AI bot traffic surged 187% in 2025, with HUMAN Security analyzing one quadrillion digital interactions and confirming bots now outnumber human users online.

AI Bot Traffic Jumps 187% — Humans Are Now a Minority Online

by
💡 Key Takeaways

  • AI-driven traffic surged 187% in 2025, with automated traffic growing 8x faster than human activity on the internet
  • AI agent traffic exploded 7,851% year-over-year — bots have shifted from reading the web to executing transactions autonomously
  • The behavioral gap between legitimate AI commerce and automated fraud is just 0.5 percentage points — existing security frameworks cannot tell them apart

One quadrillion. That is how many digital interactions HUMAN Security analyzed across the internet in 2025. The cybersecurity firm’s 2026 State of AI Bot Traffic report delivered a verdict that reshapes how we think about the web: automated traffic now grows eight times faster than human activity.

HUMAN Security CEO Stu Solomon framed the shift in stark terms. “The internet as a whole was created with this very basic notion that there’s a human being on the other side of the computer screen, and that notion is very rapidly being replaced.”

The numbers behind that statement are not abstract. AI bot traffic surged 187% from January to December 2025, cybersecurity threats multiplied alongside legitimate automation, and three companies now control more than 96% of all observed AI-driven traffic.

AI bot traffic overwhelming human internet users
Automated traffic is overtaking human activity at 8x the growth rate, fundamentally altering the internet’s operating model — Generated by OpenAI DALL-E 3

The 8x Reversal — How AI Pushed Humans to the Margins

The headline number — 187% growth — demands context. HUMAN Security’s benchmark report reveals that automated traffic grew 23.51% year-over-year in 2025, while human traffic expanded just 3.10%. That eight-to-one ratio is not a blip; it reflects the compound effect of large language models, AI agents, and training crawlers all scaling simultaneously.

The dataset behind these findings is massive. HUMAN’s Defense Platform processed more than one quadrillion digital interactions across 2025, making it one of the most comprehensive traffic analyses ever conducted by a single cybersecurity firm. The sheer scale of the sample lends unusual statistical confidence to the conclusion: the internet’s majority user base is no longer human.

For website operators, the implications are immediate. Metrics like page views, session duration, and conversion rates — all designed around human behavior — lose reliability when a growing share of visitors are machines.

Advertising revenue models that charge per impression face a credibility crisis when impressions increasingly come from bots, not buyers. The entire digital advertising ecosystem — worth hundreds of billions of dollars globally — rests on the assumption that an impression equals a human eyeball, and that assumption is eroding in real time.

7,851% Explosion — AI Agents Move From Reading to Transacting

If the 8x growth rate captures the quantitative expansion of AI bot traffic, the qualitative shift is even more dramatic. The core driver is the rise of AI agents — autonomous systems that do not just crawl web pages but interact with them. In 2025, AI agent traffic grew 7,851% year-over-year.

Unlike traditional crawlers that scrape data passively, AI agents navigate authenticated sessions, compare products, and complete checkouts without human involvement. Agent activity on checkout pages accounted for 2.3% of all agent interactions — a small percentage, but one that was effectively zero just a year earlier. The transition from observation to transaction is underway.

On the data-collection side, AI scrapers — bots that harvest web content at scale — grew 597% in 2025. Training crawlers, which gather data to feed large language model development, still dominate AI-driven traffic at 67.5% of the total.

The competition to build better AI models is, at its core, a competition to harvest more web data — and the traffic numbers make that reality visible. Content creators, publishers, and platform operators find themselves on the supply side of a data economy they never agreed to join, fueling tensions between AI companies and the websites their crawlers depend on.

💡 Related Posts
Harvey AI Hits $11B: Why 100,000 Lawyers Bet on Legal AI Agents

OpenAI 69%, Meta 16% — Who Owns AI Bot Traffic

The surge in AI bot traffic is not evenly distributed. A handful of companies account for nearly all of it. OpenAI’s bots — ChatGPT User, GPTBot, OAI-SearchBot, and ChatGPT Agent — command 69.1% of all observed AI-driven traffic by volume.

Meta-ExternalAgent follows at 16.3%, with Anthropic’s identities (ClaudeBot and Claude-SearchBot) at 10.8%. Perplexity accounts for 2.4% and Google for just 1.4%. The top three operators collectively control 96.2% of AI bot traffic — a concentration that mirrors, and in some ways exceeds, the dominance Google once held over search.

This lopsided distribution carries significant implications. The companies whose bots generate the most traffic are effectively deciding which web content gets consumed, processed, and monetized by AI systems.

For publishers and e-commerce platforms, it creates an asymmetry of power. Their content feeds models they did not authorize, built by companies whose bots they struggle to even identify. The concentration also means that changes in a single company’s bot behavior — OpenAI throttling or expanding its crawlers — can measurably shift the internet’s traffic composition overnight.

