Personal AI Agents and Your Website: Muse, Dots, Grok Bot and More (2026)

In the space of eight weeks, the biggest AI companies all shipped the same idea. xAI launched Grok Bot on 11 August 2026. Instinct spread through private invites in late August. Meta launched Muse on 8 September. OpenAI announced dots on 29 September. Each one is a personal AI agent: an assistant with its own computer in the cloud that opens websites to get things done for one person.

That makes them a new kind of visitor. They are not search crawlers, and they are not quite humans either. This guide compares the main agents from their makers' own documents, shows how each one identifies itself, and gives you one plan that works for all of them. To see which named agents already visit you, paste a log sample into the free AI agent log checker.

What a personal AI agent is

A personal AI agent is an assistant that does tasks, not just answers questions. You tell it what you want, for example "book a table for four on Friday" or "find a cheaper phone plan", and it works through the steps itself. The agents in this guide share four traits.

• Their own computer. Each user gets a virtual machine in the cloud with a real browser. Meta calls its version Muse Secure VM; OpenAI says each dot has "its own cloud computer"; xAI says Grok Bot runs on hosted computers.
• Always on. They keep working after the user closes the app and report back when something changes or when they need approval.
• Connected to the user's accounts. Email, calendar, messaging and other apps, through connectors or by signing in through the browser.
• One person at a time. An agent visits your site because its user asked for something there. It does not crawl your site to build an index.

That last point is why the old rules do not fit. Search crawlers and training crawlers read robots.txt because they visit sites on their own schedule. A personal agent is closer to a person using a browser. Google says this directly about its own user-triggered fetchers: "Because the fetch was requested by a user, these fetchers generally ignore robots.txt rules."

The agents compared

This table brings together what each maker documents, plus what Cloudflare Radar bots directory lists. "Reported" means the token comes from a third-party registry, not the maker's own page. We mark it that way on every profile so you know how much to trust it.

Below, each agent in a little more detail, using only what its maker or a reliable registry says.

Meta Muse

The Meta's Muse launch post says Muse "can open a browser, fill out forms, and negotiate on their behalf", and that it asks before it "sends an email or makes a purchase". Meta's Meta's post for businesses adds that Muse applies a "one honest person" test and an "if every agent did this" test before it acts, and that it "will seek approval for sensitive actions taken on your behalf like signing in, completing a reservation, or making a purchase." Cloudflare lists its client as muse-. Amazon blocked Muse on 21 September 2026, saying it did not identify itself; Shopify and Walmart work with it. Full details are in our Meta Muse guide.

OpenAI dots

The OpenAI's dots launch post says dots "can do nearly anything using their own cloud computer, their own browser, and the apps you've connected." They browse through ChatGPT's Cloud browser, which, according to OpenAI's Cloud browser allowlisting guide, signs each request with Signature, Signature-Input and Signature-Agent: "https://chatgpt.com". Cloudflare, Akamai, HUMAN and Vercel list the traffic as ChatGPT Agent. There is no dots token in the user agent. See what OpenAI dots mean for your website.

xAI Grok Bot

xAI's xAI's Grok Bot security page says hosted computers "reach the internet through shared static egress IP addresses by default", that the ranges "are shared across Grok Bot customers", and that "current ranges are available from your account team". It also says "a Bot has no identity or credentials of its own" and that, for login, two-factor and payment steps, "the Bot hands the computer to the member". Cloudflare Radar lists Grok Bot with the user-agent pattern GrokAgent. xAI's own pages do not print that string, so we mark it Reported. Do not confuse it with GrokBot and xAI-SearchBot, which are separate crawler names; see Grok Bot vs GrokBot.

Google-Agent

Google documents Google-Agent on its Google's user-triggered fetchers page: it is "used by agents hosted on Google infrastructure to navigate the web and perform actions upon user request." It is the most transparent of the group. The user-agent string contains Google-Agent, the IP ranges are published in user-triggered-agents.json, and reverse DNS works as it does for other Google fetchers. Google also notes that user-triggered fetchers "generally ignore robots.txt rules".

Hark Agent

Hark's bot page is a model for how an agent should identify itself. It sends HarkBot/1.0, signs every request with "HTTP Message Signatures (RFC 9421) under the Web Bot Auth profile", publishes IP ranges as a fallback, and is a Cloudflare verified bot. Hark says each fetch is "initiated by an authenticated Hark user request", with "no autonomous crawling, no scheduled jobs, no prefetch", and that it makes "one outbound request per tool invocation. No automatic retries on failure."

