Artificial intelligence is fundamentally reshaping the internet. AI is not merely boosting the volume of bot traffic on the web; it is transforming its very nature. In 2025, AI-driven bot attacks surged 12.5 times compared to the previous year, according to the recently released Thales' 2026 Bad Bot Report. More importantly, AI agents are now emerging as a distinct third type of traffic, sitting alongside traditional good and bad bots. The report also highlights a major shift towards AI-accelerated automation.
AI agents are interacting with applications and APIs to fetch data and execute tasks, which is increasingly blurring the line between legitimate automation and malicious intent. Much of this AI activity remains unverified, making it difficult for organisations to fully understand the risks.
Bots Outnumber Humans Online
The data shows that bots are increasingly outnumbering humans online. In 2025, automated traffic accounted for more than 53% of all web activity, up from 51% the year before, while human traffic dropped to 47%. What was once tied to specific campaigns like data scraping or credential stuffing has now become a constant, persistent presence across the internet.
APIs, Identity Systems Under Attack
As businesses rely heavily on APIs, attackers have shifted their focus there as well. The report found that 27% of all bot attacks now target APIs, allowing bots to bypass user interfaces and interact directly with backend systems at speed.
These attacks often look legitimate, using valid credentials and structured requests, yet they exploit business logic, steal sensitive data, or manipulate processes. The financial services sector was hit particularly hard, accounting for 24% of all bot attacks and 46% of account takeover attempts.
Internet Is Machine Driven
As AI adoption continues to accelerate, the internet is rapidly becoming fundamentally machine-driven. As per the report, bots have evolved beyond being mere tools for attackers; they now function as active participants within digital systems. They shape traffic patterns, influence key business metrics, and interact with platforms and applications in real time.
The report warns that traditional security methods, which primarily focus on detecting and blocking malicious bots, are no longer adequate.
Essential Business Intelligence, Continuous LIVE TV, Sharp Market Insights, Practical Personal Finance Advice and Latest Stories — On NDTV Profit.