The number of cyber attacks carried out by artificial intelligence bots has increased more than tenfold over the past year, according to new research from cybersecurity firm Thales.
Daily AI-enabled bot attacks rose from two million to 25 million in a single year, the 2026 Bad Bot Report found. The report noted that while this rise is significant, the larger shift in 2025 was the normalisation of AI and automation within internet infrastructure itself.
AI-driven attacks were observed across a wide range of industries, including retail, business, education and government, highlighting the global scale of the problem. Bots now make up more than 53 per cent of all web traffic, up from 51 per cent the previous year, with around 40 per cent classified as 'bad bots' designed to steal data or crash websites.
The United States was the most targeted country for bot attacks in 2025, followed by Australia, the United Kingdom and France. Tim Chang, a general manager at Thales, said: 'AI is transforming automation from something organisations try to block into something they must also manage. The challenge is no longer identifying bots. It's understanding what the bot, agent, or automation is doing.'
