The AI Traffic Report Q3 2026: Agentic Browser Traffic Jumped 4.7x in September as Meta’s Muse Hits 29M Requests in 12 Days

AI agent traffic is no longer an emerging trend. It’s a layer of the web that keeps compounding. In Q3 2026, DataDome’s network processed nearly 25 billion AI agent requests, up 41.5% from Q2.  

The traffic is also changing in kind. Agentic browsers, which act on a user’s behalf rather than just fetch content, jumped 4.7x in September. But browsers are only one part of a broader shift. Across the whole agent population, volume is spreading out: Meta still leads in volume, but other agents grew at a faster rate. Claude’s crawlers surged +159%, and Meta’s Muse reached 29 million requests in its first 12 days of full availability, almost entirely from cloud infrastructure rather than consumer connections.

The agent population is clearly broadening. For site owners, the question is no longer how much AI traffic they get, but which agents to trust, and for what.

This report draws on DataDome’s network data from July through September 2026. Muse figures run from September 22 through October 3, 2026.

Key findings

• AI agent traffic grew 41.5% QoQ. DataDome’s network processed nearly 25 billion AI agent requests in Q3 2026, up from 17.7 billion in Q2. 
• Agentic browser traffic jumped 4.7x in September, from 12.5 million to 58.2 million requests. Even without Muse, volume tripled, to 38.7 million. Comet fell 65% from July to September.
• Meta’s lead holds, but the mix is shifting. Meta generated 12.4 billion requests (49.7% of traffic, down from 51.5% in Q2) as non-Meta agents grew faster (+47% vs +36.5%). Meta-WebIndexer retook the #1 spot in September (2.63B vs 2.48B for Meta-ExternalAgent).
• Claude’s crawlers surged. ClaudeBot grew +159% QoQ to 2.3 billion requests, passing GPTBot (−12%) to rank #4.
• Meta’s Muse acts from the cloud – not user devices. Muse generated 29.1 million requests in its first 12 days of full availability. 99.3% came from cloud and CDN infrastructure, consistent with an agent that works inside its own cloud virtual machine
• Muse hits sensitive flows: 8.9% touched forms, login, payment, account creation or cart endpoints.

AI agent traffic: Growth accelerates in volume

Nearly half of all AI agent traffic this year arrived in the last three months. DataDome’s network recorded nearly 25 billion AI agent requests in Q3 2026, up 41.5% from Q2’s 17.7 billion, bringing the 2026 total to nearly 55 billion.

The growth came as a sudden jump, not a steady climb. July dipped 5.6% below June, to 6.23 billion requests. August then jumped 47% to 9.18 billion, and September edged up 4.4% to 9.58 billion, the highest month in this dataset and 45% above June. Traffic reset to a new, higher baseline within weeks, and it held. 

Capacity and bot-management policies built around last quarter’s averages are already out of date. 

Top agents: Same leaders, new momentum

Meta-ExternalAgent and Meta-WebIndexer remain the top two agents on DataDome’s network. Together they generated 12.4 billion requests in Q3 (+36.5% QoQ), or 49.7% of all AI agent traffic.

That is slightly below Q2’s 51.5%, because non-Meta agents grew at a faster rate (+47%). Meta’s monthly share still climbed through the quarter, from 43.9% in July to 49.7% in August and 53.4% in September. 

Meta-WebIndexer retakes the lead. Q2 ended with Meta-WebIndexer passing Meta-ExternalAgent for the first time (June). In July and August, the order flipped back, but in September Meta-WebIndexer led again, 2.63 billion requests to 2.48 billion. 

ExternalAgent still leads for the full quarter, yet WebIndexer’s climb from 1 billion in July to 2.6 billion in September, with ExternalAgent dipping, suggests Meta is continuing to invest in the “answering” side of AI, not only the “learning” side.

ClaudeBot surges to #4. ClaudeBot grew 159% QoQ, from 892 million to 2.3 billion requests, and passed GPTBot, which fell 12%.

Just outside the top 10, two new entries tell a story about where the labs are heading: Claude-SearchBot (358M requests, new), Amzn-SearchBot (103M, new).

OpenAI, Anthropic, and Amazon now each run three kinds of bots: one that collects content to train their models, one that indexes pages for AI search, and one that fetches a page in real time when a user asks a question. Each bot has its own name, so a site can allow or block each one separately. Agents that load pages in a regular browser don’t carry these bot names and aren’t covered by these controls.

The split gives publishers what they asked for: a way to refuse model training without disappearing from AI search and answers. It also helps the labs build their own fresh, cited search results and depend less on Bing, Google or Brave. But each new bot name is another allow/block decision, and the companies don’t always say up front how each bot treats robots.txt.

Agentic browsers: A volatile category with one new addition

Total agentic browser requests rose 4.7x from August to September, from about 12.5 million to 58.2 million. Excluding Muse, volume still tripled (from 12.5 million to 38.7 million).

Note: Muse is not a standalone browser. It is a personal AI agent that operates inside its own dedicated cloud virtual machine, which contains a full browser, to complete multi-step tasks on a user’s behalf. We include it here because the traffic it generates is browser-driven.

