DataDome tells LDS why an AI agent at checkout is not proof of abuse

DataDome's sample of traffic attributed to Meta's Muse found that 8.9% of requests reached forms, login, payment, account-creation or cart endpoints, but Jérôme Segura, VP of Threat Research at DataDome, told Let's Data Science that the figure "measures that exposure, not confirmed abuse." DataDome reported nearly 25 billion AI-agent requests across its network in the third quarter of 2026, up 41.5% from the previous quarter, with its agentic-browser category rising from about 12.5 million requests in August to 58.2 million in September, a rounded 4.7-fold increase, and separately counted 29.1 million Muse requests from September 22 through October 3. Segura said confirming abuse requires additional signals such as repeated submissions or high failure rates alongside a business's own definition of acceptable behavior, and the report's sampling limits mean individual businesses cannot assume their own traffic grew at the same rate.

DataDome tells LDS why an AI agent at checkout is not proof of abuse DataDome's Jérôme Segura tells LDS that its finding of Muse requests reaching sensitive endpoints measures exposure, not confirmed abuse or completed transactions. His written answers explain why identifying an AI agent does not settle what a business should allow it to do. The report supplies evidence from DataDome's network, with sampling limits that matter when applying its figures elsewhere. An AI agent reaches a payment endpoint. That may deserve attention, but the request alone does not tell a retailer whether the agent loaded a page, attempted a transaction, completed a purchase or did something harmful. Jérôme Segura, VP of Threat Research at DataDome, made that distinction explicit in written answers to Let's Data Science: "On its own, a request to a sensitive endpoint shows that an agent reached it, not what it did. Our 8.9% figure measures that exposure, not confirmed abuse." The figure comes from DataDome's sample of traffic attributed to Meta's Muse. It is a useful qualification to a Q3 report https://datadome.co/threat-research/ai-traffic-report-q3-2026/ describing rapid growth in AI-agent requests. More traffic reaching sensitive parts of a website raises questions for operators, but counting those requests does not answer them. The interview's practical value is in separating the measurement from the decision: who appears to be making a request, what the request establishes, and what permission is needed before an action should proceed. What the traffic figures measure DataDome reports nearly 25 billion AI-agent requests across its network in the third quarter of 2026, up 41.5% from the previous quarter. Its agentic-browser category rose from about 12.5 million requests in August to 58.2 million in September, a rounded 4.7-fold increase. Those are request counts, not counts of people, successful tasks or purchases. They also describe DataDome's observations, rather than a census of the web. LDS asked how much of the quarterly increase might reflect changes in the sites covered or the detection process. Segura said the customer base remained generally unchanged, with most industries represented but some more heavily represented than others. That is useful context, but it is not a published comparison of an identical set of sites under an unchanged detection method. An individual business cannot assume that its own traffic grew at the same rate. The report separately counts 29.1 million Muse requests from September 22 through October 3. DataDome corrected its accompanying release to describe nine days of September availability, rather than eight. That twelve-day total, the monthly browser category and the quarterly network total must remain separate when comparing growth. A sampled request is not a completed action The report says 8.9% of requests in its Muse sample reached forms, login, payment, account-creation or cart endpoints. It also says 99.3% of requests in the sample came from cloud or CDN infrastructure. Segura's answer narrows what can be concluded from the first finding. Evidence of abuse requires additional signals, such as repeated submissions or high failure rates, together with the business's definition of acceptable behavior. Reaching a checkout-related URL is not enough. The supplied material does not include the requested example tracing a particular request through to a completed action. LDS therefore cannot use the endpoint percentages to estimate how many agents submitted forms, bought products or attempted fraud. The endpoint mix alone also does not establish whether a session was authenticated. There is a further sampling limit. In his reply, Segura described collection beginning September 21 and continuing through the end of the month. That differs from the September 22 to October 3 window attached to the report's 29.1 million total. The exact sample denominator and selection method were not supplied in the answers. The safe reading is to treat the two percentages as findings about the reported sample. They should not be multiplied by the broader total to manufacture counts the researchers have not provided. Identifying the agent does not grant permission Segura said DataDome identifies Muse through client-side fingerprinting of artifacts associated with the cloud browser it uses, rather than relying on shared network