Artificial intelligence-powered bot attacks on the internet have surged more than tenfold over the past year, according to new research from cybersecurity firm Thales. The 2026 Bad Bot Report reveals that daily AI-enabled bot attacks soared from 2 million to 25 million in a single year.
Rise of Automated Threats
"While this rise in AI-powered attacks is significant, the larger shift in 2025 was the normalisation of AI and automation within internet infrastructure itself," the report states. "AI-driven attacks were observed across a wide range of industries and geographies, highlighting the global scale and reach of AI-enabled automation."
Industries targeted by these AI bots span retail, business, education, and government sectors. The report also notes that bots now account for more than 53% of all web traffic, up from 51% the previous year, continuing the trend seen in 2024 when bots first surpassed human traffic.
Bad Bots on the Rise
Approximately 40% of web traffic now consists of so-called bad bots, which include automated systems designed to steal data or botnets that flood websites with traffic to cause crashes. The United States was the most targeted country for bot attacks in 2025, followed by Australia, the United Kingdom, and France.
The proliferation of malicious AI bots presents new challenges for cybersecurity professionals tasked with defending against evolving threats. "AI is transforming automation from something organisations try to block into something they must also manage," said Tim Chang, general manager of applications and security at Thales. "The challenge is no longer identifying bots. It’s understanding what the bot, agent, or automation is doing, whether it aligns with business intent, and how it interacts with critical systems."
