AI-driven automation now outpaces human activity on the internet, with 40% found to be malicious, according to a report by Thales.
Global tech firm Thales has published its 2026 bad bot report: bad bots in the agentic age, which highlights the extent to which internet traffic is now generated by AI-driven bots. These bots fall into two categories: ‘good bots’ responsible for legitimate or useful automated tasks and ‘bad bots’ responsible for malicious, abusive or deceptive tasks.
In 2025, automated bots made up more than 53% of all web traffic. Of that, 40% was generated by bad bots, up from 37% the year before. Human traffic, accounting for 47% of traffic, now represents a shrinking share of overall activity.
According to Thales, the figures reflect not only the surge in AI-driven bot activity, but also a fundamental shift in the nature of internet traffic.
A key challenge is that AI bots are increasingly interacting directly with applications and APIs to retrieve data and perform tasks...