Instinct

Instinct is an invite-only assistant you text or call. The TechCrunch report on Instinct describes it connecting to "your email, messaging apps, calendar, and your device's audio, location, screen, and more", and notes that its terms allow it to enter into binding "agreements, commitments, or transactions" for users. Instinct has published no user-agent token, no signature scheme and no IP ranges as of 11 October 2026, and it is not in Cloudflare's verified bot directory. Its visits look like ordinary browser traffic from cloud addresses.

Three ways an agent can identify itself

The table shows a clear pattern. Agents identify themselves in one of three ways, and each needs a different check on your side.

1. A user-agent token

The oldest method: a word in the User-Agent header, such as Google-Agent, HarkBot, GrokAgent or muse-. It is easy to read in any access log, which is what our AI agent log checker does. The weakness is that anyone can copy it. A scraper can call itself HarkBot as easily as Hark can.

2. A cryptographic signature

The newer method, and the one the industry is moving to. The agent signs each request with a private key, using RFC 9421 and the Web Bot Auth draft. It adds a Signature-Agent header that points to a public key directory, so anyone can verify the request really came from that operator. OpenAI, Hark and, according to Cloudflare, xAI and Meta-ExternalTest use it. It cannot be faked without the key, but you need a CDN or a library to check it, and standard access logs do not show it.

3. Nothing

Some agents send no token and no signature. Instinct is the main example today. So is any agent running on the user's own laptop, which OpenAI and xAI both allow: OpenAI says a user can "give your dot permission to connect and use your laptop", and xAI says members "can route traffic through their desktop to use its network and IP address." That traffic looks exactly like the user visiting your site, because in network terms it is.

Why robots.txt is not the answer

It is tempting to add every new agent name to robots.txt. It does little harm, but it is the wrong tool, for three reasons.

1. No maker says its agent reads it. Meta, OpenAI, xAI and Hark document robots.txt behaviour for their crawlers, not their agents. Google says its user-triggered fetchers generally ignore it.
2. The standard is for crawlers. RFC 9309 describes rules for automated clients that crawl. A person using a browser has never been bound by it, and an agent acting for one person in real time sits much closer to that person.
3. Some agents have no name to match. You cannot write a User-agent line for dots or Instinct.

If you want to stop AI training on your content, robots.txt is still the right place, for crawlers such as GPTBot, Meta-ExternalAgent and ClaudeBot. Our robots.txt generator handles those. Agents are a separate decision.

Where agents get stuck

Every maker documents the same three stopping points. They are useful to know, because they are both your protection and the reason agents fail on sites that want their business.

One plan that works for every agent

You do not need a separate policy for each new agent. This plan covers named, signed and anonymous agents alike.

Step 1: Measure

Find out who is already visiting. Paste a week of access log lines into the AI agent log checker to find Muse, Grok Bot, Hark, Google-Agent and the user-triggered fetchers such as ChatGPT-User and Claude-User. Then open your CDN's bot analytics and filter for verified agents such as ChatGPT Agent, which do not show up by name in plain logs.

grep -iE "grokagent|muse-|harkbot|google-agent|chatgpt-user|claude-user|perplexity-user" \
  /var/log/nginx/access.log | tail -5000 > agents-sample.log

Step 2: Decide by area, not by agent

Split your site into areas and decide once for each: browsing and research, enquiries and bookings, checkout, accounts, and anything with limited stock. For most businesses the first three should be open to agents, accounts are protected by logins already, and limited stock needs extra checks.

Step 3: Remove friction where agents help

• Move CAPTCHAs off search, product, pricing and booking pages. Keep risk-based checks on account creation and high-value actions.
• Put prices, stock, hours and service areas in plain HTML, with matching structured data.
• Offer guest checkout and a mainstream wallet such as Link, Shop Pay, Apple Pay or Google Pay.
• Label every form field and write clear error messages.

Step 4: Use verified identity for named rules

Where you need a named rule, base it on verification, not on the header. On Cloudflare, use verified bot fields or detection IDs. For ChatGPT Agent the detection ID is 129220581, as OpenAI's guide documents. On Akamai and HUMAN, use their ChatGPT Agent and other verified entries. For Google-Agent, check the IP against Google's published list. For Hark, verify the signature or the published ranges.

Step 5: Protect actions with rate limits

For agents you cannot identify, rate limits on actions such as sign-up, coupon redemption, reviews and checkout catch abuse from any source without blocking research. This is the same advice that works for human fraud.

Step 6: Re-test

Run the AI Agent Readiness Check on your key pages after each change. It loads them from a cloud server with a Linux browser, which is the closest public test to how hosted agents arrive, and reports any challenge, refusal, login wall or missing content.

