Bots Now Outnumber Humans Online And The Internet Was Never Built For This

InnovationVenture CapitalBots Now Outnumber Humans Online And The Internet Was Never Built For ThisByJosipa Majic Predin, Contributor. Forbes contributors publish independent expert analyses and insights. I’m a founder, writer and lecturer focusing on VC funds.Follow AuthorJun 04, 2026, 08:49am EDT--:-- / --:--This voice experience is generated by AI. Learn more.This voice experience is generated by AI. Learn more.GENEVA, SWITZERLAND - JULY 06: Human shaped robot Ameca of British manufacturer Engineered Arts interacts with visitors on July 06, 2023 in Geneva, Switzerland. Some 3,000 global experts from big tech, education and international organisations will gather at a two-day summit in Geneva organised by the United Nations to discuss artificial intelligence in its potential for empowering humanity. (Photo by Johannes Simon/Getty Images)Getty ImagesJust yesterday Cloudflare CEO Matthew Prince posted on X that automated bot traffic had crossed a threshold no one in the industry expected this soon: for the first time in the internet’s history, machines now generate more web traffic than people. Cloudflare’s Radar dashboard puts bots at 57.5% of all HTTP requests to HTML content, humans at 42.5%. Prince had predicted the crossover by end of 2027, but we got there eighteen months early. Bit Vs. Human traffic for 2026. Source: https://radar.cloudflare.com/traffic#bot-vs-humanCloudflareThe internet was architected around human usability and attention, and the entire world of digital advertising, SaaS conversion funnels, publisher monetization, and e-commerce UX sits on that assumption. Imperva’s 2026 Bad Bot Report frames it: companies that continue operating under the assumption that users are human, risk misreading their own systems. For any VC investors this is a potential repricing event across every category that monetizes human attention, as every media asset, ecommerce site and brand was built for humans - not bots. The culprit is not the old wave of scraper bots and search crawlers, but agentic AI. At SXSW in March, Prince described the request-volume asymmetry: a human shopping for a camera visits five websites; the agent doing the same task visits 5,000. HUMAN Security’s 2026 State of AI Traffic report found AI-driven traffic growing eight times faster than human traffic across 2025. Agentic AI, bots acting on behalf of users rather than scraping for training data, made up just 1.7% of automated traffic at the start of last year. By the end of 2025 that category had grown 8,000%. Cloudflare is the clearest near-term beneficiary; the company launched Pay Per Crawl in 2025, letting publishers charge AI scrapers for content access, blocked over 416 billion AI bot requests at site owners' request, and rolled out a Markdown-for-Agents format explicitly designed for machine consumption. Prince has called this transition a platform shift comparable to desktop-to-mobile. The difference is pace: mobile took a decade; this is taking months. Bot management, identity verification, and agent authentication are being repriced in real time. MORE FOR YOUThales's 2026 Bad Bot Report recorded a 12.5x surge in AI-driven bot attacks year-over-year in 2025, with 40% of all internet traffic now classified as malicious bots. The complication is detection: AI agents operating maliciously are behaviorally indistinguishable from agents operating legitimately. HUMAN Security found that only half a percentage point separates the rate of benign automation from malicious automation across its platform. The old binary of 'bot or not' no longer holds, which means the security stack built for that binary is already obsolete. Publishers and advertisers are facing the sharpest exposure. Bot traffic, even when it represents genuine user intent delegated to an agent, does not generate the pageviews, session times, or conversion events that underpin programmatic advertising rates. If a user’s AI assistant visits 5,000 URLs on their behalf, zero of those visits register as a human impression. The entire demand-side platform infrastructure prices inventory on human attention; a majority-bot internet structurally deflates that inventory’s value even as total requests increase. Any venture-backed company whose unit economics depend on CPM, CPC, or conversion-rate assumptions built before 2025 needs to remodel as soon as possible. The crossover is also a forcing function for a redesign of the web’s identity layer. Agents need to be authenticated, permissioned, and rate-limited differently than humans; not blocked wholesale. The winners in the next infrastructure cycle are the companies building trust rails for machines: agent identity, intent verification, and API-native content delivery. Cloudflare’s Radar data is live. Prince’s April 2027 prediction just became a June 2026 fact, and the market is still priced for the old internet. Editorial StandardsReprints & Permissions