Meta has been attaching cryptographic signatures to a growing number of web requests from its Muse personal agent and its Meta-WebIndexer crawler since around October 12, according to Jérôme Segura, VP of Threat Research at bot-management company DataDome, who described the observation in a LinkedIn post on October 30. The signatures use Web Bot Auth, a protocol that lets a website verify that an automated visitor really comes from the company it claims.

Segura was careful about the limits of what he saw: there has been no public or official announcement from Meta, the signed requests are still a relatively small share, and early signed traffic may have run under a Meta-ExternalTest user-agent string. Meta's public crawler documentation, as of October 31, lists five automated agents and mentions neither Web Bot Auth nor a test agent. DataDome says it now validates the signed requests for its customers.

Signed agent identity is becoming a live issue as personal agents like Muse browse and transact on users' behalf: sites want a way to tell a genuine Muse visit from an impersonator. Meta's revised crawling terms are due to take effect on November 20. Until Meta documents the change, this stays rumor-grade — a single researcher's observation, however credible the source.