AI bot traffic data visualization
Three companies — OpenAI, Meta, and Anthropic — now account for 96.2% of all AI-driven traffic, creating a power structure with few parallels in internet history — Photo by Growtika on Unsplash

Retail, Media, Travel — Where 95% of AI Traffic Lands

AI bot traffic does not spread evenly across the economy. Three sectors — retail and e-commerce, streaming and media, and travel and hospitality — absorb more than 95% of all AI-driven traffic. E-commerce alone accounts for roughly 50% of the total increase, making it the single largest magnet for automated activity on the web.

The breakdown of AI scraper targeting reinforces this concentration. Media and streaming platforms attract 41% of all AI scraper traffic, while retail draws 37%. These are not random targets — they represent the internet’s richest repositories of structured data: product prices, inventory levels, reviews, showtimes, and booking availability.

Retail faces the sharpest threat. Scraping attacks against e-commerce platforms account for 70% of all observed scraping, and the sector has produced more than 440,000 unique threat profiles.

In a world where competitors can replicate pricing strategies in real time via AI scraping, the ability to differentiate on price erodes rapidly. Promotional strategies, inventory decisions, and dynamic pricing algorithms — all of which depend on informational advantages — become less effective when that information is harvested and analyzed by rival bots within minutes of publication.

For any business operating in these three sectors, the operating assumption should be that a significant share of their web traffic is already non-human. Traffic-based advertising models, A/B testing results, and conversion rate benchmarks all degrade in reliability when the underlying data includes an unknown proportion of automated visitors.

The 0.5% Gap — When Security Cannot Tell Friend From Foe

The most unsettling finding in the HUMAN Security report is not about volume — it is about similarity. The behavioral patterns of legitimate AI commerce and automated fraud differ by just 0.5 percentage points. A legitimate AI shopping agent browsing products, comparing prices, and completing a purchase looks almost identical to a fraud bot doing the same thing with stolen credentials.

The damage from the malicious side is already substantial. Post-login account takeover (ATO) attempts quadrupled year-over-year, with HUMAN flagging an average of 402,000 incidents per organization.

Carding attacks — where stolen credit card numbers are tested through automated purchases — surged 250% compared to 2022. AI has accelerated not just defense capabilities but also the sophistication of attack tools, creating an arms race where both sides deploy increasingly indistinguishable automation.

Cybersecurity lock on keyboard
With only 0.5 percentage points separating legitimate AI agents from fraud bots, traditional security models face a fundamental challenge in distinguishing commerce from crime — Photo by FlyD on Unsplash

HUMAN Security VP of Threat Intelligence Lindsay Kaye emphasized the scale of the challenge. “Organizations need unparalleled visibility into agentic and emerging technologies to understand benefits and risks.” The security paradigm must shift from blocking bots to classifying them — distinguishing the AI agent that drives revenue from the one that drains it.

This creates a genuine dilemma for every e-commerce platform. Block legitimate AI shopping agents, and you forfeit sales from a rapidly growing commerce channel.

Allow all automated traffic through, and fraud losses escalate. The 0.5% gap means there is no clean technical line between benign and malicious bots, forcing companies to invest in behavioral analytics far more granular than anything current security systems provide.

💡 Related Posts
White-Collar AI Automation: 18 Months, 75% Unemployment Gap

2027: Full Reversal — The Dead Internet Becomes Real

HUMAN Security is not the only organization tracking this trajectory. Cloudflare CEO Matthew Prince told an audience at SXSW in March 2026 that bot traffic will surpass human traffic entirely by 2027. Coming from the head of a company that intermediates a substantial share of global internet infrastructure, the prediction carries the weight of network-level data rather than speculation.

Solomon offered what may be the most important reframing of the entire report. “This notion of machine bad, human good just is not realistic. You have to live in a world where machines are acting on our behalf.” That framing rejects the binary lens through which most organizations still view bot traffic.

That statement is not a threat assessment — it is a design principle. The internet was built for humans, but its next chapter will be written by machines acting on human instructions.

The organizations that survive this transition will be those that stop trying to block bots entirely and instead build systems that can distinguish, classify, and manage automated traffic at scale. Authentication, pricing, content delivery, and fraud detection all need to be redesigned for a web where the majority of visitors are not people.

Two metrics should be on every security and strategy team’s watchlist going forward: the quarterly ratio of automated-to-human traffic in HUMAN Security’s benchmark reports, and the rate at which AI agent traffic penetrates new industry verticals beyond retail, media, and travel. The reversal is not a forecast — it is already the operating reality of the internet in 2026.

References

Stay Ahead of the Curve

Get the latest insights on AI, tech, and markets — delivered in both Korean and English.

Explore More Posts