How do AI shopping agents identify themselves?
Some AI shopping agents prove who they are. They sign each request with Web Bot Auth, a cryptographic signature a site can verify. Some are classified by their network provider as a verified AI bot. Others declare nothing, run an ordinary browser, and can only be recognized by how they behave. The user-agent string alone proves nothing.
Last updated
Why isn't the user-agent string enough?
Because any program can send any user-agent, and the agents observed did not announce themselves in it. Meta's Muse and xAI's Grok shopping agent both reported an ordinary desktop Chrome on Linux. Nothing in the string said an AI was driving.
A user-agent is a line of text the browser sends with each request. It is useful for crawlers that name themselves. It is not proof, because it costs nothing to change.
In Cromanion's lab runs, neither agent's user-agent named it. Muse's said Chrome 153 on Linux on 2026-09-21. Grok's said Chrome 151 on Linux on 2026-09-25.
What is Web Bot Auth?
Web Bot Auth is a way for a bot to sign its HTTP requests with a private key. The site checks the signature against a public key the bot's operator publishes. A valid signature proves the request came from whoever holds that key. A person's browser cannot produce one.
It builds on HTTP Message Signatures, an IETF standard (RFC 9421). The request carries three headers: Signature-Input, Signature, and Signature-Agent. Signature-Agent names the origin that publishes the keys, at a fixed address: /.well-known/http-message-signatures-directory.
The Web Bot Auth protocol itself is still being standardized. An IETF working group, also called Web Bot Auth, has it in scope. Cloudflare verifies these signatures for sites on its network, with Ed25519 keys.
Which shopping agents were seen signing their requests?
xAI's Grok shopping agent signed every request in three runs on Cromanion's test store on 2026-09-25, including the page's own background requests. Every signature verified. Meta's Muse signed nothing in the runs observed.
Grok's signatures named a key directory hosted on cursorusercontent.com. The same key signed all three runs. Cloudflare also placed its requests in the AI Assistant category.
Grok's agent also fetched some pages as plain text, without a browser and without a signature. Those requests ran no script, so a tag on the page could not see them.
What does a verified bot category say?
It says what kind of bot a request comes from, not which one. Cloudflare verifies bots on its network and files them in categories. Three concern AI: AI Assistant, AI Search and AI Crawler. An AI Assistant is, in Cloudflare's words, an automated AI bot driven by user action.
A category is a second level of proof. It comes from the network provider, not from the page. It is available only where the provider sees the traffic.
The three AI categories describe different visits. An assistant acts for a person during the visit. Search and crawler bots fetch content, for answers or for training. Only the first is a shopping visit in the sense of this guide.
How are agents that declare nothing recognized?
By how the browser behaves. A software-driven browser moves and types differently from a person. Muse's pointer jumped from point to point instead of traveling. Grok's agent filled name, email and address fields with zero keystrokes. These are signs, not proof, and each needs a few seconds of evidence.
On 2026-09-21, Muse's pointer was sampled 7 times on cromanion.com. It moved about 115 pixels between samples and jumped twice. The jumpiest desktop person measured moved about 85 pixels. That margin is thin, and it is stated here as a limit of the method.
Some signals looked promising and were rejected, because real people share them. A full-screen browser window is one: about 13% of the desktop visitors Cromanion measured had one. A browser that randomizes its reported plugins is another.
What can agent identification not see?
Anything that leaves no trace in the page, and any agent that behaves enough like a person. A fetch without a browser runs no script. An unsigned agent that moves smoothly is counted as a person. Identification finds the agents it can prove or recognize, and no more.
Plain-text fetches
A request made without a browser runs no script, so a tag on the page never sees it. Only the server or the network does.
Unsigned, human-like agents
An agent that signs nothing and moves like a person is indistinguishable from one. It is counted as a person.
Agents that change
The observations here are anecdotal: a handful of dated lab runs of two agents. Agents change from one release to the next, and a behavior seen on one date may not hold on the next.
Common questions
Can a person's browser pretend to be a signed agent?
No. A Web Bot Auth signature needs the private key that matches the operator's published public key. Without that key, a request cannot carry a valid signature, whatever it says in its headers.
Does a store need Cloudflare to see a verified agent?
A verified category comes from a network provider that sees the traffic, so it is only available where that provider is in the path. A Web Bot Auth signature can be checked by anyone who fetches the operator's public keys.
Sources
- RFC 9421: HTTP Message Signatures — IETF, RFC Editor. The standard Web Bot Auth builds on: signing HTTP messages with Signature-Input and Signature headers. Checked .
- Web Bot Auth (webbotauth) — IETF. The working group whose scope is authenticating automated web clients, including AI agents. Checked .
- Web Bot Auth — Cloudflare Docs. The three headers, the key directory address, and Ed25519 keys. Checked .
- Verified bots: categories — Cloudflare Docs. The verified bot categories, including AI Assistant, AI Search and AI Crawler, and their definitions. Checked .
- Forget IPs: using cryptography to verify bot and agent traffic — Cloudflare. Why a cryptographic signature is stronger than an IP address or a user-agent. Checked .
See it on your own site
Paste one tag. Cromanion crawls your site, watches real sessions in Learn mode, and only acts when you switch it on — with a permanent 10% holdout proving what it caused. Free to start, no credit card: a 14-day or 1,000-session live trial, then keep measuring for free.