Analysis · curated 12 Sep 2026
Population Two Arrives
First reported arkoselabs.com
Coverage timeline
Single-source analysis — first reported, latest, and curated coincide.
Why it matters
Non-disclosing autonomous agents that inject credentials and drive websites businesses never built for them blur the line between legitimate users and automated traffic, undermining bot-detection, authentication, and fraud controls that defenders rely on.
Arkose Labs' Kevin Gosschalk analyzes the arrival of consumer-scale autonomous agents like Meta's Muse and Instinct, which complete real tasks (booking flights, reserving offices) by falling back to a web browser and injecting a user's credentials into login forms when no API or MCP connector exists. The piece argues these agents act invisibly and non-disclosingly, with a commerce-driven incentive for only selective disclosure at checkout rather than at login pages.