The data account World of Statistics posted that humans account for only 38.5% of internet traffic, while the remaining 61.5% comes from non-human sources such as bots, attack tools, and cryptocurrency-related programs. This ratio is not from a new census in 2026, but rather an old segmentation that has been repeatedly forwarded in security reports like those from Barracuda: humans make up about 30-40%, with automation accounting for the rest.

Barracuda previously reported that malicious bots alone account for about 39% of total traffic, while beneficial bots (like search crawlers and social scrapers) make up about 25% of automation, resulting in humans being a minority. North America is identified as a high source of malicious bots, at about 67%, Europe around 22%, and Asia about 7.5%. Researcher Simon Hegelich from Munich pointed out that advanced bots can generate thousands of pieces of content daily and mimic humans, making it difficult for ordinary users to distinguish.

Updated vendor data has framed the question of whether humans have become a minority as a methodological issue. The Thales/Imperva "2026 Malicious Bot Report" states that according to application layer telemetry for the entire year of 2025, automation exceeds 53%, with humans around 47%, and malicious bots alone account for about 40%, up from 37% the previous year; that year, approximately 17.2 trillion malicious requests were intercepted, with 27% of bot attacks targeting APIs and 21% targeting business logic, while AI-driven bot attacks increased about 12.5 times year-on-year. HUMAN Security claims that the growth rate of automation is about eight times that of human traffic, with AI-driven traffic increasing by about 187% in monthly volume within the calendar year of 2025, and proxy and proxy browser traffic increasing by about 7851% year-on-year.

Cloudflare Radar gives a lower bot proportion across all network requests: around 35% for bots and about 65% for humans around August 2026. However, HTML requests on the same network are separated—Shoal Research states that about 60% of HTML requests on Cloudflare come from bots, with humans around 38.2%, closely aligning with the human figure in this statistical post. Cloudflare's CEO Matthew Prince had predicted that bots would surpass humans by 2027, later stating that proxy traffic had pushed the crossover point to mid-2026; reports have placed the proportion of proxy AI requests at about 57%, with humans around 43%. Overall bot activity in North America has been marked at about 68.6% in regional segmentation.

The intensity of scraping has rewritten the publishing ledger. Cloudflare observes that training-type scraping accounts for nearly 80% of AI crawler activity; the share of GPTBot has risen from about 4.7% to about 11.7% within a year, while ClaudeBot has increased from about 6% to nearly 10%. Shoal states that ClaudeBot averages about 4200 pages per revisit, higher than the revisit density of traditional search crawlers. Pew Research shows that AI summaries have reduced click-through rates from about 15% to about 8%. Cloudflare plans to default to blocking training and proxy-type crawlers on new domains while allowing search-type crawlers.

The market mechanism is a struggle for the definition of traffic. Buyers aim to protect the security budgets of login, checkout, and APIs, as well as to prove to advertisers that "there are still people watching"; sellers are CDNs and anti-bot vendors packaging automated traffic as protective products. Funds are flowing from website operating costs to challenges, fingerprinting, and pay-per-use agreements (including HTTP 402 and stablecoin experiments). Beneficiaries are security companies that can sell bot proportions as subscription reasons, and AI applications that retain users by using summaries; those under pressure are sites relying on click revenue and the infrastructure that must serve humans, benevolent crawlers, and attacking bots simultaneously. The event-driven nature is that the old ratio is broadcast again, rather than a new census being released.

The same internet is divided by three metrics: humans can still make up more than half of all network requests, but have become a minority at the application and HTML layers. Therefore, 38.5% is more like a shareable label rather than the only measurement.

Source: Public Information