Thomas Seifert: In the next five years, non-human traffic may reach 1000 times human traffic, making humans a negligible fraction of the internet
Cloudflare CFO Thomas Seifert predicts that in the next five years, non-human traffic could reach 1000 times that of human traffic, rendering humans a "negligible fraction" of internet request volumes. This assessment is based on the accelerating use of AI agents, crawlers, automated workflows, and machine-to-machine calls, rather than a simple increase in traditional bot traffic.
Cloudflare's data shows that non-human traffic has for the first time surpassed human traffic in its observed sample: automated requests account for approximately 57.4%, while human requests account for about 42.6%. Previously, the company’s management anticipated that bot traffic would exceed human traffic around 2027, but the expansion of AI agents has brought this crossover point forward; Cloudflare's second-quarter performance communication further projected a long-term gap of 1000 to 1.
The core reason for the multiplication of traffic is not the number of individual AI users, but rather the way agents access information. When a user purchases a camera, they might manually browse 5 websites; however, their AI agent may automatically visit 5000 websites to compare prices, specifications, stock, reviews, delivery, and discount information. A single human search, shopping, or research task can be broken down into hundreds to thousands of machine requests, thus detaching network load from the traditional measure of "human clicks."
Cloudflare believes that the binary classification of "human or bot" is becoming ineffective. The more important questions in the future will be: Is the traffic authorized? Is it aggressive? Does the crawling load correspond to the value returned? Is there ad fraud? Does it come from trusted agents? Does it comply with the access and payment rules set by the website? AI assistants, privacy agents, legitimate automation tools, and malicious crawlers may use similar technical characteristics, but their commercial value and security risks to websites are entirely different.
In market mechanisms, AI model companies, agent platforms, search and shopping assistants are the buyers of new request volumes; cloud service providers, CDNs, cybersecurity companies, anti-crawling service providers, and data authorization platforms sell computing power, bandwidth, verification, access control, and content interfaces. Website operators will incur higher costs for bandwidth, servers, databases, and security, yet may not receive corresponding human advertising revenue; platforms that master bot detection, API billing, content authorization, and rate limiting will benefit, while small publishers, e-commerce sites, and content communities relying on free public web scraping traffic will be under pressure.
Source: Public information