Abstract

There is a date that historians of the internet will eventually mark, much like economists mark the 2008 financial crisis or technologists mark the launch of the iPhone: the moment machine traffic crossed 50 percent of all web requests. We passed it, and almost nobody noticed.

Key Points

• The “Machine Majority” is here: We officially passed the 50% mark for bot traffic, and it’s now sitting at 57.5%. This isn’t just background noise; it’s a structural change in the internet’s population.1
• Malicious bots are rampant: About 40% of all internet traffic is outright malicious (scraping, fraud, denial-of-service attacks), and these attacks are growing. APIs are increasingly targeted directly, bypassing traditional interfaces to hit backend systems.1
• “Agentic” AI is the new powerhouse: Beyond malicious bots, autonomous AI agents are browsing the web at massive scale—visiting thousands of pages where a human would visit five.

Cloudflare CEO Matthew Prince posted to X last week with the understated calm of someone announcing a flight delay rather than a civilizational threshold: automated bot traffic has, for the first time in the internet’s history, surpassed human traffic. Cloudflare’s Radar dashboard now indicates 57.5 percent bots and 42.5 percent humans. Prince had predicted the crossover wouldn’t arrive until late 2027. It came eighteen months early.

But Cloudflare’s number, striking as it is, may actually be the optimistic read. The 2026 Thales Bad Bot Report, drawing on analysis of 17.2 trillion blocked bot requests across thousands of domains worldwide, puts automated traffic at 53 percent of all global web traffic in 2025, up from 51 percent the year before. Human activity has fallen to just 47 percent and continues to decline. The gap is widening structurally, not cyclically. This is not an anomalous spike. It is a permanent reordering of the internet’s population.

The Numbers Behind the Numbers

Before you reach for the usual reassurances, that it’s just search crawlers, just scrapers, just the background noise of the web, understand that this wave is categorically different from anything that came before. The headline percentages are alarming enough. What lies beneath them is worse.

Of the 53 percent of traffic classified as automated, 40 percent of all internet traffic is classified as outright malicious. Bad bots engaged in scraping, credential stuffing, fraud, and denial of service. That 40 percent figure marks a three percentage point jump from 37 percent in 2024, and represents the seventh consecutive year of growth in malicious bot traffic. This is not a trend that reverses. The Thales report found that daily blocked AI-enabled bot attacks rose from 2 million to 25 million in a single year, a 12.5x surge year over year.

The architecture of the attack surface is shifting, too. A full 27 percent of bot attacks now target APIs directly, bypassing user interfaces to interact with backend systems using valid credentials and well-formed requests. Financial services bore the brunt: the sector accounted for 24 percent of all bot attacks and a staggering 46 percent of account takeover incidents globally in 2025. These are not nuisance attacks. They are automated monetization operations running at an industrial scale against the most critical digital infrastructure in the world.

The Wrong Kind of Bots

The truly transformative force, however, is not the malicious bot wave. It is agentic AI: autonomous systems acting on behalf of users, navigating the web as a proxy human would, but at orders of magnitude greater scale and speed.

At SXSW in March, Cloudflare’s Prince offered a vivid illustration of the asymmetry: a human shopping for a camera visits perhaps five websites. An AI agent performing the same task visits 5,000. HUMAN Security’s 2026 State of AI Traffic report found AI-driven traffic growing eight times faster than human traffic across 2025. And the agentic category, bots acting for people rather than scraping about them, entered 2025, representing just 1.7 percent of automated traffic. By year’s end, it had grown 8,000 percent.

The 2026 AI Bot Impact Report adds further texture to the velocity: AI and LLM indexing crawlers quadrupled their share of traffic in just eight months, rising from 2.6 percent to 10.1 percent. OpenAI’s GPTBot alone grew 305 percent. Akamai found that 63 percent of all recorded AI bot triggers target the publishing sector, the industry least equipped financially to absorb traffic that generates zero corresponding ad revenue.

Read that last sentence again. The sector most heavily trafficked by the new AI bots is the one whose entire economic model depends on human eyeballs reading content and clicking advertisements. The collision between these two realities is not theoretical. It is already happening in publisher analytics dashboards right now, and most of them don’t have the tooling to see it clearly.

Local outlets like Thailand Business News are directly impacted by these trends, as high domain authority sites often see significant automated scraping and indexing that doesn’t translate into human engagement.

The Architecture of a Human First Web

The internet was architected around human usability and human attention. Every convention that defines it, the hyperlink, the page load, the session cookie, the A/B test, the conversion funnel, the programmatic ad auction, was designed with a person sitting in front of a screen as the assumed endpoint.

The entire edifice of the digital economy rests on that assumption. And the assumption is now false.

