Analysis
Population Two Arrives
Publication date not yet evaluated · Added arkoselabs.com
Page published
Coverage timeline
Single-source analysis — one report is available.
Why it matters
Non-disclosing autonomous agents that inject credentials and drive websites businesses never built for them blur the line between legitimate users and automated traffic, undermining bot-detection, authentication, and fraud controls that defenders rely on.
Arkose Labs' Kevin Gosschalk analyzes the arrival of consumer-scale autonomous agents like Meta's Muse and Instinct, which complete real tasks (booking flights, reserving offices) by falling back to a web browser and injecting a user's credentials into login forms when no API or MCP connector exists. The piece argues these agents act invisibly and non-disclosingly, with a commerce-driven incentive for only selective disclosure at checkout rather than at login pages.