addresses. The reply did not provide an attribution error rate or an independent validation set, so LDS cannot assess the accuracy of that classification from the supplied material. The broader point is useful even without adopting a particular detection product. Traffic arriving from shared cloud infrastructure does not, by itself, distinguish a legitimate delegated task from unwanted automation. Authentication is a separate question from the business's decision to allow an activity. Segura told LDS: "At the same time, identification alone is not enough." He said some customers choose not to allow particular agents even when those agents meet strong authentication standards. Identifying a provider does not automatically make every activity by that provider acceptable to a site. For a retailer, our practical reading is to separate three checks: | Check | What the operator needs to establish | |---|---| | Agent identity | Which agent or provider is making the request, and how that identity was verified | | Customer authorization | Whether the customer authorized this activity and which account or task that authorization covers | | Action permission | Whether this particular operation is allowed under the site's rules and the customer's authorization | This is LDS's explanation of the distinction, not a claim that the interview demonstrated an implementation of all three checks. A successful identity check cannot substitute for the other two. Observe before changing the rules Segura recommends understanding the traffic before taking action: the shares attributed to people, bots and agents, and especially what reaches high-risk, high-value endpoints. That advice matters because a restrictive rule can affect a legitimate customer task as well as unwanted activity. He told LDS: "Rules can't be siloed either because they directly impact business KPIs." A useful evaluation therefore needs more than a count of blocked requests. In our assessment, an operator should compare the rule's intended effect with customer outcomes, including legitimate failures and support problems, and keep a way to reverse a harmful change. The interview does not supply a tested first-month rollout, a false-positive threshold or a numerical rollback rule. Those settings would need to reflect the site's actual traffic and business requirements. They should not be invented from the report's growth figures. More crawling is not automatically more value LDS also asked how publishers should measure the value of training crawlers, search bots and user-triggered agents. Segura said the boundaries can blur, with several kinds of agents appearing within a single user flow. His response did not supply a method for linking those requests to referrals, useful visits or revenue. That limits what can be concluded from the report's comparisons between crawling and referral activity. Request volume is not a measure of commercial return, and a comparison needs compatible sites, periods and attribution rules. For publishers, the decision is consequently more specific than whether to welcome or reject all AI traffic. The useful questions concern which functions a site permits, which activity produces value for it, and what evidence would justify changing those permissions. What to watch A published sample size and selection method would make the Muse percentages easier to interpret. Examples connecting endpoint requests with verified actions would help distinguish routine browsing, legitimate delegated work and abuse. Detection validation and measurements of legitimate traffic blocked would strengthen any claim about the effectiveness of controls. Until those details are available, the interview supports a clear operational principle: identify the agent, establish what actually happened, and assess the requested action on its own merits. Reporting note This LDS Exclusive is based on six written answers supplied directly to Let's Data Science and attributed to Jérôme Segura, VP of Threat Research at DataDome, together with DataDome's Q3 2026 report and corrected release. The traffic measurements are DataDome's observations. LDS did not independently reproduce the classifications or test the company's controls. The sample limitations and practical interpretation are explained above; the three-check table is LDS's analysis. Key Points - 1The 8.9% sensitive-endpoint figure measures where sampled Muse requests went, not completed transactions or confirmed abuse. - 2Request totals, observation windows and sampled percentages must stay separate; the answers do not provide the sample denominator or attribution error rate. - 3Agent identity does not establish customer authorization or permission for an action. Controls also need to account for legitimate customer outcomes. Scoring Rationale Original answers clarify what widely cited agent-traffic figures establish and give site operators a practical distinction between identity, customer authorization and allowed actions. Sources Original reporting, with the public references used alongside it. LDS Exclusive Reporting based on written answers given directly to Let's Data Science by Jérôme Segura, VP of Threat Research, DataDome . Practice with real Retail & eCommerce data 90 SQL & Python problems · 15 industry datasets 250 free problems · No credit card See all Retail & eCommerce problems https://letsdatascience.com/problems/datasets/retail