Home
News
Tech Grid
Interviews
Anecdotes
Think Stack
Press Releases
Articles
  • Threat Intelligence

DataDome Report Finds Most Organizations Flying Blind as Agentic Traffic Surges to Billions of Requests


DataDome Report Finds Most Organizations Flying Blind as Agentic Traffic Surges to Billions of Requests
  • by: Source Logo
  • |
  • March 16, 2026

DataDome, the leader in bot and agent trust management, has released The AI Traffic Report: High Volume, Low Visibility, and a Growing Risk, an analysis of the scale, composition, and risks of AI agent traffic in early 2026. The report reveals that AI agents are crawling, indexing, and interacting with websites at a volume most organizations are ill-equipped to handle, creating not just a traffic challenge but an identity crisis and a compounding visibility gap.

Quick Intel

  • DataDome's network recorded 7.9 billion AI agent requests in January and February 2026 alone, a 5% increase over Q4 2025.

  • For one customer, agentic traffic accounted for 9.75% of total traffic over a 30-day window.

  • Meta-externalagent was the most impersonated agent with 16.4 million spoofed requests, followed by ChatGPT-User with 7.9 million.

  • PerplexityBot had the highest impersonation rate, with nearly 2.4% of requests found to be fraudulent.

  • Agentic browser traffic is concentrated in industries with valuable transactional data: e-commerce/retail (~20%), real estate (17%), and travel/tourism (15%).

  • Without accurate classification of AI agents by identity and intent, organizations cannot block or allowlist with confidence.

The Visibility Gap in Agentic Traffic

"Invisible traffic is unmanaged traffic. And right now, most organizations cannot see this clearly enough to do anything meaningful about it," said Jérôme Segura, VP of Threat Research at DataDome. "AI agent traffic is complex. Billions of requests are hitting sites every month, from agents with different identities, different purposes, and varying degrees of transparency about who they are."

The report highlights a core challenge for organizations managing high-traffic websites: without the ability to accurately classify AI agents by identity and intent, neither blocking nor allowlisting can be done with confidence. Sites that allowlist known crawlers based solely on user-agent strings are exposed; a spoofed PerplexityBot or ChatGPT-User string can turn an allowlist into an attack surface.

Key Findings on Agent Volume and Impersonation

DataDome's network recorded 7.9 billion AI agent requests in January and February 2026 alone, a 5% increase over Q4 2025. For one customer, agentic traffic accounted for 9.75% of total traffic over a 30-day window. Known agents are being actively impersonated at significant scale. Meta-externalagent was the most impersonated with 16.4 million spoofed requests, followed by ChatGPT-User with 7.9 million. PerplexityBot had the highest rate of impersonation, with nearly 2.4% of requests found to be fraudulent.

Industry Concentration and Value Assessment

Agentic browsers represent an underappreciated risk, with traffic concentrated in industries holding the most valuable transactional data. E-commerce and retail account for approximately 20% of volume, followed by real estate at 17%, and travel and tourism at 15%. The report emphasizes that high-volume agents are not the same as high-value agents. Meta ExternalAgent accounted for nearly 25% of top AI agent traffic on DataDome's network in February 2026, followed by ChatGPT-User at 19.1% and Meta WebIndexer at 14.3%. One agent may drive referral value while another harvests data with no benefit to the site it visits.

For the full findings from DataDome's report, click here. Follow DataDome on YouTube and LinkedIn for regular updates from Galileo, DataDome's threat research team, and to learn how DataDome's bot protection can help your organization manage the next generation of automated threats.

About DataDome

DataDome delivers real-time bot and agent trust management, providing complete visibility and control over all traffic—whether human, bot, or AI. Named a Leader in The Forrester Wave™ for Bot Management in 2024, DataDome is trusted by enterprises like Etsy, PayPal, and SoundCloud. Acting as a traffic control plane, DataDome's multi-layered AI engine leverages thousands of models and 5 trillion signals daily to analyze intent and stop fraud in under 2 milliseconds, letting legitimate users through seamlessly across websites, apps, APIs, and MCPs. A recognized Leader on G2 across several categories, DataDome stops 20K+ attacks every second, delivering protection that outperforms.

  • Cyber SecurityAgentic AIThreat IntelligenceFraud PreventionAI Security
News Disclaimer
  • Share