ChatGPT’s cloud browser grew 4.5x in September (6.1M to 27.4M), making it the largest agentic browser, at 47% of volume. Claude’s extension nearly tripled (3.6M to 10.5M). Muse, despite being fully available only since September 22, still made up 33% of September’s volume.

Meanwhile, Comet fell 65% from July to September (2.4M to 0.8M).

Muse acts from the cloud, not from user devices

Muse generated 29.1 million requests in its first 12 days of full availability (September 22 to October 3), making it one of the largest sources of agentic browser traffic we measured in September.

But volume is only part of the story. Where the traffic comes from, and what it does once it arrives, is what sets Muse apart.

• Daily volume rose 4.4x in nine days, from 0.8 million requests on September 22 to 3.7 million on October 1, roughly 18% growth per day.
• Peak: 484,000 requests in a single two-hour window (October 3).
• Scale: In September alone, Muse generated 19.5 million requests, about 1.9x the Claude browser extension, and 33% of all agentic browser traffic that month. Because detection covers only the last nine days of September, these are floors.
• Rhythm: Clear daily cycles. Volume rises from 08:00 UTC, peaks at 16:00 UTC, and falls back until 08:00 UTC the next day. That is consistent with traffic following user activity rather than a scheduled crawl.

In a sample of Muse traffic, 99.3% came from cloud and CDN infrastructure: Cloudflare (81.2%) and Fastly (18.1%). Only 0.6% (17.5K requests) came from consumer ISPs, spread across eight networks: Comcast, Bell, Verizon, Charter, Rogers, AT&T, T-Mobile and TELUS.

The origin follows from how Muse is built. Each user’s agent works in its own cloud VM, so its requests leave from data-center infrastructure rather than from the user’s device. A consumer feature therefore shows up on your network as infrastructure traffic. It also means device and home-IP signals will not separate Muse from other cloud-hosted traffic, even though a real user’s task sits behind the requests.

The same sample shows what Muse touches. 8.9% of Muse requests hit sensitive flows: roughly 24.8K login, 9.6K payment, 6.8K account creation and 5.2K cart requests, plus 202.6K form requests.

Forms account for 81% of that sensitive traffic and run about 8x higher than login. In other words, Muse is reaching past browsing and reading into forms and checkout, while mostly acting logged out rather than signing in as the user.

This aligns with findings in our 2026 State of Bot & Agent Security Report: AI agents are moving deeper into the customer journey. Muse is the first mass-market example, and it doesn’t announce itself.

Implications & risks

• Agentic traffic is moving from reading to acting. Muse’s 8.9% share of sensitive-flow requests, led by forms, shows agents reaching past content into the parts of a site that carry fraud and abuse risk.
• Cloud-hosted agents break consumer-traffic assumptions. Muse works inside its own cloud VM, so 99.3% of its requests come from Cloudflare and Fastly, and a policy that trusts residential or ISP-based traffic will not catch it.
• Meta’s volume is still an infrastructure cost, not a business signal. Meta generated 12.4 billion requests in Q3, against 51K Meta AI referrals. Meta AI’s growth is worth watching, but it does not yet change that math.
• The agent landscape reshuffles every quarter. ClaudeBot jumped 159%, ChatGPT-User fell 37% in a single month, Comet dropped 65% and Muse appeared from nothing. Each new bot name is another allow/block decision.
• Crawl volume is a poor proxy for value. ChatGPT-User fetched less in September while ChatGPT referrals hit a record. Claude’s referrals fell as ClaudeBot crawling rose.

Recommendations

• Classify agents by function, not just by vendor. OpenAI, Anthropic, and Amazon now run separate bots for training, search indexing, and user-triggered fetches. Each needs its own policy.
• Extend agent policy to action surfaces. Set explicit rules for what agents can do on forms, login, account creation, cart and checkout, not only whether they can read content.
• Make a deliberate Muse decision. Muse doesn’t declare itself, and it arrives from cloud infrastructure. Decide whether to allow, limit, or block it, and monitor what it does on sensitive endpoints.
• Validate agent identity beyond the user-agent string. Web Bot Auth and IP validation against published ranges are the minimum bar. Don’t rely on ISP or device signals to spot cloud-hosted agents.
• Apply behavioral analysis to autonomous agents. Form interaction, session flow, and API sequencing patterns are detectable, but not with signature-based approaches designed for crawlers.
• Review agent policies every quarter. Rankings, bot names, and browser share change too fast for set-and-forget rules, and companies don’t always document how each bot treats robots.txt.

Conclusion

AI agent traffic continues to scale fast: 25 billion requests in Q3 2026, up 41.5% from Q2, with September the highest month on record. But volume is no longer the main story. The mix is changing, and so is what agents do.

Muse shows where this is heading. It works from its own cloud VM, 99.3% of its requests come from cloud and CDN infrastructure, and 8.9% touched forms, login, payment, account creation or cart endpoints. Agents are moving from reading content to acting on sites, and residential-IP or device signals won’t catch them.

Our advice for Q4: classify agents by function, set rules for sensitive flows, validate identity beyond the user-agent string, and review policies every quarter. Rankings and bot names will keep shifting, so static rules won’t hold.