Verification snippets

If you run your own server, these examples help you check the agents that publish proof. Replace paths to fit your setup.

curl -s https://developers.google.com/static/crawling/ipranges/user-triggered-agents.json \
  | jq -r '.prefixes[] | .ipv4Prefix // .ipv6Prefix'

curl -s https://hark.com/agent/ipranges/harkbot.json | jq .

log_format agents '$remote_addr [$time_local] "$request" $status '
                  '"$http_user_agent" sig_agent="$http_signature_agent"';
access_log /var/log/nginx/agents.log agents;

The Signature-Agent header tells you who claims to have signed a request; the signature itself, verified against the operator's key directory, tells you whether the claim is true. Most sites should let their CDN do that part.

What agents mean for SEO and GEO

Personal agents do not rank pages and do not affect Google or Bing results. But they change what "visibility" means. When someone asks an agent to "book a plumber for tomorrow morning", the agent picks a business, often by searching and then reading a few candidate sites. The business whose site answers clearly and lets the agent finish the job wins the booking.

That links agent readiness to generative engine optimisation. The same things that help AI search engines cite you, clear facts, structured data and pages that render without heavy scripts, also help agents act on your site. Our guide to making your website work for AI agents covers the details, and AI shopping agents and product data covers stores.

Three examples

These are illustrative scenarios based on the problems we see most often in site audits, not named client cases.

A garden centre

The owner ran the AI agent log checker and found Muse and GrokAgent on the plant care and delivery pages, mostly in the evening. Delivery prices were only shown after a postcode lookup that needed a CAPTCHA. The centre published a plain delivery price table by area, kept the CAPTCHA only on account sign-up, and saw more complete orders arrive with the delivery slot already chosen.

A software company

Its pricing page loaded plans from a script that ran after a cookie banner was accepted. Agents comparing tools for their users reported "pricing not available". The company rendered the plan table in the HTML, added Product and Offer structured data, and allowed ChatGPT Agent in Cloudflare by detection ID. Sales started to receive enquiries that quoted the right plan names.

A concert venue

The venue welcomes agents on its listings and venue information pages, which answer most questions. On sale days it adds a managed challenge for all verified agents on the ticket checkout path and keeps a strict per-account purchase limit. Fans who use agents can still find dates and set reminders; bulk buying stays hard for everyone.

In each case the fix was the same: decide by area, remove friction where agents help customers, and keep firm controls only where automation causes harm.

What is coming next

• Open protocols. Meta and Sierra are developing a Personal Agent Protocol with Shopify, Stripe, Walmart and others, which Meta says will let agents "securely convey user identity" and let businesses "steer personal agents" to preferred flows.
• More signed agents. Web Bot Auth is spreading. Cloudflare's directory already lists dozens of signed agents, including shopping and checkout agents from smaller companies.
• Agent-to-agent. Meta writes that "a personal agent should not have to interpret a support center article when it can ask the business agent a direct question". Expect more businesses to offer an agent or an API for agents to talk to.
• Specialist agents at work. OpenAI's specialist dots will have "their own identity, credentials, and access" inside organisations, which means agents logging into supplier portals under named accounts.

Common questions

Are personal agents bots or people?

Both, in a sense. They are automated software, but they act for one identified person and usually stop for that person's approval before anything important. That is why their makers treat them like users, and why most sites should too.

Will blocking agents protect my content from AI training?

No. Training is done by crawlers, not by personal agents. To limit training, block crawlers such as GPTBot, Meta-ExternalAgent and ClaudeBot in robots.txt. Agents read pages to complete a task for their user.

Which agent is safest to allow?

The ones that prove who they are. Google-Agent publishes IP ranges and Hark publishes signatures and ranges, so you can verify both precisely. ChatGPT Agent is verified by the major CDNs. Muse and Grok Bot are verified by Cloudflare. Instinct cannot be verified at all today.

Do agents show up in Google Analytics?

Usually yes, because they run a real browser that executes your analytics script. Expect short, direct sessions from data-centre locations in the US. Segment by network or ASN to estimate the share.

How often will this list change?

Often. We check Cloudflare Radar and the makers' pages when we update the AI bot directory, and every profile shows whether its token is Official or Reported.

Your personal agents checklist

• □Run the AI agent log checker over a week of logs and note which agents visit which pages.
• □Check your CDN's bot analytics for verified agents that send no token, such as ChatGPT Agent.
• □Split your site into browse, enquire, buy, account and limited-stock areas, and decide once for each.
• □Remove CAPTCHAs from browsing and booking pages. Keep risk-based checks on account creation and high-value actions.
• □Put prices, stock and hours in plain HTML with structured data.
• □Use verified identity, not user-agent strings, for any named allow or block rule.
• □Rate-limit sensitive actions to catch abuse from agents you cannot identify.
• □Keep robots.txt for crawlers and training decisions, not for personal agents.
• □Re-test with the AI Agent Readiness Check after each change, and review your agent traffic monthly.