AI agents now fill in lead forms for buyers. Verify the agent before you score the lead

KEY TAKEAWAYS

1. Agent fills are a small but fast-growing share of form traffic. DataDome saw agentic browser requests rise from about 12.5 million to 58.2 million between August and September 2026.
2. Speed and completeness rules cannot tell a buyer's agent from a script. Volume, repetition and failed verification can.
3. Route each submission by what it proves. A verified signature or an agentInvoked flag earns a normal queue and a tag, not the spam folder.
4. No one has published conversion data on agent-assisted leads. Tag them now so your own CRM can answer that within a quarter.

A demo request used to mean a person typed into your form. In 2026 it can also mean a person asked an agent to do it. Google, OpenAI, Anthropic and Meta all ship agents that fill in web forms for their users. Most form defences and lead scoring rules were built to stop scripts, and a buyer's agent looks like a script: fast, complete and tireless. This article sets out how much of this traffic exists, what each agent can prove about itself, and how to route the submission so you keep the buyer and still stop the abuse.

How much agent traffic reaches forms now?

Not much yet, but it is growing quickly. The best public numbers come from DataDome, a bot management company that reports on traffic across its customer sites.

Its Q3 2026 report, last updated on 15 October, counts nearly 25 billion AI agent requests in the quarter. Agentic browsers, the kind that click and type for a user, went from about 12.5 million requests in August to 58.2 million in September. Without Meta's new Muse agent, the September figure was 38.7 million, about three times August. ChatGPT's cloud browser alone went from 6.1 million to 27.4 million. Claude's browser extension went from 3.6 million to 10.5 million.

Forms are where Muse spent most of its sensitive effort. In a sample of Muse traffic, 8.9% of requests touched sensitive flows, and forms made up 81% of that. DataDome's half-year report, dated 22 September, counted 198.9 million AI bot requests to forms between January and June 2026.

Two cautions. These are request counts on DataDome's own network, not submissions on yours. And the Muse figures are floors, because detection covered only the last nine days of September.

Which agents fill in forms, and where do they run?

Where the agent runs decides what your form can learn about it. An agent inside the buyer's own Chrome uses that browser and its signed-in sessions. An agent in a cloud browser arrives as a fresh visitor from data centre infrastructure.

Google's own post dates auto browse to 28 January 2026, for US AI Pro and Ultra subscribers. Its examples include filling in tedious forms and getting quotes from plumbers and electricians. Muse launched on 8 September 2026, and TechCrunch lists filling out forms among its tasks.

One consequence follows from the table, though no study we found has measured it. An agent in the buyer's browser carries whatever first-party cookies your site set on earlier visits, so stored UTM values can reach the form. A cloud browser starts without them. Expect cloud agent leads to look sourceless in your CRM until you capture the source some other way.

Why do the block-it and allow-it camps both sound right?

The advice splits in two.

One camp treats agents as part of the bot problem. 4Thought Marketing, writing on 29 September, groups AI browsing agents with scrapers and fraud rings. It suggests flagging fills completed in under two seconds and holding every submission behind a verification gate before scoring. DataDome tells sites to set explicit rules for what agents may do on forms, logins and checkouts.

The other camp says let them in. Pravin Kumar argues that agents usually act for a real buyer, so controls should penalise volume, not speed. Thrive Agency says to make forms readable by agents and swap legacy CAPTCHAs for invisible checks such as Cloudflare Turnstile or reCAPTCHA v3.

They are describing different traffic. A speed rule cannot separate a buyer's agent from a script, because both are fast. What does separate them is repetition, disposable addresses and identity claims that fail verification. So the evidence supports the allow camp on speed and completeness, and the block camp on volume and spoofing.

Thrive's point about invisible checks needs a qualification. Invisible checks score behaviour, and agents behave like automation. Cloudflare launched Precursor on 13 July 2026 to read pointer movement and keyboard timing across a session, specifically to tell human from agentic traffic. Cloudflare also gives its own Browser Rendering service a bot score of 1, the most automated reading. An invisible check is less friction for humans. It is not a pass for agents. If you want verified agents through, write a rule that says so.

What can an agent submission actually prove?

A user-agent string proves very little. In a DataDome test, a spoofed ChatGPT-style user agent was sent to 698,214 sites, and 79.7% let it through.

Three stronger signals exist today.

1. A signed request. OpenAI's help page says ChatGPT agent signs every outbound request with HTTP message signatures, with a Signature-Agent header of "https://chatgpt.com". Cloudflare and Akamai verify it for you, and Vercel needs no setup. Since 1 July 2026, Cloudflare files signed agents under Verified and labels services that many end users operate as "Intermediary". A signature proves the operator, not who the end user is.
2. An agent-invoked form. In Chrome's WebMCP origin trial, the submit event carries an agentInvoked flag set to true when an agent triggered it. By default the agent fills the fields and the user still clicks Submit.
3. A verified agent session. Google Cloud Fraud Defense, the April 2026 successor to reCAPTCHA, separates verified agent sessions from suspected ones. Its policy engine can allow or block by agent identity, and it can ask for a QR code challenge when it wants proof that a human is present.

Everything else is inference from behaviour.

Which route should each submission take?

Check where your form tool sends rejects. HubSpot, for example, says known bot submissions are excluded from form analytics and may be marked as spam. They go to a spam submissions index you can review. That index is where misfiled agent leads will sit.

Should you add WebMCP markup to your forms now?

Not as a rebuild. The Chromium intent covers an origin trial from Chrome 149 to 156. Chrome's declarative API page, updated on 25 September, documents the toolname and tooldescription attributes. On 8 October a change was merged removing the declarative API from the draft spec, which now focuses on the imperative registerTool() method. The declarative form is still being explored in an explainer. Google said in May that Gemini in Chrome would soon support WebMCP. We found no announcement that it has.

