Malicious automated internet traffic is growing more than nine times faster than human traffic, while AI bots are increasingly accessing login pages and other sensitive areas of websites, according to a report released Tuesday by a bot and agent trust management company.
The report by DataDome, based on more than a trillion requests across 75,000 customer sites and tests of more than 20,000 popular websites, found that bad bot traffic increased 124% between July 2025 and June 2026.
During the first half of 2026, AI bot requests to website login pages increased more than eightfold.
“Automated traffic isn’t just a volume problem at the edge of the internet anymore,” DataDome Vice President of Threat Research Jérôme Segura said in a statement. “It’s growing fast, and it’s going deeper.”
“For businesses,” he continued, “the challenge is no longer simply identifying automation; it is determining whether that activity is beneficial or harmful.”
AI Fuels Surge in Web Scraping
Segura told TechNewsWorld that several developments likely contributed to the increase in bot traffic.
“Automated scraping tools continued to multiply as demand grew for web data used in AI model training, agent responses and other AI services,” he explained.
“At the same time, anti-fingerprinting frameworks, automated browsers and low-cost bot-as-a-service platforms made sophisticated evasion more accessible,” he added, “and AI is also making these tools faster and cheaper to build.”
According to the DataDome report, scraping, which increased 185.2% during the reporting period, is the largest and fastest-growing attack vector, accounting for 70.9% of bad bot traffic across DataDome’s customer base.
“That 185% year-over-year jump in scraping is agents fetching answers off pages built for people,” explained Jacob Krell, senior director for secure AI solutions and cybersecurity at Suzu Labs, a provider of AI-powered cybersecurity services in Las Vegas.
“AI search, research tooling, competitive intelligence and old scrapers can all generate continuous page fetches,” he told TechNewsWorld. “One human question can turn into requests against multiple pages or sites. That is machine-level demand on human-sized infrastructure, with more room for content theft, price scraping and unauthorized data collection.”
Ensar Seker, CISO of SOCRadar, a threat intelligence company in Newark, Del., asserted that the 185% increase in scraping is significant because scraping is no longer just about copying public website content.
“Automated systems can collect product data, pricing, intellectual property, proprietary research, and other commercially valuable information at enormous scale,” he told TechNewsWorld. “AI has also increased the economic value of large datasets because information can be collected for model training, retrieval systems and competitive intelligence.”
Scraping can harm businesses, he added, because aggressive scraping can create infrastructure costs, distort analytics, and potentially undermine the commercial value of the data and content they produce.
Move From Scripted to Adaptive Bots
Krell fingered agentic browser usage as another development pushing the volume up.
“Models could already plan a sequence of actions,” he said. “Vision models and browser-control tooling made it practical to run that plan against a normal website. An agent can read the rendered page, locate controls, fill forms, and click through a workflow at machine scale.”
Seker added that generative AI has contributed to volume increases by dramatically lowering the technical barrier to building and modifying automation, while headless browsers, residential proxy networks and anti-detection technologies make bots much better at imitating legitimate users.
“At the same time,” he continued, “attackers can automate reconnaissance, scraping, credential testing and transactional abuse at a scale that previously required much more infrastructure and expertise.”
“We are moving from relatively predictable scripted bots toward adaptive automation that can navigate websites, make decisions and change behavior based on what it encounters,” he said.
AI Bots Target Login Pages and Account Access
Seker identified the increase in AI bot requests to login pages as one of the report’s more significant findings.
“Crawling a homepage is primarily an information-access activity,” he explained. “Interacting with authentication pages indicates automation is moving deeper into applications and toward identity, accounts and transactions.”
“That creates a much more sensitive security boundary,” he continued. “The same technologies that enable legitimate AI agents to access an account on behalf of a user can potentially be abused for credential stuffing, account takeover, session abuse or automated fraud.”
“Security teams therefore cannot simply ask whether traffic is human or automated anymore,” he said. “They increasingly need to determine who or what is operating the agent, whether it is authorized, and what it is attempting to accomplish.”
Aviv Nahum, co-founder and CEO of Above Security, a San Francisco-based provider of AI-powered insider risk protection, advised CIOs and security teams to treat AI agents as first-class identities and a new breed of insiders.
“Understanding which agents are deployed and what they’re doing, who manages those tools and what systems or credentials they have access to is essential to identifying risks associated with synthetic insiders,” he told TechNewsWorld. “This enables teams to assess agentic activity and determine whether behavior makes sense or is a red flag.”
“But achieving this level of intelligence requires a new approach that closes the gaps left open by traditional bot management approaches,” he said. “To combat the speed of AI agents, the defensive model must continuously investigate the behaviors of both humans and synthetic agents with built-in triggers that automate intervention when suspicious behaviors are detected.”
Rethinking Authentication for AI Agents
DataDome’s Segura recommended organizations stop asking “is this a bot or a human?” and start asking “what is this visitor trying to do, and does it serve the business?”
“Identity alone cannot answer that,” he noted. “AI agent spoofing rose 45% between February and July 2026, and a separate DataDome study found that 80% of AI agents do not properly identify themselves.”
“The practical answer is to combine verified agent identity with behavioral signals, but the right balance depends on the business,” he added.
Kevin Tussy, CEO of FaceTec, a biometric-identity software company in Las Vegas, argued that agentic AI presents a growing challenge for conventional authentication methods.
“Agents are already running amok,” he told TechNewsWorld. “They can possess and use virtually any modern authentication factor — passwords, passkeys, and email or SMS OTPs. The one thing an agent cannot possess is a live human face.”
“Bots can watch a human solve a Captcha, which takes a person 15 to 30 seconds, and be trained to replicate that behavior perfectly,” he explained. “That’s why Turing-test-style defenses are a dead end. A bot that’s faster and more capable than a human can easily be taught to act exactly like one.”
“What it can’t be taught to do,” he continued, “is present a human face to a camera and complete a 3D biometric liveness detection challenge.”
Read the full article here
