Automated internet traffic now exceeds human traffic, a surge driven in large part by the rapid rise of AI-powered bots, which have become the most prominent and impactful form of automation hitting apps and APIs.
This change is a sword with two edges. On one end, AI bots offer tremendous business use cases that save a ton of money and time. On the other, security becomes more of a challenge as AI bots closely mimic human behavior and make it difficult for security controls to distinguish between what’s acceptable and what’s malicious.
With AI traffic dominating, managing your application security effectively requires a shift in how teams identify bot intent and decide which identities to allow, restrict, or block.
It’s no coincidence that bot traffic is peaking right now. AI bots and “agents” are no longer experimental tools. They have become essential to how users and businesses search, collect data, and automate interactions with applications and APIs.
It’s simply way cheaper and easier to perform tasks like continuously crawling, monitoring, and updating content at internet scale through automated agents rather than human effort. Search crawler traffic, in particular, is way up, where Googlebot dominated with 25% of all verified bot traffic in 2025. Personalized agents are also major productivity boosters, fetching and summarizing information from third-party services without any need for context switching.
But while other teams are rejoicing in the benefits of automation, the story is a bit different for cyber defenders. AppSec is under heavy pressure to secure applications that often host critical data without interrupting legitimate workflows. Rising incidents of hyper volumetric DDoS attacks, perpetrated by armies of bots, complicate the landscape as well.
It’s not that all bots are malicious. In fact, the majority aren’t. But even legitimate agents create risk. Often, the risk is in the form of high-frequency access, which puts a strain on the application’s backend.
In many cases, these agents are also granted more access than they actually need. Overly broad permissions are especially common among APIs. Such exposures can quickly turn what is a productive AI agent into a vehicle for data leakage or account-level abuse.
Even without unneeded access, AI agents inherently require high privileges to function effectively. Because these bots are authenticated, persistent, and expected to be present, their high level of access can lead to implicit trust and reduced scrutiny compared to human users.
As a result, application security teams may struggle to detect abnormal behavior, misuse, or gradual drift over time
While they’re not the majority, malicious bots also make up a significant percentage (37%) of bot traffic. What makes them more dangerous in 2026 is not just their volume, but how attackers are using AI to make these bots harder to detect and easier to scale.
Criminals have the same resources as any developer, so they can also deploy bots that mimic human behavior and blend into legitimate traffic patterns. They randomize request timing, rotate identities, follow realistic navigation paths, and interact with applications in ways that closely resemble real users or trusted agents.
APIs have become a primary target in this model of abuse. Nearly half of malicious bot activity is now aimed at APIs, where attackers exploit the fact that APIs are built for automation and often expose high-value functionality.
From an AppSec perspective, the most common outcomes to these threats are account takeover and credential stuffing, large-scale data scraping, and business logic abuse.
The rise of AI-powered automation means that bot traffic can no longer be a secondary concern. In 2026, it must be addressed as a core application security issue, on par with other critical measures like vulnerability management and authentication.
The main shift AppSec teams must make is moving beyond identity-only detection toward behavior and intent-based analysis. With AI crawlers and agents dominating internet traffic, knowing who or what is connecting is not enough. Security controls must evaluate how the automation behaves to determine whether activity is legitimate or shows signs of abuse.
This shift will require security teams to work more closely with engineering and product owners to define acceptable automation and enforce guardrails early.
Another priority has to be protecting APIs, as they are the primary interface for automated access and a high-value target for abuse due to their direct connection to backend systems. Enforcing least privilege, monitoring usage patterns, and protecting business logic are core priorities for preventing API abuse.
AI bot traffic is only at the surface of what it could look like in the coming years. As technology progresses, it is very likely that much of our digital workflows will be fully automated. In this reality, traditional security measures like static WAF signatures and simple bot allowlists will no longer protect modern applications and APIs.
Security teams must adapt now, and build application security programs designed for a world where machines are the primary users.