Imperva’s 2026 Bad Bot Report puts the existential risk to businesses plainly: companies that continue operating under the assumption that users are human risk catastrophically misreading their own systems. A traffic spike after a press mention may be agents indexing content for retrieval, not readers sharing a story. A conversion rate drop may reflect agents abandoning sessions because they extracted what they needed through an API call. A 40 percent bounce rate may be measuring bots that left in milliseconds, having accomplished their task. The signal is corrupted. Analytics dashboards built for a human majority internet are now measuring something else entirely, and the strategic decisions being made from them are compromised at the source.

The Hydrolix State of AI Bots 2026 report reveals just how deep the perception gap runs: survey respondents estimated AI bots generate approximately 17 percent of their traffic. The actual figure, per Thales, is more than three times that. Companies are flying blind into a machine majority internet with instruments calibrated for a human one.

A Repricing Event in Slow Motion

For investors, the implications are underpriced and accelerating. Every media asset, every e-commerce property, every brand-building exercise of the last twenty years was built for humans, monetized through human attention, and valued on the assumption that human attention would continue to flow through it.

That assumption has now been structurally broken.

Adobe Analytics data from Q1 2026 introduces a genuinely paradoxical data point into this picture: AI-driven traffic to U.S. retail sites grew 393 percent year over year in the first quarter, and those AI-referred visitors are converting 42 percent better than non-AI traffic, spending 37 percent more per visit and browsing 13 percent more pages. A year ago, regular human traffic was worth 128 percent more per visit than AI-referred traffic. That relationship has now inverted completely.

This is not the story of bots destroying commerce. It is more complex and ultimately more destabilizing: it is the story of two internets emerging simultaneously, one optimized for human browsing and attention, and one optimized for machine retrieval and action, with the economics of each diverging rapidly. Publishers and advertisers built for the first internet are being eroded by the second. Retailers who have adapted to serve AI agents well are, for now, benefiting.

The question for investors is whether those retail gains are durable, or whether they represent a temporary arbitrage before AI agents compress margins by enabling perfect price comparison at inhuman speed. The second scenario seems more likely. Salesforce found that during the 2025 holiday season, AI was credited with driving 20 percent of all retail sales and generating $262 billion in revenue through AI-assisted discovery and recommendations. That is an extraordinary concentration of commercial influence accumulating in the hands of AI intermediaries, intermediaries that did not exist as a meaningful category three years ago.

For the media, the calculus is grimmer. A UNESCO report found that generative AI is on track to cause revenue losses of 24 percent for music creators and 21 percent for audiovisual creators by 2028. The ad-funded internet model, the architecture that has sustained open journalism, independent publishing, and free services at scale for thirty years, is being structurally undermined not by piracy or platform shifts, but by a new class of traffic that consumes content without generating impressions.

The internet has always had a free rider problem. It has never had a free rider problem at 57.5 percent of all traffic.

Who Wins. Who Doesn’t?

The clearest near-term beneficiaries are the companies that sit as infrastructure between bots and the content they need. Cloudflare is the most obvious: as the layer through which the majority of global web traffic flows, bot-dominant traffic is not a threat but a product roadmap. Bot management, AI gateway services, machine identity verification, and authenticated traffic infrastructure are suddenly among the most valuable real estate on the internet. Only 33 percent of organizations currently report that their bot detection solutions successfully block more than 50 percent of AI bot traffic, an extraordinary gap in an industry that has been managing bot traffic for over a decade.

Akamai, Imperva (Thales), HUMAN Security, and the emerging wave of AI traffic governance vendors are writing the new rules of the road. The companies that build the border controls between the machine internet and the revenue internet will extract significant rents from everyone who needs to operate on both sides.

For the long tail of publishers, SaaS businesses, and brand marketers whose pricing models, growth strategies, and unit economics assume a human majority audience? The reckoning is already underway. It just hasn’t shown up in earnings calls yet, partly because companies lack the instrumentation to see it, and partly because the human traffic that remains has not yet been fully repriced for its new scarcity.

What Comes Next

There is a version of this story that ends constructively. Agentic AI, if it works as advertised, means humans accomplish more through fewer direct interactions. Our agents go out, retrieve, transact, and return with answers. Human attention becomes more concentrated and intentional, even as it constitutes a smaller share of raw traffic. The web becomes infrastructure for AI, the way electricity became infrastructure for manufacturing: invisible, essential, and no longer requiring human proximity to function.

But that transition requires every system built for the old model to be rebuilt for the new one. Identity infrastructure. Monetization logic. Attribution frameworks. Analytics tooling. Rate limiting. API governance. Content licensing architecture. The list is long, the retrofitting expensive, and the window for incumbents to execute is narrowing.

The internet was never built for this. That is not a complaint. It is an engineering brief and an investment thesis.

The bots are here. They constitute the majority. They are not leaving. The only rational response, for builders, investors, and policymakers alike, is to stop architecting, pricing, and governing the internet as though humans are still the primary user.

Additional Reading from Thailand Business News

Other People are Reading