AI agents outperform humans: bot activity now exceeds that of humans online

The problem is that the internet was not built with this in mind. The architecture of the web – from HTTP protocols to CAPTCHA security measures, from graphical interfaces to session cookies – assumes there is a human user on the other side of the screen. AI agents are putting a system designed with completely different logic under strain.

As a result, traditional captchas are already obsolete: the most sophisticated bots can solve them better and faster than the average human. Behavioural analysis, which used to distinguish between bots and humans based on mouse movements and reaction times, is struggling to keep up with systems trained to emulate human behaviour.

Website operators face a strategic dilemma. Blocking bots means forgoing traffic and potential conversions. Allowing them free rein exposes sites to rising infrastructure costs and distorts every metric relating to engagement. A third way — charging bots for access — is emerging, but it requires infrastructure that most sites do not possess.

This development is fuelling a debate that has been circulating for years in the more technical corners of the internet: the so-called “dead internet theory“. The idea, which began as a provocative hypothesis, argues that much of the content and interaction online is already generated by machines, with humans reduced to unwitting spectators of a spectacle orchestrated by algorithms.

With Cloudflare’s data to hand, the theory loses its air of conspiracy and takes on a more concrete form. If the majority of web requests come from automated systems, how much of what we see online is actually generated by people? Are comments on social media, product reviews and clicks on newsletters all genuine?

Adam Tryan, CEO of the media company Workweek, recently stated that 98% of clicks in B2B newsletters come from bots. The metric of click-through rate, on which digital marketing has built entire strategies, risks being, in his words, “complete bullshit”, utterly useless.

The implications extend far beyond marketing. For cybersecurity, predominantly automated traffic means broader attack surfaces and malicious patterns that are more difficult to distinguish from legitimate ones. For the media, artificially inflated metrics distort editorial and advertising decisions. For academic research, it is becoming increasingly difficult to distinguish genuine human behaviour from simulations.

The platforms are taking action. In May, Instagram carried out one of the largest bot-cleansing operations in its history: Taylor Swift lost six million followers overnight, and Kylie Jenner lost seven and a half million. This was an implicit admission of just how inflated the figures had been up to that point.

In his post, Matthew Prince did not come across as triumphant. Rather, he seemed like a man who had just seen his prediction come true three quarters ahead of schedule, whilst at the same time realising that the internet his company protects might never be the same again.

The question is no longer whether bots will dominate the web. They already are. The question is how to rebuild a digital infrastructure that works for both – humans and agents – without the former becoming irrelevant in the system they have created.