Fingerprint Detects Hidden AI Agent Bots With New Tools

Fingerprint, the industry leader in device intelligence, announced expanded bot detection capabilities that identify traffic inferred to be undeclared AI agents, including Meta’s Muse, Spear Street’s Instinct and xAI’s Grok Bot. As more AI agents operate without identifying themselves, Fingerprint provides browser-level visibility to recognize previously unidentified automated traffic, distinguish it from legitimate human activity and enable businesses to determine which interactions to allow, limit or block.

Read more – BlueFlag Security Expands Agentic AI Governance Across SDLC

The AI Agents Operating Without Declaring Their Identity

More than half of all web traffic in 2026 is no longer human, which is largely due to AI agents acting on behalf of consumers or enterprises. While industry standards such as Web Bot Auth were designed to let AI agents cryptographically prove their identity, a growing wave of prominent agents are choosing to operate undeclared or are actively shifting away from signed traffic:

• Muse provides no verifiable identity, alters its browser fingerprint and suppresses the standard automation flags that traditional bot detection tools rely on. Fingerprint’s research team shipped detection for traffic inferred to be Muse roughly two weeks after the agent was announced, and subsequently identified Muse activity on a major bank’s login flows that the bank’s other security vendors failed to flag.
• Instinct logs into websites using human credentials, including by requesting multi-factor authentication (MFA) codes from the user via SMS, without signing its traffic via Web Bot Auth. In one high-profile case reported by CNN, Instinct pinged restaurant reservation platform Resy hundreds of times every hour on behalf of a user, resulting in account deactivation.
• Grok Bot can sign in to websites, work through inboxes, and finish multistep tasks for real users. It used to announce itself on arrival by signing its requests with Web Bot Auth, but around October 9, 2026, it stopped.

Read more – Citrix Advances Secure AI Adoption With New Governance Tools

“More AI agents are visiting websites without disclosing their identity, and some that used to, like Grok Bot, have stopped,” said Dan Pinto, CEO and Co-founder of Fingerprint. “That lack of transparency is already a widespread issue: Fingerprint’s recent report found that 79% of financial institutions have caught a malicious bot or scraper posing as an AI assistant. Fingerprint can identify traffic inferred to be Muse, Instinct and Grok Bot without any assistance from their developers, giving enterprises the ability to uncover previously undetected AI agent activity and make informed decisions about which traffic to allow, limit or block.”

Read more – Abnormal AI Names Don Jeter CMO to Drive AI Security Growth

How Fingerprint’s Bot Detection Smart Signal Identifies Humans, AI Agents and Bots

Legacy bot management tools force businesses into either blocking all automated traffic, which risks turning away paying customers’ AI assistants, or allowing unrecognized automation, which exposes login flows and payment methods to abuse. Fingerprint checks the network edge and/or the browser to reveal what is behind every visit: a human user, a known automated bot, an AI agent that cryptographically proves who it is, an undeclared AI agent that hides its identity or a spoofed bot masking its identity.

With Fingerprint’s Bot Detection Smart Signal, security and fraud teams can:

• Read changing signals: Identify visitors and surface intent cues even as device and browser signals evolve. Fingerprint’s dedicated global research team continuously analyzes emerging agentic frameworks to ship new detections within days as browsers and AI agents change their behavior.
• Move beyond “bot or not”: Distinguish malicious automation and human fraud from trusted returning visitors, verified AI agents and undeclared AI agents. Fingerprint labels traffic inferred to be specific agents such as Muse, Instinct and Grok Bot along with high, medium or low confidence tiers.
• Reveal full network and device context: Combine agent inference with granular telemetry, including IP address, Autonomous System Number (ASN), ASN type and whether a request came from a data center and which one. This context helps companies evaluate the true risk of every session.