Malicious Bots Now Exceed Human Web Traffic for the First Time

Key Takeaways

• Automated bot traffic now accounts for more than half of all global web activity, surpassing human-generated traffic for the first time.
• This shift is primarily driven by AI scrapers, large language model (LLM) training crawlers, and autonomous search agents.
• A significant portion (37%) of this automated traffic is classified as malicious, posing substantial cybersecurity risks.
• The rapid increase in bot activity impacts web analytics, content monetization, and necessitates adjustments to internet infrastructure and security models.

Bots Dominate Web Traffic, Outpacing Human Activity

For the first time in internet history, automated bots have officially eclipsed human users in generating web traffic, marking a pivotal and unexpectedly swift change in global online activity. This monumental shift has occurred even faster than many industry forecasts predicted.

The Numbers: Bots Take the Lead

Recent analysis from Cloudflare Radar reveals that bots are now responsible for 57.5% of all HTTP requests directed at HTML pages worldwide. Conversely, human-initiated traffic has diminished to just 42.5%. The data paints an even more pronounced picture in the United States, where bot traffic constitutes a staggering 71.5% of domestic web requests, highlighting the profound integration of AI-driven automation into highly connected markets.

This trend is not isolated to a single data source. The 2025 Imperva Bad Bot Report independently corroborated that automated traffic crossed the 50% threshold for the first time in a decade, reaching 51% of all global web traffic in 2024. Cloudflare’s extensive network, which underpins approximately one in five websites globally, observed the bot-to-human ratio on HTML requests settling at roughly 53% versus 47% by the close of 2025.

Faster Than Predicted: The AI Surge

Cloudflare CEO Matthew Prince had previously projected at SXSW earlier this year that bot traffic would surpass human traffic by 2027. This prediction has materialized significantly ahead of schedule. Prince elaborated on the vast difference in browsing behavior between humans and AI, noting that a human searching for a product might visit five websites, while an AI agent performing the same task could query as many as 5,000 sites.

Welp, that happened faster than I predicted. Thought it would be end of 2027, then early 2027, but agentic traffic growing so fast that bots have now passed human traffic online for the first time in the Internet’s history. https://t.co/2zX5bHdhsa

— Matthew Prince 🌥 (@eastdakota) June 3, 2026

This surge is predominantly fueled by sophisticated AI scrapers, crawlers designed for training large language models (LLMs), and autonomous search agents built on platforms such as OpenAI’s GPT, Anthropic’s Claude, and Google’s Gemini. In 2025 alone, AI-driven traffic experienced a remarkable 187% increase, growing nearly eight times faster than human web activity over the same period.

Security Implications and Industry Adaptations

The rise of bot traffic carries serious security implications. Of all automated traffic, a substantial 37% is categorized as malicious, commonly referred to as “bad bots,” while only 14% are legitimate crawlers. This proliferation of automated activity is fundamentally distorting web analytics for publishers and advertisers, as traffic dashboards increasingly reflect machine behavior rather than genuine human engagement.

In response to these challenges, new frameworks, including pay-to-crawl protocols, are gaining traction. Cloudflare, for instance, has already implemented measures to block AI crawlers by default unless they provide compensation to content creators. As autonomous agents, AI-powered search tools, and LLM pipelines continue to expand, the imbalance between automated and human traffic is expected to widen further. The “agent economy” is no longer a future projection for 2027; it is the current reality of the internet, demanding comprehensive adaptations across web infrastructure, monetization strategies, and security architectures.

What You Should Do

• Implement Advanced Bot Management: Deploy robust bot detection and mitigation solutions to distinguish between legitimate and malicious automated traffic.
• Review Web Analytics: Scrutinize website traffic data with an understanding of bot activity to gain accurate insights into human engagement.
• Protect Content: Consider content protection strategies, such as pay-to-crawl models or API access controls, for valuable digital assets.
• Enhance API Security: Secure APIs against automated abuse, as bots frequently target these interfaces for data scraping or malicious activities.
• Stay Informed: Monitor industry reports and updates on bot traffic trends and evolving mitigation techniques to adapt security postures proactively.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.