AI-driven bot attacks surged 12.5x according to Thales bad bot report

Bots now dominate the internet, accounting for over half of all traffic, with 40% classified as malicious.
AI is erasing the line between legitimate and malicious activity, making intent – not identity – the new security challenge. APIs and identity systems are primary targets, with attackers bypassing front-end defenses to exploit core business logic at scale.

Thales today released the 2026 Bad Bot Report: Bad Bots in the Agentic Age, revealing a fundamental shift in how the internet operates, as AI-accelerated automation becomes a defining feature of modern digital infrastructure.

The findings highlight three major structural changes: the emergence of AI agents as a new category of internet traffic, the dominance of automated activity over human interaction, and the rapid expansion of attacks targeting APIs and identity systems that serve as the backbone of digital business.

AI Is Redefining Internet Traffic and Security

The report shows that AI is ...