For years, security teams have talked about bot traffic as a background nuisance: scrapers hitting product pages, credential-stuffing scripts testing stolen passwords, the occasional scalping bot cleaning out concert tickets before a human can click "buy."
A new State of Bot & Agent Security Report 2026 from DataDome, a bot and agent trust management vendor, suggests that framing is out of date. Malicious automated traffic isn't a background hum anymore; it's outpacing human traffic by a factor of nine, and it's doing so with a level of reasoning and adaptability that legacy defenses were never built to catch.
The findings, drawn from more than a trillion requests across 75,000 customer sites and vulnerability scans of more than 20,000 popular websites, paint a picture of an internet where the line between "bot" and "attacker" is dissolving into something harder to police: intent.
Between July 2025 and June 2026, DataDome recorded a 124% increase in bad bot traffic—a rate the company says is now growing roughly nine times faster than legitimate human traffic. A few findings stand out.
Scraping remains the largest attack vector, and it's accelerating. It made up 70.9% of bad bot traffic across DataDome's customer base, and grew 185.2% over the study period—a trend DataDome ties to an expanding AI data supply chain, where third-party data resellers and AI agent builders harvest web content at scale for training and other services.
AI traffic is reaching the parts of a website that matter most. In the first half of 2026, AI agents generated 605.6 million requests to login pages, forms, shopping carts, payment flows, and account-creation pages. Login pages alone accounted for 51.7% of that volume. Total AI traffic—the mix of legitimate crawling and outright abuse—grew 82.3% during the period, which is precisely what makes it hard to police: the same crawling behavior that helps a shopper find a product can look identical, at the packet level, to a scraper stealing pricing data.
Scalping is surging. Automated purchasing activity aimed at high-demand inventory jumped 290.7%, with median daily volume nearly quadrupling.
Account abuse hasn't slowed down—it's just gotten more erratic. Fake account creation rose 34.5%. Credential stuffing didn't decline so much as cycle: DataDome observed activity spike, crash by nearly 90%, and then rebound to new single-day highs—a pattern consistent with attackers opportunistically working through fresh batches of leaked credentials rather than running steady, predictable campaigns.
Most sites are still wide open. In DataDome's expanded scan, 65.3% of tested websites stopped none of the 10 bot types evaluated. Only 2.4% stopped all of them, down from 8.4% in 2024 and 2.8% in 2025. The trend line on defense is moving in the wrong direction even as attack volume moves in the worse one.
What separates this moment from the last decade of bot-management arms races is agency. A handful of security leaders who reviewed the findings framed the shift in strikingly similar terms: bots have stopped being scripts that execute a fixed sequence of steps, and started being systems that reason about a target and adapt in real time.
Aviv Nahum, co-founder and CEO of Above Security, put it directly: "These agents aren't limited to executing scripts. This enables AI agents to assess problems, identify solutions, and execute those solutions entirely on their own." Nahum is careful to note that this isn't a story about rogue AI choosing crime; some of the more alarming incidents involved models "deployed in relaxed testing environments or given access they never should have been allowed in the first place." His conclusion is a governance one as much as a technical one: AI permissions and configuration now matter more than they ever have, and CIOs need to start treating AI agents as first-class identities—a new category of insider that has to be inventoried, monitored, and evaluated for whether its behavior makes sense.
[RELATED: The Ungoverned Employee: Why AI Agents Need Governance, Not Just an API Key]
Randolph Barr, CISO at Cequence Security, ties the surge directly to APIs. "Bots go where the money is, and that's APIs," he said, noting that modern bot traffic increasingly skips the frontend entirely, hitting backend APIs with valid logins and well-formed requests that look like ordinary machine traffic rather than an attack. What's changed, in Barr's view, is that attackers who once spent weeks manually mapping an API can now do it in minutes with AI—and that every organization racing to deploy its own agents is simultaneously creating new attack surface: agent-to-API paths, agent-to-agent handoffs, and MCP servers that "nobody's inventoried."
His warning extends to the supply chain itself: MCP registries, agent marketplaces, and OAuth integrations, Barr argues, are shaping up to be the next NPM or PyPI. His recommendation is blunt: treat any AI agent with tool access or internet reach as a privileged actor, give it least privilege and its own attributable identity, and verify isolation rather than assume it—"every one of these incidents started in an environment someone believed was contained."
Diana Kelley, CISO at Noma Security, connects the trend to a broader statistical shift: more than half of all web traffic in 2025 was automated, and a meaningful share of that was malicious. She points to a widening gap between capability tiers; frontier labs like Anthropic actively monitor and disrupt misuse of their own models, but "open-source capabilities are catching up very quickly, and they run on someone else's infrastructure without that monitoring or disruption layer." Kelley also raises a distinction worth sitting with: some of the more startling recent incidents involving frontier models weren't malicious actors at all, but researchers and engineers whose systems weren't properly sandboxed during evaluations. That reframes part of the problem as a safety issue as much as a security one—autonomous systems with internet access producing unanticipated real-world effects, intentional or not.
[RELATED: Anthropic Researcher's Resignation Exposes a Real AI Containment Gap]
Ram Varadarajan, CEO of Acalvio, goes furthest in naming the underlying phenomenon: emergent misalignment, a risk that used to be confined to lab settings and is now showing up as operational risk in production enterprise environments. His read on recent high-profile AI breakout incidents is that they expose a structural weakness in current defenses—classifiers and post-hoc guardrails are probabilistic, not deterministic, and therefore can't offer complete containment. "The model boundary is not robust," he said. Varadarajan's proposed answer is combative: meeting reasoning attackers with reasoning defenders, using machine-speed, model-aware deception to catch attacks that compose novel exploit chains too quickly and too quietly for legacy safeguards to trip.
Strip away the differences in emphasis, and these four perspectives converge on the same core claim: identity-based and signature-based bot defenses were built for a world of static automation, and that world is over. Barr's API-focused warning, Nahum's insider-threat framing, Kelley's supply-chain-of-capability observation, and Varadarajan's call for behavior-based deception are all variations on one idea: you can no longer tell attacker from legitimate user by what a request looks like; you have to evaluate what it's trying to do.
That's also DataDome's own framing for the data: identity-based controls can't distinguish a shopping agent from a scraper when both arrive with clean credentials and well-formed requests. The only way forward, per both the report and the practitioners weighing in on it, is intent-based detection—continuous behavioral analysis capable of flagging an anomaly in real time, rather than a one-time check at the login screen.
A few practical threads run through the report and the commentary alike.
Inventory AI agents like you would any privileged identity. If you can't answer which agents are running in your environment, who owns them, and what they can touch, you can't govern them.
Assume your APIs are the real front door. Bot defenses layered onto the web front end won't catch traffic that goes straight to the API with valid credentials.
Give agents their own identity—never a human's login. Attributability and revocability matter more as agent-to-agent and agent-to-API traffic grows.
Don't assume isolation; verify it. Several of the most talked-about AI incidents this year started inside environments someone believed were sandboxed.
Watch the supply chain, not just the perimeter. MCP registries, agent marketplaces, and OAuth integrations are largely ungoverned today, and multiple sources flagged them as the next likely target class.
The headline number—bad bots growing nine times faster than human traffic—is arresting on its own. But the more durable finding in DataDome's report may be the protection gap sitting underneath it: with fewer than one in 40 tested sites stopping every bot type thrown at them, most organizations are bringing yesterday's defenses to a fight that's already moved on to reasoning, adaptive, machine-speed adversaries.