Bots and AI Agents Overtake Humans in Web Traffic for the First Time

For decades, the internet was built around humans clicking links and reading pages. In 2026 that foundation cracked: according to a report from HUMAN Security, automated traffic, generated by indexing bots and autonomous AI agents, has for the first time exceeded traffic generated by humans.

What the Report Found

HUMAN Security's "2026 State of AI Traffic & Cyberthreat Benchmark" report is based on an analysis of more than a quadrillion digital interactions. The authors note that automated traffic is now growing eight times faster than user-generated activity, and that AI-driven traffic alone rose 187 percent between January and December 2025.

Independently, data from Cloudflare, which monitors traffic on roughly one-fifth of all websites, points in the same direction. Cloudflare CEO Matthew Prince announced at SXSW 2026 that bot traffic has permanently surpassed human traffic and that the gap will keep widening through 2027.

Agents, Not Just Classic Bots

The key shift is not just scale but the nature of the traffic. Classic bots have for years pulled data from sites passively, indexing content for search engines. AI agents behave differently: they log into accounts, browse listings, add products to carts and complete transactions on a user's behalf.

HUMAN Security's data shows that more than 95 percent of AI-generated traffic is concentrated in e-commerce and retail, streaming and media, and travel and hospitality. Agents most often visit product pages and search results, login pages, account dashboards and checkout flows.

Automated traffic is now growing eight times faster than user-generated activity - from the HUMAN Security report, 2026 State of AI Traffic & Cyberthreat Benchmark

The Dark Side of Automation

The rise in AI traffic is not solely the result of legitimate activity by tech companies. The report finds that 37-40 percent of all web traffic consists of so-called bad bots, programs responsible for data scraping, account takeover attempts, carding attacks that test stolen payment card numbers, and spam. The scale of scraping has doubled since 2022 and now accounts for roughly one-fifth of an average site's visits.

The financial sector is especially exposed: it accounts for 24 percent of all bot attacks, and account takeover attempts in the industry rose 400 percent year over year. Attacks targeting the APIs through which AI agents communicate with services made up 27 percent of all bot attacks in 2025.

What It Means for Publishers and Retailers

For website owners and online retailers, this is a real business problem. Infrastructure costs are rising because servers must handle far more requests than the number of genuine customers would suggest, and analytics data on visits and conversions is becoming less reliable as humans and machines blend together in the numbers.

The importance of so-called GEO, optimizing content for generative systems such as ChatGPT, Perplexity or Google AI Overviews, is also growing. For publishers, this means writing in a way that is understandable both to humans and to models that will cite or summarize their articles, often without sending traffic back to the original site.

Regulation Lags Behind

The EU's AI Act has required labeling of AI-generated content since August 2, 2026, but experts say the rule is difficult to enforce, especially for text. Similarly, there are no unified standards for distinguishing traffic generated by legitimate shopping agents from malicious bots, making it harder for site administrators to decide whether to block traffic without also cutting off genuine customers using AI assistants.

For Polish e-commerce companies and publishers, this means having to invest in bot protection previously reserved mainly for large platforms. The growing role of agents in the purchasing process also calls for rethinking marketing metrics, as classic conversion indicators can no longer distinguish a human click from an algorithm buying on that person's behalf.