One in five.
That is what a Cequence travel customer reported after switching on Agent Trust — roughly twenty percent of inbound requests blocked as non-human. The company also says telemetry from Meta's Muse agent covered more than half of its monitored customer sites within two weeks of the October 7 launch. Both figures came from Cequence. Neither has third-party verification. I am leading with provenance rather than with the number, because a security product's efficacy claim is precisely the class of statement where a single unreplicated source should make a reader slower, not faster. The vendor is the interested party. The merchant carries the loss when the classifier is wrong.
Cequence is a private, venture-backed API security firm. Agent Trust is not a new platform. It is a module bolted onto the existing Application and API Protection stack — a feature tuck-in that reuses the sales channel, the telemetry pipeline, and the CQ Prime rule engine. Its job is narrow: at the merchant edge, read the identity claims presented by an inbound AI agent, decide whether that agent is a legitimate delegate of a real account holder or automated fraud, and enforce at the transaction level rather than at the session level.
The registry behind it is protocol-agnostic. It reads across four competing standards — Skyfire on the crypto side, Visa's Trusted Agent Protocol, Google's AP2, and the OpenAI/Stripe Agentic Commerce Protocol. Four standards, four owners, no interoperability layer between them. Meanwhile S.5051, the AI AGENT Act, sits in Senate Commerce with no scheduled floor vote. Private registries are filling a regulatory vacuum, which is less a criticism of Cequence than a description of ambient conditions: in a tape where nobody funds a standards body, the first vendor to publish a lookup table gets to call it infrastructure.
That matters because the underlying merchant problem is genuinely unsolvable at the merchant level. An agent arrives with a credential it did not mint, claims to represent an account it does not own, and asks to move money. Block it and you lose a paying customer. Permit it and you absorb the chargeback. Every merchant is being asked to underwrite a verification cost that no merchant is positioned to underwrite. That gap is real, and it is why this category exists.
Now the dissection.
A registry is a map, not a root of trust. Reading four standards is a legitimate hedge against backing the wrong one, and I understand why an independent vendor would choose it. But it also concedes the thing that matters: Cequence cannot define a standard, so it aggregates other people's. The value of that aggregation is entirely contingent on Visa, Google, and OpenAI keeping registry interfaces open to a third party. If any one of them decides agent verification resolves only inside its own network — a commercially obvious move — the aggregate shrinks to a partial index overnight. Transparency is a feature, not a default state. Here the transparency belongs to four other companies, and none of them signed anything promising to keep it.
CQ Prime is a rule engine, and rule engines age. The detection surface is signature-driven: a list of agents the system recognizes. That is a reasonable engineering choice and a structurally weak security posture, because a list is a description of what has already happened. My 2017 Solidity audit work taught me the same lesson in a different medium. Static checks validate the state space you enumerated; adversaries find the states you did not. I spent six weeks that year on three ICO crowd-sale contracts and found integer overflow paths in the distribution math that no linter flagged, because the linters were checking known patterns and the bug was a composition of two individually safe-looking operations. Agent detection has the same shape. The rules will be right about yesterday's agents. Bots do not dream, they only scrape — and the first thing they scrape is your detection logic, because it is the cheapest surface on the target to observe.
The registry's technical depth is probably thin. Implemented honestly, a protocol-agnostic registry is a mapping from agent identifier to issuing authority plus a verification callback. That is a database with a REST surface. It is replicable in a quarter by any competitor with distribution, and the moat is not the code — it is the authorization relationship with the four standard owners. Cequence has not disclosed whether it holds formal read authorization from Visa, Google, or OpenAI, or whether it reverse-adapted against public mechanisms. Those are different businesses. One is a partner. The other is a scraper with a sales team, and it can be shut off with a header change.
Position in the stack is the quiet structural problem. Cequence sits in application and API protection. Cloudflare, Akamai, HUMAN, and DataDome sit closer to the wire, at the network edge where the request first appears. When an agent is designed to look like a browser, the earlier you see it the more signal you retain. An application-layer vendor inspecting traffic that already passed a CDN is working with a compressed version of the same evidence. Cloudflare's Web Bot Auth work is the specific thing to watch here, because it is the one entrant that could make agent verification a network property rather than a subscription module.
The biometric confirmation step is the liability nobody is pricing. Forcing the account holder to confirm on their own device is strong control and hard compliance exposure in the same gesture — BIPA in Illinois, the biometric provisions of GDPR, CCPA. You can rotate a password. You cannot rotate a face. That asymmetry means a storage or retention failure is permanent for every affected user, and the vendor's data handling policy is the only thing standing between an incident and an uninsurable class action.
And then the sentence that should have been the headline. According to Cequence, an agent was able to complete MFA at a financial institution. If accurate, that is more consequential than the product. It means multi-factor authentication — the load-bearing wall of consumer account security for a decade — does not distinguish between a human principal and a process operating with stolen session material. Behavioral profiling is what Agent Trust layers on top. But behavioral inference is a probability estimate wearing an identity badge. The correct primitive is cryptographic delegation: a user-signed credential with explicit scope, an expiry, and a revocation path, verifiable without inference. Probability is not identity. It is a guess with a confidence interval, and the interval is carried by the merchant, not the vendor.
I hit this exact failure mode in 2026 while auditing oracle feeds for autonomous trading agents. Roughly forty percent of the training corpus I sampled had been poisoned with synthetic transaction history written by rival protocols. The classifiers were well-built. The inputs were fabricated. Algorithmic fairness assumes fair inputs, and agent-behavior classifiers are trained on traffic that adversaries can author. Code does not lie, but it can be misled — and the misdirection is cheap when your adversary is also software.
Here is where the bulls are right, and it deserves saying. "Block the action, not the agent" is a genuinely correct framing, and almost nobody else sells it. Most agent-management vendors sell a wall: binary, high-friction, and eventually bypassed by an agent that learns to look human. Cequence sells a throttle with a receipt — permit the checkout, block the wire transfer. That granularity is the difference between a control a merchant will actually deploy and one they quietly disable after the first false positive costs them a whale.
The neutral-aggregator position is also undervalued in a fragmentation regime. If four standards persist for three years, someone has to adjudicate conflicts — two registries, one agent, contradictory verdicts — and whoever owns the arbitration table owns a real toll booth. Cequence is not wrong to want that seat. It is wrong to call it identity. And as a private company with a hot narrative and no disclosed pricing, the likeliest outcome is not an IPO but an acquisition by an edge or payments incumbent buying the capability rather than building it.
Three signals will settle this, and none of them are press releases. Whether Visa, Google, or OpenAI grant formal registry read authorization in writing. Whether Cloudflare ships agent verification at the edge, where it already sits ahead of every application-layer vendor. And whether anyone publishes a false-positive rate alongside the block rate. Until then, the honest position is the one this bear market keeps teaching: the demand is real, the deployment is real, and the trust model is still a guess. So ask the question the deck will not answer — when the classifier is wrong and a paying customer is blocked, who books the loss?
