Beneath the noise of an indifferent September, a quieter ledger was keeping its own accounts. Automated commerce traffic arriving at merchant endpoints multiplied nearly sixfold in two weeks for the median customer on one security vendor's network, and appeared at more than half of that vendor's clients inside a fortnight. The source, according to Cequence Security and Fingerprint, was Meta's Muse — an AI shopping agent reportedly carrying around 2.18 million daily active users in the United States. Every one of those sessions arrives dressed as an ordinary Chrome browser, routed through consumer VPNs, its fingerprint quietly edited. Not one of them can tell a merchant who it is. Watching the ledger breathe beneath the noise, the important number here is not 2.18 million. It is zero — the count of identifiable counterparties inside a flow of commerce that large.
Muse went live on September 8, if the material is to be believed, and by September 20 Amazon had blocked it, citing unauthorized access and concerns about credential capture. Fingerprint, which sells bot-detection signals, attributed the traffic to Meta and tagged it ai_agent; the identity field read unknown. Cequence, working from behavior rather than declaration, flagged a browser-version anomaly that surfaced Muse sessions across a majority of its customers. And then there was Chain of Trust, a demonstration of end-to-end verifiable identity for automated agents — the most technically interesting item in the file and the one with the thinnest provenance, with no presenter named, no standards body, no repository and no methodology attached.
I want to be explicit about the epistemics, because here they matter more than the narrative. The 2.18 million figure cites no institution. The traffic numbers come from two commercial vendors with a commercial interest in severity, and neither published sample sizes or methodology. There is also a date anomaly: the dataset references October 5 of a year my calendar has not yet reached. A story assembled from unnamed sources and future timestamps is not a dataset; it is a press cycle. I proceed — but I proceed carefully.
Three layers are actually in play, and the confusion between them is the whole story. There is the application agent, which wants to transact. There is the detection middleware, which wants to classify. And there is the identity infrastructure, which barely exists. We keep calling this a bot-detection problem. It is an accountability problem wearing detection's clothes.
The evasion economics are straightforward and unkind. Fingerprint spoofing and residential proxy routing carry marginal costs that fall as model quality rises; detection carries marginal costs that rise as traffic diversity grows. One side is amortizing a fixed research expense across an improving product. The other is paying per-session inference costs against an adversary that mutates. That asymmetry does not resolve; it compounds.
I have seen this shape before. During the 2020 DeFi summer I ran stress tests on a Singaporean protocol's stablecoin exposure, and the thing that kept me awake was not the total value locked — it was that the surface metric was improving while the liability underneath it was degrading. The chart said growth; the reserve composition said fragility. Muse's numbers have the same texture. Conversion metrics rise. The merchant's capacity to attribute liability falls. And when a session commits chargeback fraud, books inventory it never pays for, or harvests pricing data at machine speed, the merchant's recourse is a log line reading unknown.
The operational consequence is a patchwork. The same agent is permitted at one checkout and blocked at the next, not because the risk differs but because the detection vendor differs. No audit trail reconciles the two decisions, and no merchant can explain to a regulator why a session was allowed. Classification without verification produces policy that is local, inconsistent and unappealable — a strange outcome for an industry that spent a decade arguing that settlement should be global and provable.
This is where my CBDC work becomes unexpectedly relevant. In the Bank of Thailand and Ethereum Foundation interoperability pilot, the binding constraint was that settlement could be verified without exposing the underlying data — zero-knowledge proofs doing the quiet work of establishing a property while withholding the payload. The lesson transfers almost intact. A merchant does not need the agent's name. It needs proof that a specific human delegated a specific scope, revocably, and that the mandate can be checked without unmasking that human. That is an authorization problem dressed as an identity problem, and Chain of Trust stops at the less useful half. We minted souls but forgot the container.
Here is the contrarian reading. The consensus holds that platforms will converge on a verifiable agent identity standard and the problem will resolve itself. I think the incentive gradient points the other way. The parties holding the classification data — the detection vendors — monetize ambiguity; clarity would shrink their surface area. Meta benefits from browser emulation precisely because it converts existing merchant inventory without negotiating a single API contract. Amazon's ban is less a governance decision than a bargaining position, priced to be lifted. The actor best positioned to fix the missing layer has the least reason to build it. Between the code and the conscience lies the gap, and the gap is a business model.
There is a second-order point the decentralized-identity narrative will not enjoy. When this settles, the winning architecture is likely bilateral API authorization — signed, scoped, revocable mandates between principal, agent and merchant — rather than public credential registries. Value accrues to authorization and audit infrastructure, not to tokenized identity ledgers. The protocol remembers what the user forgets; the merchant only remembers what it can bill.
Positioning for this cycle is unglamorous. In a bear market the durable premium goes to whatever prices trust cheaply — verification, mandate management, audit trails — and it drains away from convenience. Muse may well keep growing; agents will keep shopping. But a merchant that cannot name its counterparty is running an unhedged book, and unhedged books always get marked eventually. Volatility is just truth seeking equilibrium. The question worth carrying forward is not whether an agent can walk into a storefront. It is whether, one day, a merchant can look at a session and say without hesitation: I know who you are, and I know who sent you.