. Requests reaching checkout and payment pages fell to 1.9% of total agent traffic from 2.4%, though absolute checkout volume grew 117% month over month. HUMAN notes that a request arriving on a checkout page does not signify an order was placed [1][3].

Ecommerce sites generated a stable 60% share of agent requests. Travel took second place for the first time at 19.3% (up from 17.1%), narrowly edging out media at 19.1%. SaaS, while only 1.2% of traffic, grew fastest — nearly quadrupling in one month and running about 15 times its August level [3].

Enterprise adoption surveys show a different picture

A separate Zapier survey of 513 U.S. enterprise leaders at organizations with 1,000+ employees, fielded September 16–21, found 88% say their organizations are using or testing AI agents, up from 72% in 2025. Production use jumped from 40% to 71%. However, only 30% of leaders at organizations using agents say the technology handles a majority of tasks without human intervention. Ninety percent report at least one positive outcome, and 46% say their most mature agent has paid for itself or is expected to within 12 months [2].

The survey measures self-reported adoption and expectations; HUMAN’s data measures observed traffic on protected properties. The two sources capture different things: one reflects enterprise intentions and internal workflows, the other reflects external-facing agent activity on the open web.

What site operators can do

HUMAN’s report narrows the list of agents sending the vast majority of requests to two companies. For ecommerce and travel teams preparing for Black Friday, the company suggests raising Muse and OpenAI’s three agents with whoever runs bot protection. Analytics tools on most sites cannot tell AI agents from human visitors, and a bot rule that verifies signatures now needs Muse’s muse.ai directory — though about half of Muse’s requests currently carry no signature to check [1].

Next month’s report will show how agents behaved over Black Friday and Cyber Monday.