Cloudflare says bots now outnumber humans online, far ahead of forecast

The line between audience growth and machine noise just got a lot thinner. Cloudflare CEO Matthew Prince said bots had passed human traffic online for the first time, and Cloudflare Radar now shows about 57.5% of HTTP requests to HTML pages coming from bots versus 42.5% from humans. For agencies still selling raw sessions and top-line traffic as proof of performance, that shift makes reporting a credibility test.

Cloudflare’s own Radar chart is limited to web pages on Cloudflare’s network, not all internet activity, but the scale is still striking. Prince said on June 3, 2026 that the crossover had arrived years before many expected. He had previously predicted it would happen by the end of 2027, which means the milestone landed roughly 18 months early. Before the generative AI era, Prince said the internet was about 20% bot traffic, with Google’s crawler the largest non-human source.

The pace behind that change is now coming from a different class of automation. HUMAN Security’s 2026 State of AI Traffic & Cyberthreat Benchmark Report found automated traffic grew 8x faster than human traffic year over year, monthly AI-driven traffic rose 187% from January to December 2025, and traffic from AI agents and agentic browsers jumped 7,851% year over year. The company said more than 95% of AI-driven traffic in 2025 was concentrated in retail and e-commerce, streaming and media, and travel and hospitality. It also found the median share of traffic attempting a scraping attack approached 20% globally in 2025, nearly double the 2022 rate.

That puts a new burden on agencies and publishers that still optimize around pageviews and bounce rate alone. Cloudflare Radar maintains a directory of verified bots, including transparent search-engine crawlers and monitoring services, and Cloudflare’s documentation says verified bots are legitimate bots it has confirmed, useful for keeping helpful crawlers from being blocked with the bad actors. OpenAI’s crawler documentation gives site owners separate controls for OAI-SearchBot and GPTBot through robots.txt, and says updates can take about 24 hours to show up in its search systems. The practical lesson is simple: bot accessibility, crawler behavior, robots.txt policy, and AI visibility are no longer edge cases.

If machine agents are increasingly acting on behalf of people, the agencies that will be trusted are the ones that can show qualified pipeline, conversion quality, and CRM-verified outcomes, not just traffic charts swollen by automation.