AI-driven automation is no longer emerging; it is becoming embedded in internet traffic.. The 2026 Thales Bad Bot Report explores how AI-driven automation is transforming the way applications and APIs are accessed, with bots now accounting for the majority of global web traffic. As agentic AI introduces a new class of automated traffic, organizations must navigate an increasingly complex environment where intent is harder to detect, distinguish, and control.
Based on analysis of full-year 2025 bot activity, this report combines insights from Thales Threat Research and Security Analyst Services (SAS) teams, who investigate and mitigate bot attacks across industries worldwide.