Recently, DataDome recently released a report on bot and AI agent security. Malicious automated traffic grew more than nine times faster than human traffic between July 2025 and June 2026, with bad bot traffic increasing 124%. Scraping remained the leading threat, rising 185% year over year.
At the same time, AI bots are moving beyond just crawling homepages, targeting login pages 8x more. Yet most websites are not prepared. The external website tests revealed that 65% were completely unprotected against bots.
Key findings include:
- Bad bot traffic increased 124% over 12 months. Scraping accounted for 70.9% of bad bot traffic across DataDome’s customer base and increased 185.2% during the study period. The growth may be connected to an expanding AI data supply chain, in which third-party data resellers and applications building AI agents collect web data at scale for training and other AI services.
- In H1 2026, AI agents generated 605.6 million requests to login pages, forms, carts, payment flows, and account-creation pages, with login pages accounting for 51.7% of that traffic. Total AI traffic increased 82.3% during the study period, bringing more automated traffic into the mix, including both beneficial and harmful activity.
- Scalping activity increased 290.7%. Median daily volume nearly quadrupled, putting continued pressure on businesses to protect high-demand inventory and purchase flows from automated abuse.
- Fake account creation grew 34.5%. Credential stuffing remained cyclical rather than declining, with activity surging, dropping by nearly 90%, and later recovering to new single-day highs. This pattern suggests attackers are opportunistically leveraging batches of leaked credentials.
- Most websites remain unprotected against bots and AI agents. In the expanded scan, 65.3% of tested websites stopped none of the 10 bot types evaluated. Only 2.4% stopped all of them, down from 8.4% in 2024 and 2.8% in 2025.