Thales' Bad Bot Report 2026 dropped with a stark statistic up front: in 2025 bots made up 53% of global traffic, leaving humans (hum.) at 47% — a flip that reads more like a warning than a milestone.
The fastest-growing menace was AI-driven attacks, surging about 12.5 times year-on-year. Analysts point to the rise of "AI agents" as a distinct traffic type — not clearly good or bad, but awkwardly parked between helpful automation and deliberate abuse. APIs are feeling that pressure hard (27% of attacks), and the financial sector is a favourite target: automated actors mimic real usr. behavior to grab data and break into acc.
Old defenses — blocklists, simple rate limits — are losing purchase. Thales urges a move toward automation-management that watches behavior over signatures. Whether you call it oversight, control, or surrender, the net now runs to rhythms set by machines, and that unsettled fact is the report’s central implication.