605.6 million — the number of automated requests generated by AI agents to login pages, forms, carts, payment flows and account-creation pages in the first half of 2026, according to a DataDome report cited in Global News. For organizations that rely on those front-door interactions to authenticate users and process payments, the volume is a blunt indicator of how much of the internet’s traffic profile is now being driven by machines rather than people.
Scale and composition of AI-driven traffic (H1 2026)
DataDome’s report finds total AI traffic rose 82.3% during the study period ending June 2026, bringing both beneficial and harmful automated activity into greater prominence. Of the 605.6 million AI-agent requests counted to sensitive web endpoints in H1 2026, login pages accounted for 51.7% of that traffic. That concentration puts authentication endpoints at heightened risk of abuse simply through volume: more than half of AI-agent requests targeted the entry points applications use to verify or create user identities.
Bad bots and scraping: rapid growth and possible supply-chain links
“Bad bot” traffic increased 124% over a 12-month span, the report says, with scraping representing 70.9% of that malicious activity and surging 185.2% year over year. DataDome links this escalation to an expanding AI data supply chain, noting that third-party data resellers and applications building AI agents are collecting web data at scale for training and other AI services. In short, scraping is no longer a narrow nuisance — the report portrays it as a major feedstock for automated systems that in turn generate more automated requests.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadScalping, fake accounts, and credential stuffing patterns
Several specific attack categories showed stark movement. Scalping activity jumped 290.7%, and median daily scalping volume nearly quadrupled, the report states — a profile that increases pressure on businesses selling limited-availability items and on the purchase flows that serve them. Fake account creation rose 34.5% in the same period. Credential-stuffing activity did not decline steadily; instead, the report documents cyclical behavior where attacks surged, dropped by nearly 90%, and later recovered to new single-day highs — a pattern consistent with attackers opportunistically using batches of leaked credentials.
Defensive posture: most websites remain unprotected
Despite the surge in automated threats, defensive coverage lags. In an expanded external scan, 65.3% of tested websites stopped none of the 10 bot types evaluated. Only 2.4% of sites stopped all 10 — a proportion that has fallen from 8.4% in 2024 and 2.8% in 2025. Put another way: the majority of the sites probed by the report had no observable measures blocking the evaluated bot behaviors, even as AI agents increased requests to high-value endpoints such as login and payment pages.
What this means for technologists, enterprises and policymakers
- Technologists and security teams: The report’s numbers — 605.6 million AI-agent requests in H1 2026 and a 124% rise in bad bot traffic — are concrete indicators to monitor. Teams will be watching login-page and form traffic patterns closely, given that login pages attracted 51.7% of the counted AI-agent requests.
- Enterprises and procurement leaders: The 290.7% increase in scalping and the near quadrupling of median daily scalping volume suggest procurement and e-commerce owners should be concerned about automated abuse of purchase flows and inventory — the report explicitly links scalping trends to intensified pressure on high-demand inventory.
- Policymakers and regulators: The report highlights a possible connection between scraping growth and an expanding AI data supply chain involving third-party resellers and applications. Regulators and oversight bodies may focus on how large-scale data collection feeds into automated systems that then generate further harmful traffic.
The DataDome findings sketch a simple but unsettling arc: automated actors are increasing both in number and ambition, and the most common defensive posture on the public web is still insufficient. With login pages alone representing more than half of the 605.6 million AI-agent requests to sensitive endpoints in H1 2026, the report leaves a practical question for operators and overseers alike — who will harden the internet’s most frequently attacked doors, and how quickly will those protections close the gaps the data now exposes?
