Reported Measurement & EconomicsAccess ControlsPlatform & Ecosystem DataDome Blog ·

DataDome 2026 Security Report Highlights Rising Scraping Volumes and AI Agent Spoofing

Open source ↗

Summary

DataDome released its 2026 State of Bot & Agent Security Report based on an analysis of over 75,000 customer sites and tests against 21,491 websites between July 2025 and June 2026. Bad bot traffic surged 124% year-over-year, driven heavily by scraping, which represented 70.9% of bad bot volume. Additionally, AI agent spoofing rose 45% between February and July 2026, while over 70% of tested websites permitted spoofed AI crawlers past defenses without challenge.

Insight

Traditional identity-based controls like user-agent matching (such as claiming to be GPTBot or ClaudeBot) and static allowlists are failing as automated tools increasingly spoof recognized crawler identities and penetrate deep transactional endpoints, including login and checkout flows.

Implication

Web publishers and site operators relying solely on robots.txt rules or unverified user-agent filtering will face higher rates of unverified scraping and credential stuffing, forcing a transition toward behavioral and intent-based traffic verification.

Why it matters

As the AI data supply chain expands and agentic browsing moves into transactional workflows, the inability to distinguish between legitimate user agents and unauthorized spoofed bots poses severe operational, security, and content governance challenges.

Evidence