Automated online traffic from bots and artificial intelligence (AI) agents conducting agentic searches for data and purchases grew faster than human traffic in 2025, but Stu Soloman, CEO at Human Security, expects to see much more agentic behavior this year.

Automation grew 23.51% year-over-year across the internet, while traffic from humans increased 3.10% during the same period, according to data released today.

This year, the advertising industry will see a trend from navigation to transactions.

“The traffic seen in 2025 was really focused on the way people use AI tools, like going out to find information on products and prices,” Soloman said. “Now we will see these agents attempt to log in to accounts on behalf of someone.”

Solomon told MediaPost that of the online traffic observed, “about 2% came from agentic behavior.” This means it takes authority to act on behalf of humans, and about “50% of all online traffic we see is no longer human. It is machine-based.”

“That’s amazing, if you think about it,” he said. “It’s easy to get lost in numbers, but it’s so interesting.”

Data in The 2026 State of AI Traffic & Cyberthreat Benchmark Report, released today, shows monthly AI-driven traffic surged 187% in 2025, nearly tripling in a year.

Early adopters of agentic technology — retail and ecommerce, streaming and media, and travel and hospitality — drove more than 95% of this automation, HUMAN Security wrote in a report released Tuesday.

When asked whether the growth of automation concerns him, Solomon said eventually it will “normalize” in time like other technical waves. It will need visibility, trust, and governance — all things happening in the world of AI today.

HUMAN analyzes and mitigates synthetic traffic risks for brands, advertisers, and other companies, and can see how training crawlers for large language models (LLMs) now make up the majority at 67.5% of AI-driven traffic, but its share declined sharply throughout the year as traffic from AI scrapers grew 597%, while agentic AI traffic grew 7,851%.

“A year and a half ago, we never thought about agent-based online activities,” he said. “Then quickly, humanity became comfortable with agents going out and getting information and data.”

Scraping is no longer about going out and getting all the information it can find, but is more about specific data, so there is likely a human entering a prompt asking for specific information, Soloman said. This is indicative of how AI will evolve.

The median percentage of traffic attempting a scraping attack is approaching 20% globally in 2025 — nearly double the rate in 2022.

OpenAI's bots such as ChatGPT User, OAI-SearchBot, GPTBot, and ChatGPT Agent account for approximately 69% of all observed AI-driven traffic by volume.

Meta-ExternalAgent contributes an additional 16%, and Anthropic identities ClaudeBot and Claude-SearchBot at roughly 11%.

The remaining dozens of identified bots collectively represent less than 5% of total volume. This means that access policy decisions about a handful of AI companies have outsized effects on an organization's overall exposure to AI-driven traffic.

Independent of the AI-driven traffic patterns, HUMAN sees and protects organizations from cyberthreats across account takeover (ATO) attacks, carding attacks, web scraping attacks, and fake account creation attacks.

They have always been a “thing,” Soloman said, but the pace in which they attempt the takeover has increased due to AI.

In 2025, ATO volume fell more than 30%, but the percentage of login traffic attempting an ATO saw its biggest jump in years, particularly from EMEA, where it exceeded 13%, compared with less than 3.5% globally

ATO of businesses is one of the most common and profitable attack methods. In 2024, HUMAN flagged nearly 100,000 post-login compromise attempts per customer. In 2025, that number quadrupled to an average of 402,000.

There has been growth of 259% in the number of fake or flagged accounts between 2023 and 2024, and an additional 89% from 2024 to 2025.