DataDome Benchmark Finds 65.3% of 21,491 Tested Sites Fail to Stop Automated Bots and Spoofed AI Agents

Summary

In its 2026 bot and agent security report, DataDome tested 21,491 websites across 15 industries against 10 bot types, finding that 65.3% of sites failed to block any test bots and only 2.4% achieved full protection. Over 70% of audited websites permitted access to requests simply asserting user-agent strings for GPTBot or ClaudeBot without verifying authenticity. The study also revealed that organizational size and traffic tiers do not correlate with better defenses, with top 1,000 traffic sites showing a 64.4% failure rate.

Insight

Relying on declarative user-agent matching creates a dual vulnerability: honest bots face crude blocklists while malicious scrapers and spoofed agents trivially bypass controls simply by asserting trusted identity tokens.

Implication

Operators relying solely on robots.txt and naive user-agent filtering will remain exposed to spoofed AI traffic, forcing an industry transition toward network fingerprinting, reverse DNS validation, and behavioral intent analysis across web endpoints and APIs.

Why it matters

As low-cost bot-as-a-service frameworks proliferate, the collapse of identity-based perimeter defenses highlights how unverified user-agent governance fails to protect proprietary content and web infrastructure.

Evidence

• Primary source
• Evidence ID: datadome-blog--42fa450a86dba89a