Cloudflare says bots crossed 50% of web traffic in June. Thales says it happened back in 2023. Both companies track traffic for a living, though they can’t agree on the date because nobody, not even the biggest infrastructure providers, sees the whole internet at once.
Cloudflare’s number is 57.5% of all webpage requests going to bots as of June. Thales, the French security giant, puts bot traffic at 53% for 2026 in its latest Bad Bot Report, but says the actual tipping point came three years earlier. PitchBook analyst Rudy Yang told Fortune the discrepancy comes down to visibility gaps across the web. “There’s a lot of missing pieces of information, but a lot of the observed data suggests the same thing, which is like there is more bot activity,” Yang said. “Agentic AI activity is driving a lot of the browser activity you’re seeing.”
What actually happened
Traffic from agents that take actions, clicking links, filling out forms, completing multi-step tasks, grew 7,851% year over year, according to HUMAN Security’s 2026 State of AI Traffic & Cyberthreat Benchmark Report. Simple scraper traffic grew 597% over the same period. Even Cloudflare’s own CEO underestimated the shift: Matthew Prince predicted in March that bots wouldn’t cross 50% until the end of 2027, more than a year later than it actually happened.
Why it matters for anyone running a budget
Every core marketing metric, ad impressions, conversion rates, bounce rate, was built on the assumption that a visitor is a person deciding whether to buy something. A University of Bamberg study found bot-detection systems misclassify real humans as bots 7% to 15% of the time, before even counting the agents built to avoid detection entirely. Seer Interactive has warned clients since 2023 that agentic browsers can inflate engagement and distort session data in ways standard analytics never catch. If a funnel has looked strange lately, this is a credible reason why.
Businesses are already building for it
Stripe says 70% of the commands hitting its API now come from agents, not people. Alpaca watched agent-driven API calls climb from single digits to 30% of monthly volume in one quarter. Visa, Ramp, Mercury, ElevenLabs, Coinbase, MoonPay, and DoorDash have all built interfaces meant for agents to query directly. Yang calls it self-reinforcing: agent-native infrastructure gives agents more to do, which drives adoption, which justifies building more of it. “No one, as a business owner, is going to want to silo themselves from being able to serve a completely new customer segment,” he told Fortune.
The money hasn’t caught up
PitchBook estimates only about 1% of the $20 trillion in work theoretically handoffable to AI agents is actually happening. Startup Forsy pegs total “agent GDP” at $36 billion a year on a run-rate basis, real, but small next to the traffic shift. The bottleneck is payments, Yang says: “If we don’t have the infrastructure to do proper payments for agents, then agents aren’t buying and selling, and if agents aren’t buying and selling, then they aren’t generating economic activity.”
That gap, between how much of the internet is already non-human and how little of the economy reflects it, is where the next fight over marketing budgets and attribution is going to play out. The crossover already happened. The accounting hasn’t caught up.
