DataDome Report Finds AI Agents and Bad Bots Shifting Deep into Login and Transaction Endpoints
Summary
DataDome released its 2026 State of Bot & Agent Security Report, analyzing over one trillion requests across 75,000 customer sites alongside tests of 20,000 external domains. The research found bad bot traffic grew 124% year-over-year—outpacing human traffic by nine times—with scraping representing 70.9% of bad bot volume. Concurrently, AI agents generated 605.6 million requests targeting high-value flows like carts, payments, and login pages, while 65.3% of surveyed websites failed to block any evaluated bot types.
Insight
Automated access has evolved beyond superficial public page harvesting at the perimeter into deep transactional and authenticated user flows, rendering binary identity checks inadequate without real-time session intent analysis.
Implication
Web publishers and e-commerce operators relying solely on traditional robots.txt directives or perimeter IP blocks will face increased exposure on authentication, cart, and checkout endpoints as both commercial AI agents and scrapers emulate legitimate user workflows.
Why it matters
As the AI data supply chain drives aggressive scraping and commercial agents access authenticated services, distinguishing benign AI activity from credential stuffing or unauthorized extraction requires evaluating behavior at transactional endpoints rather than simple crawler identification.
Evidence
- Primary source
- Evidence ID:
datadome-blog--f7ce6dbe3d5a34bf