Fingerprint Expands Bot Detection to Uncover Hidden Muse, Instinct and Grok Bot Traffic as AI Agents Increasingly Conceal Their Identities
CHICAGO--( BUSINESS WIRE)-- Fingerprint, the industry leader in device intelligence, today announced expanded bot detection capabilities that identify traffic inferred to be undeclared AI agents, including Meta's Muse, Spear Street's Instinct and xAI's Grok Bot. As more AI agents operate without identifying themselves, Fingerprint provides browser-level visibility to recognize previously unidentified automated traffic, distinguish it from legitimate human activity and enable businesses to determine which interactions to allow, limit or block.
The AI Agents Operating Without Declaring Their Identity
More than half of all web traffic in 2026 is no longer human, which is largely due to AI agents acting on behalf of consumers or enterprises. While industry standards such as Web Bot Auth were designed to let AI agents cryptographically prove their identity, a growing wave of prominent agents are choosing to operate undeclared or are actively shifting away from signed traffic:
“More AI agents are visiting websites without disclosing their identity, and some that used to, like Grok Bot, have stopped,” said Dan Pinto, CEO and Co-founder of Fingerprint. “That lack of transparency is already a widespread issue: Fingerprint’s recent report found that 79% of financial institutions have caught a malicious bot or scraper posing as an AI assistant. Fingerprint can identify traffic inferred to be Muse, Instinct and Grok Bot without any assistance from their developers, giving enterprises the ability to uncover previously undetected AI agent activity and make informed decisions about which traffic to allow, limit or block.”
How Fingerprint’s Bot Detection Smart Signal Identifies Humans, AI Agents and Bots
Legacy bot management tools force businesses into either blocking all automated traffic, which risks turning away paying customers’ AI assistants, or allowing unrecognized automation, which exposes login flows and payment methods to abuse. Fingerprint checks the network edge and/or the browser to reveal what is behind every visit: a human user, a known automated bot, an AI agent that cryptographically proves who it is, an undeclared AI agent that hides its identity or a spoofed bot masking its identity.
With Fingerprint’s Bot Detection Smart Signal, security and fraud teams can:
Availability and Resources
Detection for Muse, Instinct and Grok Bot is available today through Fingerprint Bot Detection via the Fingerprint JS Agent, Server API, Rules Engine and the Fingerprint MCP Server.
For more information, read the technical deep dives on detecting Muse, Instinct and Grok Bot. To learn more about how Fingerprint’s tech works, explore tracked bots and AI agents in the Fingerprint Bot Directory and test live detection in the Fingerprint Playground.
About Fingerprint
Fingerprint detects the intent of human and agentic visitors. Our device intelligence platform identifies over 1 billion unique devices every month and processes hundreds of signals to help fraud teams distinguish trusted visitors from bad actors at speed and scale. Over 6,000 companies, including innovators like Plaid, Booking.com, Dropbox, Trustpilot and Checkout.com, use Fingerprint every day to recognize high-risk activity in real time, prevent fraud attacks and deliver frictionless user experiences. Learn more at fingerprint.com.
Frequently Asked Questions (FAQ)
Why are AI agents hiding their identities instead of using Web Bot Auth?
Many websites rely on legacy security rules that automatically block any non-human traffic. To avoid being blocked while executing tasks for their users, the companies behind agents like Muse and Instinct design them to mimic human browsers, suppress standard automation flags and omit cryptographic signatures. Additionally, some agents that previously signed their requests, such as Grok Bot, stopped.
How does Fingerprint distinguish between "signed" or "verified" AI agents and "inferred" AI agents?
Fingerprint maintains a strict technical distinction based on cryptographic proof. Signed and verified AI agents cryptographically sign their outgoing HTTP requests, providing tamper-proof confirmation of their provider’s identity, while inferred AI agents do not present a cryptographic signature. Fingerprint identifies traffic inferred to be a specific agent by analyzing browser, device, network and behavioral signals, and classifies each determination with a high, medium or low confidence score.
How should fraud and security teams handle an undeclared AI agent?
Instead of blocking or allowing all agents, teams can use Fingerprint to match their policy to the sensitivity of the action. For example, they can rate-limit undeclared agent sessions so an automated assistant cannot refresh or transact faster than a human user. They can also trigger step-up authentication or explicit user verification when an undeclared agent attempts to access sensitive account settings or authentication flows. Conversely, they can allow low-risk browsing or standard purchases to proceed while inspecting Smart Signals to block coordinated abuse.