Humans are no longer the default visitor.
London, February 2026.
A growing share of the web is being visited by machines that behave less like blunt crawlers and more like purposeful readers, and the shift is now measurable at scale. Data summarized by WIRED, drawing on analysis from TollBit and network telemetry, suggests that in late 2025 roughly one in every 50 website visits to sampled publishers came from AI scraping bots. The same reporting frames the increase as steep, moving from about one in 200 earlier in 2025 to this new level in the fourth quarter. That ratio matters because it crosses the line from edge case automation into an infrastructural presence that affects costs, analytics, and business models.
The new bot layer is not only larger, it is more strategic, because it targets the pages and formats that are easiest to convert into summaries, answers, and training signals. A key detail raised in the reporting is that a nontrivial portion of these requests bypassed robots.txt, which undermines the informal social contract that once governed crawling behavior. This is not merely a technical dispute, it is a governance dispute, because robots.txt is a normative signal rather than a hard gate. When enough actors ignore the signal, the web’s permission culture shifts from consent to extraction.
Publishers feel the impact first as an economic distortion rather than as a philosophical problem. Bot visits consume bandwidth, compute, and caching resources, and they can inflate metrics that advertisers and partners use to price attention, which forces publishers into defensive filtering that can accidentally block legitimate automation. That defense spiral turns the open web into a series of fortified sites, and the cost of fortification rises as bots become more humanlike in their browsing patterns. The result is a paradox: the more valuable the content, the more expensive it becomes to keep public, because every open page invites unseen machine demand.
The security layer is inseparable from the media layer, because “bots” is a broad category that ranges from benign indexing to fraud, credential stuffing, and hostile automation. Imperva has repeatedly emphasized in its bad bot reporting that automated traffic is increasingly tied to financial incentives, from scraping and inventory manipulation to account takeover campaigns and API abuse. Cloudflare similarly tracks large volumes of automated requests, separating verified crawlers from abusive traffic, and that distinction is now a practical necessity rather than a semantic one. When AI agents and criminal automation share techniques for evasion, the line between “data collection” and “attack surface” becomes easier to cross than most organizations admit.
What makes this moment different is that AI bots are not only collecting data for model training, they are also retrieving fresh content to answer users in real time. That means publishers are increasingly supplying value without receiving the compensating signals they rely on, such as subscriptions, ad impressions, or brand loyalty, because the user’s interaction happens inside an AI interface, not on the site. The Register highlighted a related pattern reported by TollBit, suggesting that human visits declined from one quarter to the next even as automated traffic rose, which intensifies the sense of displacement. In practice, a publisher can see costs rise while revenue signals weaken, and that combination accelerates paywalls, licensing demands, and legal escalation.
A second order consequence is analytical blindness, because web metrics were built for a world where “visit” implied a human reader with some chance of conversion. When a material fraction of visits are bots, the basic signals of demand become noisy, and optimization systems can start learning the wrong lessons, rewarding content formats that bots prefer rather than formats humans trust. This is where the incentives become unstable, because bots often fetch predictable structures, clean markup, and high density pages that are easy to parse. If publishers reshape content to satisfy machine parsing, the web begins to drift toward a machine first aesthetic, and that drift can quietly degrade the human reading experience.
The policy response is beginning to consolidate around three levers: stricter bot detection, explicit licensing, and new norms for attribution and compensation. Large network operators such as Akamai have long treated automation as a managed risk category, and their telemetry increasingly informs how the industry defines abnormal behavior and mitigates it at scale. At the same time, there is pressure building in Europe, where European Union regulatory instincts often favor transparency and market rebalancing when platform behavior shifts incentives against content producers. The deeper trajectory is that the “open web” is being renegotiated under the force of AI demand, and renegotiations rarely stay voluntary once money and power are clearly at stake.
Truth is structure, not noise. / La verdad es estructura, no ruido.