The year 2025 witnessed a crucial shift in the balance of internet traffic, according to a report published by the French newspaper Thales entitled "Malicious Bots Report 2026".
This came after bots (robots) accounted for 53% of total activity across the network.
The report indicated that 40% of total internet traffic was classified as "malicious bots," an increase of 3% compared to 2024, while human activity declined to only 47%.
AI agents are driving the transformation
The Thales report attributed this shift to the rapid spread of artificial intelligence agents, which differ from traditional data collection programs or password guessing tools, as they have the ability to interact independently with applications via application programming interfaces (APIs), execute chains of operations, and make decisions that appear to be legitimate requests.
The report indicated that AI-based attacks increased 12.5 times in one year.
Thales' deputy editor-in-chief, Tim Chang, said:
"The challenge is no longer just to detect the existence of bots, but to understand their intentions, what they are actually doing, and whether their behavior is consistent with business objectives."
APIs have become one of the most prominent attack channels, accounting for 27% of all bot attacks. Their danger lies in the difficulty of distinguishing between malicious requests and legitimate application traffic, allowing bots to bypass traditional security systems and target the core business logic of services, such as pricing, rewards, and order processing.
The financial sector remained the most targeted, accounting for 24% of all bot attacks, in addition to 46% of account takeovers.
"The dead internet": From conspiracy theory to reality
The report argued that these indicators reinforce what is known as the "dead internet" theory, which was classified years ago as a conspiracy theory.
The theory is based on the idea that a large part of the activity and content on the Internet is no longer produced by humans, but rather by bots and algorithms that mimic human behavior.
The report noted that automation is already dominating internet traffic, and research from King's College London showed that around 17.6% of new websites by 2025 were created entirely using artificial intelligence, blurring the lines between the "live" internet and artificial digital infrastructure.
What does this mean for businesses?
Thales experts have confirmed that traditional cybersecurity strategies, based on blocking suspicious IP addresses or analyzing user-agent data, have become less effective, stressing the need to adopt more advanced protection models, most notably:
Behavioral analysis: Focusing on what the flow actually does, not just what it claims to do.
Access management: Establish clear policies regarding which AI agents are allowed to interact with company systems.
Protecting APIs and business logic: through continuous monitoring of these interfaces, after they have become prime targets for cyberattacks.
