---
type: "post"
id: "the-latest-in-agent-traffic-meta-muse-starts-45dc4b"
slug: "the-latest-in-agent-traffic-meta-muse-starts-45dc4b"
title: "The Latest in Agent Traffic: Meta Muse Starts Signing Its Traffic and Grok Bot Changes Its Route"
description: "Arkose Labs says Meta Muse began signing some web traffic with Web Bot Auth on November 6, while Grok Bot’s traffic shifted sharply toward Cloudflare IP space."
retrieval_nugget: "Arkose Labs says Meta Muse began signing some web traffic with Web Bot Auth on November 6, while Grok Bot’s traffic shifted sharply toward Cloudflare IP space. For teams deciding how agents may access a site, the observations point to a practical distinction: a verified signature can attest origin, but network location alone can change quickly."
published_at: "2026-11-12"
updated_at: "2026-11-12"
record_date: "2026-11-12"
date_kind: "published_at"
topics: ["agents","agent-identity"]
entities: ["Arkose Labs","Meta","Meta Muse","Web Bot Auth","Grok Bot","Cloudflare"]
related_patterns: ["machine-readers-need-operator-identity"]
novelty_label: "new_fact"
what_changed: null
prior_refs: []
source_url: "https://www.arkoselabs.com/blog/the-latest-in-agent-traffic-muse-signs-grok-reroutes"
source_urls: ["https://www.arkoselabs.com/blog/the-latest-in-agent-traffic-muse-signs-grok-reroutes"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:the-latest-in-agent-traffic-meta-muse-starts-45dc4b"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/the-latest-in-agent-traffic-meta-muse-starts-45dc4b/","markdown":"https://newruntime.com/posts/the-latest-in-agent-traffic-meta-muse-starts-45dc4b.md","json":"https://newruntime.com/posts/the-latest-in-agent-traffic-meta-muse-starts-45dc4b.json"}
markdown_url: "https://newruntime.com/posts/the-latest-in-agent-traffic-meta-muse-starts-45dc4b.md"
---

# The Latest in Agent Traffic: Meta Muse Starts Signing Its Traffic and Grok Bot Changes Its Route

## Retrieval answer

Arkose Labs says Meta Muse began signing some web traffic with Web Bot Auth on November 6, while Grok Bot’s traffic shifted sharply toward Cloudflare IP space. For teams deciding how agents may access a site, the observations point to a practical distinction: a verified signature can attest origin, but network location alone can change quickly.

## Summary
Arkose Labs says Meta Muse began signing some web traffic with Web Bot Auth on November 6, while Grok Bot’s traffic shifted sharply toward Cloudflare IP space. For teams deciding how agents may access a site, the observations point to a practical distinction: a verified signature can attest origin, but network location alone can change quickly.

## What happened
Arkose Labs’ November 9 article reports two changes observed in its Global Consortium, a network of Arkose customer traffic. The first concerns Meta Muse and Web Bot Auth, a standard that lets an agent sign requests so a receiving site can verify who sent them. Arkose says Muse sent its first signed session at about 3:47 a.m. UTC on November 6. Within roughly three hours, about one-third of Muse sessions carried a signature, and the share stayed at about that level through the rest of the 24-hour measurement window.

The rollout was not uniform. Arkose says only some Muse variants signed, with the mix differing by customer: on some sites nearly every Muse session was signed, while on others fewer than 10% were. The company says Muse’s traffic volume did not increase when signing began, so it interprets the change as a change in behavior rather than a rise in traffic. Arkose checked the signatures against Meta’s published keys and says every signature it checked verified. For those sessions, the origin is attested through the signature rather than inferred from a fingerprint or network behavior.

The second change concerns Grok Bot routing. Arkose compared average sessions from November 1–3 with October 24–27 and found the later average was 24% lower. It says the decline began before November 1 and continued without a single-day drop. Elon Musk’s November 1 statement on X that the cost of serving Grok Bot was unsustainably high relative to revenue, and reports of tighter usage limits, are presented as context rather than a complete explanation.

The traffic mix changed more sharply than the overall session count: sessions routed through Cloudflare IP space rose 149%, or about 2.5 times, while sessions through other routes fell 72%. Cloudflare’s share went from 22% to 72%. Arkose says this indicates the agent was still reaching sites, but doing so differently. Its data covers all customers combined in the stated measurement windows; the article does not give raw session counts.

## What the archive adds
New Runtime’s earlier coverage on November 10 said Meta’s Muse Ember had become available in Meta Model API and Muse Code for recurring agent subtasks. [That note](https://newruntime.com/posts/meta-muse-wonder-muse-spark-1-3-and-790011/) concerns a separate product availability event, not traffic authentication. This is a new fact on the broader Muse story: Arkose now reports that some Muse web sessions carry verifiable signatures.

## Trend signal
This supports the idea that machine readers need an operator identity layer: [Machine readers need operator identity](https://newruntime.com/patterns/machine-readers-need-operator-identity/). The distinction Arkose draws between an agent’s signed origin and an origin inferred from fingerprints is directly relevant to governing automated access. Its Grok observation also shows why route or IP-based rules can be brittle, though the article does not establish what controls any particular site currently uses.

## Why now
Arkose dates Muse’s first observed signed session to November 6 and describes the rollout as underway but uneven. The timing makes this an operational transition rather than a settled, universal state: sites may encounter signed and unsigned sessions from Muse at the same time.

## Why it matters
A site that treats every request from a recognized network as trustworthy can lose that signal when an agent changes routes. Conversely, a verified signature can provide stronger evidence about the operator for the traffic that carries it. That does not make every signed request safe or determine what access should be allowed; authorization remains a site policy decision.

The partial Muse rollout argues for handling identity as a graded input. Teams can distinguish a cryptographically verified claim from behavioral classification and choose separate permissions or review paths. That makes policy more legible than collapsing both into a single “known bot” label. Arkose’s figures are a warning against hard-coding access around IP ranges, not proof that signatures alone solve abuse or that every agent will adopt Web Bot Auth.

## Limits and uncertainty
These are Arkose Labs’ measurements from its own customer network, not a census of all websites or all agent traffic. The article does not disclose raw session counts, customer identities, confidence intervals, or how representative the consortium is. It reports that checked Muse signatures verified against Meta’s keys, but does not independently establish what percentage of all Muse requests on the web were signed. The Grok comparison shows a route mix shift in the stated periods; Arkose says the decline began before the usage-limit news, and does not establish a single cause for either the lower average or the routing change.

## Reader takeaway
Treat agent identity and connection route as different signals. A verified signature is stronger evidence of who sent a request than an IP range, but Muse’s rollout is partial, and Arkose’s Grok data shows routes can shift substantially. Build access rules that can distinguish attested origin from inference, and avoid making network location the durable identity boundary.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Agents](https://newruntime.com/topics/agents.md): Explore the agents topic hub.
- topic hub: [Agent Identity](https://newruntime.com/topics/agent-identity.md): Explore the agent-identity topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Sources](https://newruntime.com/sources/): See the original sources this archive cites.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)