Cloudflare tracks web traffic across its global network. On June 3, 2026, CEO Matthew Prince posted new figures showing automated systems generated 57.4% of HTTP requests, against 42.6% from people, according to Cloudflare Radar. Prince had told an SXSW audience in March that the crossover would not arrive until 2027. It came more than a year early.
Decodo’s own research points to the same driver. AI tools read the web at machine speed, and that speed explains most of the new bot traffic.
AI-driven traffic grew about 187% across 2025, roughly 8 times faster than human traffic growth, per HUMAN Security’s 2026 State of AI Traffic report. Agentic AI traffic, software that acts on a person’s behalf, grew about 7,851% year over year in the same report.
A person shopping for a camera might open a few websites. An AI agent doing the same task can query thousands of pages, turning one user request into thousands of page fetches. That gap in scale is what pushed bots past humans.
What Decodo’s Data Shows About Who Is Behind The Traffic
Automated traffic splits into three groups. Training crawlers collect data to build and update AI models, and make up the largest slice. AI agents and fetchers pull live pages to answer a prompt or complete a task. Malicious bots run scraping, credential stuffing and fraud.
Decodo’s research puts the malicious share at roughly a third of all bot traffic, leaving about two-thirds doing legitimate work, like search indexing and AI answers.
A handful of companies run most of that legitimate traffic. OpenAI’s bots account for about 69% of observed AI-driven traffic by volume, Meta about 16%, and Anthropic about 11%, per HUMAN Security. Three sectors absorb more than 95% of that traffic; retail and eCommerce, streaming and media, and travel and hospitality.
Retail and eCommerce alone made up 62.5% of training crawler traffic.
Decodo’s Network Data On Where The Bots Go
Decodo tracked its own network traffic over six months across more than 195 countries, and the pattern lines up with the global figures. Search engines and AI assistants generate about 72% of the traffic Decodo observes.
Retail and eCommerce sites make up about 13% of successful requests, while travel, airlines, and cargo sites trail far behind at 0.4%. News, real estate, jobs, and finance sites each account for a fraction of a percent. Decodo’s data points to the same conclusion as the country figures below: bot activity follows commercial value, not traffic for its own sake.
The same commercial logic shows up at the country level. Decodo’s analysis of Cloudflare Radar data found that six of the top 60 traffic source countries already run more bot traffic than human traffic, led by markets with dense cloud infrastructure rather than large populations.
- Iran leads at 81.4% bot traffic
- Singapore follows at 73.7%
- Ireland sits at 71.1%
- The Netherlands runs 61.3% bot traffic
- Finland runs 56.8%
The United States originates 53.5% of worldwide bot traffic and runs 43.6% of bot traffic at home. Germany, the second largest source, runs 45% domestically. Inside the US, Virginia alone accounts for 27% of national bot traffic, followed by California at 9.9% and Oregon at 7.7%.
Traffic carries the flag of the data center, not the person behind the request. A reader in Lagos can still route through a server in Ashburn or Frankfurt, and show up in the data as German or American traffic.
More from Cybersecurity
- SpyCloud 2026 Identity Threat Report Finds Non-Human Identities Are Now The Leading Path Into The Enterprise
- Your Smart TV Might Be Eavesdropping: Behind The Security Flaws Compromising Your Living Room
- Reflectiz Launches Agentic Pentesting For Websites: Up To 10x Coverage Vs Conventional Pentests
- Hackers Are Hijacking Brazilian Government Websites To Run a Global Gambling Scam
- Hackers Shut Down A UK Power Plant – Are Cyberattacks Moving From Data Theft to Physical Interruption?
- ChatGPT Can Now Read Your iMessages – Does This Break The Implicit Contract Of End-to-End Encryption?
- Vega Introduces Detection Skills A New Open Standard For AI Reasoning in Agentic Cyber Defence
- OpenAI Launches Private Misuse Tracking – How Can It Detect Misuse Without Storing Sensitive Enterprise Data?
Why Blocking Every Bot Backfires
AI assistants and shopping agents now decide what customers see online, and blocking bots removes a business from those results. In 2025, 77% of agentic AI activity hit product and search pages, with smaller shares on account pages, authentication, and checkout, per HUMAN Security.
Identity is part of the problem. Bots can hide their name, and in August 2025 Cloudflare accused AI firm Perplexity of disguising its crawler as a browser.
Some publishers have responded by charging bots for access instead of blocking them outright. The shift rests on a simple ratio: pages taken against visits sent back. Google crawls about five pages for every referral it sends. Some AI crawlers pull thousands of pages for each visit they return, which is why publishers increasingly price access instead of giving it away.
Vaidotas Juknys, CEO at Decodo, said blocking every bot is “like locking your storefront because some visitors don’t buy.” He added that the agents crawling a site today might be how customers discover it tomorrow.
What Businesses Should Do Next And Where The Web Scraping API Fits
The response depends on the team, and each one needs a different move.
Product And Engineering Teams
Teams building AI agents need reliable, real-time access to web data across regions. An agent that cannot reach a site, or reads a blocked or geo-shifted version of it, returns a worse answer. Decodo built its Web Scraping API for exactly this problem, giving agents, LLMs, and tools the ability to fetch real-time results across more than 195 countries.
The API configures scraping power per request, so a team pays for the capabilities a job actually needs, instead of a flat rate regardless of complexity. Routing requests through local IPs matters just as much, since a product page in Madrid can differ from the same page in Chicago.
An agent that always exits through one region reads one version of the web and misses the rest. Fetching the page a local user would see is what keeps an agent’s answer accurate.
Vaidotas Juknys added, “Reliable access to public web data has become as fundamental as cloud computing.” For teams building on AI, that access is now doing the heavy lifting.
Marketing And Analytics Teams
Agent traffic is a new audience showing up inside your analytics. Tag automated traffic separately from human traffic, and read AI referral activity on its own instead of folding it into session counts. Track which AI tools send the most agent visits.
Security Teams
The job shifts from blocking everything to sorting good bots from bad ones. Set rules based on verified identity and behaviour, not user agent strings alone. Allow crawlers that drive discovery, rate limit unknown traffic, and stop patterns tied to credential stuffing and scraping fraud.
Bots now send more web requests than people do. Iran, Singapore, and Ireland already run bot majorities and AI-driven traffic keeps growing about 8 times faster than human traffic. Decodo’s own network data shows the same pattern: bots concentrate where the commercial value sits. Businesses that sort bots instead of blocking them and give their own agents reliable access through tools like the Web Scraping API stay visible in AI search results.
