More than half of global web traffic is now generated by bots, accounting for 53 percent in 2025. Within that, malicious bots alone make up 40 percent, nearly matching human activity at 47 percent, according to the Thales Bad Bot Report 2026. What was once a human-dominated internet has rapidly shifted toward automation. As our chart shows, the balance looked very different just a few years ago. In 2018, humans made up 62 percent of web traffic, compared with 20 percent for malicious bots and 18 percent for benign bots. Since then, malicious activity has doubled, while the share of benign bots has declined to 13 percent.
This rise in malicious bot activity reflects a growing cybersecurity challenge. Bad bots are increasingly used to steal login credentials, extract sensitive data, spread misinformation and manipulate digital advertising. Industries such as e-commerce, finance and social media remain particularly exposed, with bot-driven fraud costing businesses billions each year. Notably, roughly one in four attacks now targets APIs, allowing bots to bypass user interfaces and operate at high speed and scale. At the same time, the nature of automation itself is evolving. AI-driven bots and emerging AI agents are accelerating this shift, moving beyond simple scraping to interacting with websites, executing workflows and acting on behalf of users. In 2025 alone, AI-driven bot attacks surged by more than 12 times compared to the previous year, underscoring how quickly this threat is scaling.
However, not all bots are harmful. Benign bots, such as search engine crawlers and chatbots, remain essential for indexing the web and supporting digital services. Nevertheless, their declining share highlights how quickly malicious automation is developing. As AI continues to advance, the growing dominance and sophistication of bots are set to remain a defining feature of the internet.
