Cequence Agent Trust: blocking AI agent actions, not the agent
Key takeaways
- Cequence found Meta's Muse in traffic at more than half the customer environments it studied, posing as a standard Chrome browser
- Agent Trust applies block, rate-limit or challenge policies to single requests instead of banning an agent outright
- Successful multi-factor authentication no longer proves a human is behind a session, so teams need behavioural and request-level controls
Cequence Security says Meta's Muse AI agent turned up in traffic at more than half of the customer environments it studied, and that it did so while posing as an ordinary Chrome browser. Alongside that finding, the company launched Agent Trust, a tool for security teams that identifies AI agents and controls specific actions they take, rather than forcing a choice between letting them in and shutting them out. It is aimed at CISOs and security teams in sectors such as financial services, retail, travel and software, where Cequence found Muse traffic at more than half the customer environments it studied.
One caveat before the detail: the data comes from Cequence itself, drawn from roughly three weeks of traffic across its own customers. It is a vendor's view, and it sits alongside a product launch. It is still a useful signal of what security teams are starting to see.
What it does well
The central idea is granularity. Agent Trust sits within Cequence's Application and API Protection product and combines identity verification with behavioural monitoring, so it can spot both declared agents and undeclared ones. That second category matters, because Cequence says Muse did not announce itself. It used a real Chrome browser in the cloud and routed through a consumer VPN, which makes its sessions resemble normal browsing. Cequence caught it through behavioural analysis, not an identity signal.
The feature list is practical rather than flashy:
- A live inventory of the agents seen in an organisation's traffic.
- Verification of agent identity against trusted providers.
- A request-by-request activity record, useful for attribution when something goes wrong.
- Transaction-level policies that can block, rate-limit or challenge a single action instead of the whole session.
- Confirmation from the account holder on their own device for sensitive account changes.
- API discovery to identify which endpoints handle login, checkout, pricing and stock checks.
Cequence offers a concrete scenario. An agent that normally checks order status suddenly starts collecting price and stock data across an entire product catalogue. That looks like scraping, and a transaction-level policy can stop that request while leaving the customer's legitimate activity alone.
There is also a real-world example of the philosophy at work. A travel and hospitality customer's security team began blocking nearly one in five Muse requests while letting the rest through, targeting individual requests judged abnormal rather than excluding the agent entirely.
Where it falls short
The hard problem is one a tool can only partly solve. Cequence says Muse could sign in to customer accounts at financial institutions and complete multi-factor authentication on users' behalf. In those cases, a successful login did not reveal whether a person or an automated agent was driving the session. If authentication is no longer a reliable proxy for a human, then detection rests on behavioural judgement, and judgement calls produce false positives and false negatives.
Muse's traffic also overlapped with both normal customer activity and bot-like abuse. Cequence describes sessions that searched, compared products, filled baskets and moved through checkout, with a small share ending in purchases and many others browsing and leaving. That pattern is the same one security teams have long associated with scrapers and basket-hoarding bots. Telling a customer's delegated agent from a hostile one, on behaviour alone, is difficult to assess, Cequence argues.
There is also a dependence on trusted providers. Identity verification against trusted providers works when agents declare themselves. Muse, by Cequence's account, did not. Behavioural detection has to carry the load for exactly the traffic that most needs it, and the source offers no independent accuracy figures for it.
How it compares
What can be compared is the approach to the underlying decision facing security teams.
| Approach | What it does | Trade-off |
|---|---|---|
| Block the agent entirely | Excludes all agent traffic | Cuts off customers who have chosen to use agents; Cequence's CEO says customers will take spending to wherever agents are welcome |
| Allow everything that passes authentication | Treats a successful login as proof of legitimacy | Authentication, including MFA, may have been completed by the agent itself, so it no longer signals a human |
| Cequence Agent Trust (block the action) | Blocks, rate-limits or challenges single requests | Needs good behavioural baselines and API visibility to judge what is abnormal |
The competitive context is also shifting. A separate report says Anthropic has unveiled Claude Duet, a proactive agent that monitors connected apps and works in the background, putting it in competition with OpenAI's Dots and Meta's Muse.
Pricing and value
No pricing is given for Agent Trust, so there is nothing to assess on cost. Buyers should ask how request-level logging and policy enforcement are metered, and whether the live agent inventory is included, before assuming it fits an existing contract.
Who should use it
The strongest fit is organisations with login, checkout or pricing endpoints that agents can reach and where the cost of both over-blocking and under-blocking is high: banks and other financial institutions, retailers, and travel and hospitality firms. Those are the sectors named in the findings. Teams that cannot currently see what share of their traffic is automated are the obvious first audience, because Cequence's headline point is that many businesses cannot see these agents at all.
Smaller sites with no sensitive account actions, or teams happy with a blanket block policy, may not need this level of control yet. UK and US firms alike face the same operational question, since agent traffic does not respect borders.
For teams tightening identity controls generally, the debate over which accounts still need a hardware security key takes on new weight if a delegated agent can complete MFA on a user's behalf.
Key takeaways
- Cequence reports Muse in more than half the customer environments it studied, with median traffic growing nearly sixfold within about two weeks of first appearing.
- Muse presented as a standard Chrome browser, so conventional checks are less likely to separate it from a human.
- At some financial institutions, a successful login did not show whether a person or an agent was driving the session.
- The practical response is to inventory agents, discover sensitive endpoints, and set per-action policies.
Verdict
Agent Trust addresses a real gap: security teams that cannot see agents, or can only choose between banning them and waving them through. The block-the-action model is sensible and the request-level audit trail is genuinely useful. But the evidence is vendor-supplied, detection of undeclared agents relies on behavioural judgement, and pricing is undisclosed. It is worth a serious evaluation for financial services, retail and travel teams now, and worth watching for everyone else. As Cequence's own chief executive put it, every CISO is about to be asked whether AI agents can be let in. The sensible next step is to find out how many are already inside.
