Reported Platform & EcosystemAccess ControlsStandards & Protocols DataDome Blog ·

Meta Muse Agentic Browser Operates Without Declared User-Agent or Dedicated IP Ranges

Open source ↗

Summary

Technical analysis from DataDome reveals that Meta’s new consumer agent, Muse, does not identify itself via a distinct User-Agent header, custom request headers, or documented IP ranges. Muse sessions run inside sandboxed ‘Sentinel VM’ environments presenting as standard desktop Chrome on Linux and egressing through generic Cloudflare or Fastly address space without cryptographic signatures. DataDome added client-side environmental fingerprinting detection for Muse to its Agentic Trust dashboard to help merchants categorize or control this traffic.

Insight

Unlike traditional search crawlers and AI scrapers that declare bot identities and maintain published IP allowlists, emerging consumer agentic browsers blend into ordinary desktop traffic, forcing site operators to rely on client-side browser fingerprinting and behavioral intent analysis rather than declarative protocol-level controls.

Implication

Merchants and anti-bot systems face heightened challenges distinguishing authorized consumer proxy sessions from malicious automated scrapers, scalpers, and impersonation attacks that mimic sandboxed agent environments.

Why it matters

As tech giants deploy agentic browsers that perform end-to-end commerce actions on behalf of consumers, the absence of standard identification protocols like Web Bot Auth creates friction between platforms embracing automated checkout and retailers blocking unverified automation.

Evidence