AI traffic trends

From August through December 2025, traffic averaged 3.89 billion requests per month. Volume rose to 4.11 billion requests in January 2026, dipped to 3.45 billion in February, and then climbed steadily through April. Traffic reached 6.36 billion requests in May and climbed further to 6.6 billion in June, making June the single highest-volume month in the period and showing the trend still accelerating rather than leveling off.

The first half of 2026 generated 29.65 billion AI agent requests, compared with 23.06 billion in the second half of 2025. Total AI bot traffic grew substantially during the study period, increasing by 82.3% from July 2025 to June 2026.

This growth coincides with the broader adoption of AI shopping assistants, research agents, autonomous browsing tools, and LLM-powered integrations. These tools are becoming embedded in consumer and enterprise products at scale. As a result, interactions that once required a human click are increasingly generated programmatically across the industries represented in DataDome’s customer base.

AI traffic’s share of total web requests grew by nearly 50% over the study period, rising from 1.2% in July 2025 to 1.7% by June 2026. That growth reflects AI agents becoming embedded in consumer and enterprise products, generating automated web requests continuously as a side effect of normal use.

Meta is the dominant source of AI traffic on the web, generating 46.3% of tracked AI traffic. Its two primary crawlers, Meta-ExternalAgent and Meta-WebIndexer, generated 8.54 billion and 5.30 billion requests, respectively. This activity is largely associated with training data collection and AI-powered feed and commerce personalization. Meta’s traffic also increased 164.9% from January to June 2026, reaching 2.65 times its January level.

OpenAI is a distant second at 34.6%. The portfolio includes ChatGPT-User (browsers and agents accessing sites through ChatGPT interfaces), ChatGPTBot (OpenAI’s web crawler), and OpenAI-SearchBot.

Huawei’s PetalBot is the third-largest AI traffic source by company at 5.3%, with 1.59 billion H1 2026 requests across its crawler fleet. For organizations with significant Asia Pacific traffic, it is a material and growing automated presence that warrants classification and policy.

Google shows a smaller AI traffic source than its scale might suggest, at 0.4%. This reflects Google’s strategy of routing AI agent traffic through existing Googlebot infrastructure rather than deploying separate LLM crawlers, meaning Google’s actual AI footprint on the web is likely much larger. Gemini can retrieve content from Google’s existing search index and cached content rather than sending a separate request to every website. As a result, some requests supporting Google’s AI experiences may appear as Googlebot or another Google crawler instead of being identified as Gemini traffic. Google’s AI footprint is therefore harder to measure through direct AI-agent attribution alone.

DuckDuckGo recorded the largest company-level increase in H1 2026 AI bot traffic, with a 423% increase. It reached roughly five times its earlier level, highlighting how quickly company-specific AI activity can scale.

Comet Browser, Perplexity’s own AI browser, accounts for 12.2% of Perplexity’s total bot traffic, alongside PerplexityBot’s 78.2% crawler share. 

The remaining platforms make up a very small share of tracked AI bot traffic. DeepSeek, Manus, Mistral AI, and Microsoft Copilot each accounted for less than 0.1% of H1 2026 traffic, showing how concentrated the current AI bot ecosystem remains.

Across the three categories, AI agent spoofing increased 45% between February and July 2026 across all tracked agents. User-prompted agents rose from approximately 1.4% to 5.6%. Search and answer bots increased from approximately 1.9% to 4.7%. Crawlers and indexers rose from approximately 3.2% to 5.7%.

User-prompted agents saw the largest increase, suggesting that live AI assistants are becoming a rapidly growing spoofing surface. Search and answer bots also experienced a substantial increase, showing that AI search infrastructure is attracting more impersonation attempts. 

By volume, Meta-ExternalAgent remained the most impersonated identity. It accounted for 16.4 million spoofed requests in February and 12.7 million in July. ChatGPT-User ranked second in February, with 8 million spoofed requests, while ClaudeBot ranked second in July, with 4.1 million.

At the individual-agent level, PerplexityBot had the highest spoofing rate in February, at 2.4%. Perplexity-User had the highest rate in July, at approximately 5.1%.

Login pages received the largest share of high-risk endpoint traffic, with 313.0 million requests, or 51.7% of the total. Monthly login-page targeting by AI bots also increased more than 8x (735.8%) across H1 2026, from 11.9 million requests in January 2026 to 99.7 million in June 2026. Login activity also saw a meaningful increase in share of high-risk endpoint traffic year-over-year, increasing from 23% in 2025 to 51.7% in 2026.

The rise in login activity suggests that AI traffic is moving beyond broad content retrieval toward more active, account-based workflows. Login is often the gateway to personalized information and accounts. Legitimate AI agents may use it to retrieve order information, check loyalty balances, or manage account data on behalf of an authorized user. The same endpoint is also valuable to attackers conducting credential testing, account takeover reconnaissance, and session abuse.

Forms remained the second-largest category, with 198.9 million requests, or 32.8% of high-risk endpoint traffic. Their share fell from 64% in 2025, a decline of 31.2 percentage points. This does not mean that the total volume of traffic to forms decreased, but that form traffic grew more slowly than traffic reaching login, cart, and payment endpoints during the 2026 study period.

The shift may reflect a change in how AI agents interact with websites. Forms often support one-time actions, such as lead submission, registration, or data entry. Login pages provide access to reusable account context and a wider range of personalized actions. As AI agents become more capable of navigating authenticated experiences, they may have more reason to log in than to complete isolated forms.

Forms remain an important abuse surface. They support lead capture, customer service, registration, and other business processes. They are also common targets for input testing, lead fraud, form abuse, and automated data collection. Businesses should therefore evaluate not only how much form traffic they receive, but also whether each request reflects an authorized user action or an automated attempt to manipulate the workflow.

Other high-risk endpoints gained share in 2026. Cart traffic rose from 5% to 6.3%, payment-flow traffic increased from 2% to 6.4%, and account creation traffic increased from 2% to 2.8%. Together, cart, payment, and account-creation endpoints received 93.9 million requests, or 15.5% of high-risk endpoint traffic.

These endpoints connect directly to purchasing, stored value, promotions, and customer accounts. The increase in cart and payment activity is consistent with AI agents becoming more active in commerce-related journeys. It also creates additional opportunities for card testing, inventory abuse, promotion abuse, and fraudulent transactions.

The shift from forms toward login, cart, and payment endpoints shows why endpoint type alone is not enough to determine intent. Businesses need behavioral analysis that evaluates the sequence, speed, context, and purpose of each interaction across the full customer journey.

ChatGPT is the dominant driver of AI-referred web traffic by a wide margin, generating 83.4% of all referrals. Monthly referral volume from AI chat platforms peaked at 19.1 million visits in March 2026 and has sustained at approximately 13 to 14 million per month through mid-2026.

These referrals represent a new traffic acquisition channel, and one with different behavioral characteristics than search or social referrals. AI-referred visitors tend to arrive with high intent, having been pre-qualified by an AI answer. They also arrive with session context that may be invisible to standard analytics: the AI may have already retrieved, summarized, or synthesized content from the destination site before the user clicks through.