If you do test it, leave the toolautosubmit attribute off your demo form. Without it the browser focuses the submit button and the agent should tell the user to review and send. That keeps a human decision on every demo request, which is the thing a sales team wants to know about.

A worked example (hypothetical numbers)

A software company receives 400 demo requests in a month. Its form rejects any fill completed in under three seconds, and that rule catches 60. Every number here is invented to show the method.

Sorted by the table above, the 60 break down like this:

• 8 carry a valid ChatGPT agent signature.
• 12 arrive with agentInvoked set, from a WebMCP test page.
• 31 come from four IP addresses with disposable domains or repeated text.
• 9 show no proof either way.

The speed rule discarded 20 submissions that carried proof of a user-directed agent, plus 9 unknowns that deserved enrichment. If the 20 qualify at the same rate as the other 340, the rule cost 5% of the month's demo requests. Nobody has published agent lead quality data, so that "if" is the open question. The fix costs little either way: route the 20 and the 9 to sales with a tag, keep blocking the 31, and read the tag's meeting rate after a quarter. Then make sure someone answers them. Silence is still the larger leak, as our piece on demo request follow-up shows.

A seven-step method

1. Pull last month's rejected and spam-flagged form submissions, not only accepted ones.
2. Ask your CDN or bot vendor whether it verifies signed agents. Allow verified agents on form endpoints explicitly.
3. Remove or relax any rule that rejects on speed alone. Keep rate limits per IP range and per email domain.
4. Add a hidden field that records verification status and agent name, and pass it to the CRM.
5. Keep puzzle challenges only on trials, payments and account creation. Claude in Chrome cannot pass them, and Gemini may hand account creation back to the user anyway.
6. Give cloud agent leads their own source value in the CRM, so they do not vanish into direct or unknown.
7. After a quarter, compare meetings per 100 submissions for tagged agent leads against everyone else.

The same discipline applies to crawlers. Our guide to which AI crawlers to allow or block covers the content side, and the email bot clicks piece covers machine noise after the form.

What nobody has measured yet

There is no public study of how agent-assisted leads convert. There is no measured account of how cloud agent sessions appear in GA4. And DataDome's counts are requests on its network, not form submissions on yours. Treat the routing above as a way to collect that evidence, not a verdict. If you want help reading your own form data this way, join the waitlist or write to esh@ethosengine.io.

Questions

Should I block AI agents from my demo request form?

Not by default. Cloudflare classes these agents as directed by an end user, and Google's auto browse aims to ask that user before it submits a web form. Block repeated submissions, spoofed agent identities and disposable addresses. Keep puzzle challenges for costly steps such as trials, payments and account creation.

How can I tell that a form submission came from an AI agent?

Three signals are documented. ChatGPT agent signs every request with HTTP message signatures that your CDN can verify. A form running Chrome's WebMCP origin trial receives an agentInvoked flag on the submit event. Google Cloud Fraud Defense separates verified agent sessions from suspected ones. A user-agent string alone proves little because it is easy to fake.

Will invisible CAPTCHAs let agents through?

Not reliably. Invisible checks score behaviour, and agents behave like automation even inside the buyer's own browser. Cloudflare's Precursor reads pointer and keyboard timing across a session for exactly this reason. If you want verified agents through, write an explicit allow rule for them rather than hoping the score lands on the right side.

Should I add WebMCP markup to my lead forms now?

Only as an experiment. The origin trial runs from Chrome 149 to 156, and the declarative form API was removed from the draft specification on 8 October 2026 and moved back to an explainer. If you test it, leave autosubmit off on demo forms so the buyer still clicks Submit.

Sources

1. DataDome, The AI Traffic Report Q3 2026 datadome.co
2. DataDome, AI Bot and Agent Traffic Trends 2026 datadome.co
3. DataDome, The AI agent identity crisis datadome.co
4. OpenAI Help Center, ChatGPT agent allowlisting help.openai.com
5. Cloudflare Blog, The age of agents, cryptographically recognizing agent traffic blog.cloudflare.com
6. Cloudflare Docs, Verified bots developers.cloudflare.com
7. Cloudflare Blog, Introducing Precursor blog.cloudflare.com
8. Chrome for Developers, WebMCP declarative API developer.chrome.com
9. WebMCP on GitHub, Declarative API explainer github.com
10. WebMCP on GitHub, Remove declarative API from spec (pull request 338) github.com
11. Chromium blink-dev, Intent to Experiment, WebMCP groups.google.com
12. Chrome for Developers, 15 updates from Google I/O 2026 developer.chrome.com
13. Google, Chrome gets new Gemini 3 features, including auto browse blog.google
14. Google Chrome Help, Ask Gemini in Chrome to complete tasks for you with auto browse support.google.com
15. Claude Help Center, Using Claude in Chrome safely support.claude.com
16. Claude Help Center, Manage Claude in Chrome permissions support.claude.com
17. Google Cloud Blog, Introducing Google Cloud Fraud Defense cloud.google.com
18. Google Cloud Docs, Monitor agent traffic docs.cloud.google.com
19. TechCrunch, Meta debuts its Muse AI agent techcrunch.com
20. TechTarget, ChatGPT agent explained techtarget.com
21. HubSpot Knowledge Base, Prevent spam form submissions knowledge.hubspot.com
22. 4Thought Marketing, Bot form submissions are skewing lead scores 4thoughtmarketing.com
23. Pravin Kumar, AI agents filling website forms in 2026 pravinkumar.co
24. Thrive Agency, Are your website forms ready for agentic AI thriveagency.com

NEXT STEP

See where your brand stands.

Your Digital Authority Score, who AI recommends for your target questions, and the placements that close each gap. Your first report is free.

Get your free report →