DataDome

Total AI traffic increased 82.3% during the study period.

In H1 2026, AI agents generated 605.6 million requests to login pages, forms, carts, payment flows, and account-creation pages, with login pages accounting for 51.7% of those requests.

Between July 2025 and June 2026, malicious automated traffic grew more than nine times faster than human traffic.

Real estate accounted for 17% of agentic browser traffic in early 2026.

E-commerce and retail accounted for roughly 20% of agentic browser traffic.

ChatGPT-User was the second most impersonated agent in early 2026.

Nearly 6 in 10 domains in Latin America were completely exposed to bots.

61% of enterprises with 10,001+ employees were completely unprotected against bots.

In North America and Europe, over 60% of websites lack any bot protection.

Bad bot traffic increased 124% between July 2025 and June 2026.

Scraping accounts for 70.9% of bad bot traffic and increased 185.2% year over year.

Fake account creation grew 34.5%.

In the expanded scan, 65.3% of tested websites stopped none of the 10 bot types evaluated.

Only 2.4% of tested websites stopped all evaluated bot types, down from 8.4% in 2024 and 2.8% in 2025.

Scalping activity increased 290.7%.

Travel and tourism accounted for 15% of agentic browser traffic in early 2026.

DataDome’s network recorded 7.9 billion AI agent requests in January and February 2026, a 5% increase QoQ.

Meta ExternalAgent accounted for nearly 25% of top AI agent traffic on DataDome’s network in February 2026, followed by ChatGPT-User (19.1%) and Meta WebIndexer (14.3%).

Meta-ExternalAgent was the most impersonated agent in early 2026.

Only 2.8% of websites were fully protected against bots in 2025, which is down from 8.4% in 2024.

In Latin America, only 3.5% of websites were fully protected against bots.

In 2025, 5% of AI bot traffic reached checkout flows.

In Asia Pacific, just 1.6% are fully protected against bots.

In 2025, 64% of AI bot traffic reached forms.

LLM crawler traffic rose from 2.6% of verified bot traffic in January to over 10.1% by August.

88.9% of domains disallow GPTBot in their robots.txt files.

Government, Non-Profit, and Telecoms sectors have the weakest protection against bots.

LLM crawler traffic quadrupled across DataDome’s customer base in 2025.

Only 2% of domains with over 30M monthly visits were fully protected against bots.

Travel & Hospitality, Gambling, and Real Estate led the way with the highest combined rates of full and partial protection against bots.

DataDome alone detected nearly 1.7 billion requests from OpenAI crawlers in a single month.

In Latin America, 38.5% of websites were partially protected against bots.

In 2025, 23% of AI bot traffic reached login pages.

In 2025, anti-fingerprinting bots were only blocked by ~7% of websites.

In 2025, fake Chrome and curl bots were detected just 21% of the time.

Latin America had the highest share of protected websites against bots.

Among enterprises with 10,001+ employees, just 2.2% had full protection against bots.

AI bot and crawler traffic now makes up more than 1 in 10 verified bot requests.