AI-Powered Malicious Bot Attacks Surge 12.5x, Robots Account for Over Half of Web Traffic

French company Thales released a report showing that web robots now account for over 53% of global web traffic, with 40% being malicious. In 2025, AI-driven bot attacks surged 12.5 times compared to the previous year—this is not a short-term trend but a structural shift in web traffic patterns.

AI not only increases bot activity volume but also blurs the line between legitimate and malicious behavior. APIs and authentication systems have become key targets; attackers can bypass front-end defenses to exploit business logic vulnerabilities, steal data, or tamper with processes. The financial services industry is hit hard: bot attacks account for 24% of incidents, and account hijacking makes up 46% of cases.

A Thales application security leader noted that enterprises need to shift from blocking bots to managing automated behaviors. The core challenge now is judging bots' intent rather than identifying them.