Automated requests now exceed human HTML-page requests in Cloudflare's telemetry and independent datasets show explosive agent growth, but claims that AI agents alone already dominate all Internet traffic, or will inevitably reach 1,000 times human traffic, go beyond what has been measured.
Cloudflare Says Bots Now Outnumber Human Web Requests
Machines now make most HTML-page requests Cloudflare sees, driven partly by fast-growing AI agents, but that is not the same as most Internet use or bandwidth.
Who's involved
Cloudflare
A San Francisco Internet infrastructure and cybersecurity company that sees a large cross-section of web requests
goal → Keep websites fast and secure while providing infrastructure for AI agents, machine identity, traffic control and paid access to content
Matthew Prince
Cloudflare's co-founder and chief executive, who forecast and then announced the bot-over-human crossover
goal → Explain the rise of machine-to-machine Internet use and position Cloudflare to provide the infrastructure it needs
Thomas Seifert
Cloudflare's chief financial officer, who gave the new five-year projection for non-human traffic
goal → Show investors how agent traffic could increase demand for Cloudflare while warning that efficiency and security must keep pace
AI-agent operators
Companies including OpenAI, Anthropic, Meta and others whose automated systems crawl, search and act on websites
goal → Gain reliable access to web data and online services without legitimate agents being blocked as hostile bots
Website and infrastructure operators
Publishers, retailers, software companies, content-delivery networks and website servers receiving automated requests
goal → Control costs, protect accounts and content, distinguish useful agents from attackers and recover value from machine access
HUMAN Security
Cybersecurity company measuring automated and AI-generated activity across its customer network
goal → Build systems that distinguish useful automation from scraping, account takeover and fraud
Elon Musk
Technology executive who amplified Cloudflare's forecast to a huge X audience on August 9
goal → Argue that AI agents will create far more Internet activity than humans and stress the resulting infrastructure demand
In short
Machines now make more web-page requests than people in Cloudflare's data, forcing websites to prepare for far more automated traffic, heavier server work and harder security decisions. The most likely next step is wider use of systems that identify, limit or charge automated agents before letting them act on websites.
That shift is likely because several large Internet-security companies already see automation near or above half of measured traffic, while AI-agent requests are growing quickly. How far the trend goes is uncertain: Cloudflare's five-year projection of non-human traffic reaching as much as 1,000 times human traffic assumes today's growth continues.
Cloudflare, which helps websites run quickly and securely, says automated systems made about 57.5% of the HTTP requests to HTML pages it observed in June, against 42.5% from likely humans. HTTP requests are the messages browsers and software send to fetch web pages. The figure does not mean machines use most Internet bandwidth or that people no longer dominate video, social media and apps.
How it unfolded
Cloudflare predicts bots will pass humans
Cloudflare CEO Matthew Prince made the shift a public Internet-infrastructure issue during an SXSW interview reported by TechCrunch on March 19. He predicted AI-driven bot traffic would overtake human web traffic in 2027, saying one agent might visit thousands of sites for a task where a person would visit only a few. Less than three months later, Cloudflare said the crossover had already happened, making the outcome more immediate than Prince had expected.
Networks adapt before bots take the lead
The expected rise was already changing network design before bots became the majority in Cloudflare's measure. Cloudflare said identified AI bots were making more than 10 billion requests a week, often querying many pages at once and visiting obscure content that is harder for content-delivery networks to cache efficiently. Operators also had to solve an identity problem: a program could falsely label itself "ChatGPT" or another known service. Cloudflare's Web Bot Auth proposed cryptographically signed HTTP requests so websites could verify who runs a bot instead of trusting an Internet address or self-declared name. That made wider agent access more workable, while showing that traffic controls would need to become more precise.
Cloudflare says machines cross the line
The crossover then arrived far earlier than forecast. On June 3, Prince posted Cloudflare Radar data showing bots ahead of likely-human requests and said his end-2027 expectation had been wrong. Reporting put the split at roughly 57.5% automated to 42.5% human HTTP requests to HTML pages. Prince cautioned that the exact crossover date was hard to fix because bot classification changes as detection improves. Six days later, Cloudflare said daily AI-agent requests on its network had risen more than 1,700% in one year. That made continued growth more likely, but did not mean AI agents themselves were 57.5% of Internet traffic.
Websites shift from blocking bots to managing them
Once machines became the larger group of requests, treating every bot as unwanted became less practical. Cloudflare said more than half of categorized crawler requests were now for AI training, while another large share came from crawlers combining training, search and agent work. Some heavily crawled industries had also seen human traffic fall by as much as 40% in less than a year. Cloudflare split AI traffic into Search, Agent and Training categories so websites could make different choices for each. The emerging system is simple in principle: identify the machine, determine what it wants, then allow, limit, block or charge it. That makes widespread agent use easier to manage, but also turns machine access into a new commercial and security layer of the web.
Cloudflare turns the trend into a five-year forecast
Cloudflare's second-quarter results turned a measured traffic shift into a much larger forecast. On August 6, the company described the Internet as being rewritten for machine-to-machine traffic, while Reuters reported that AI-agent growth was increasing demand for Cloudflare's network and security services. CFO Thomas Seifert said that if current trends continued, non-human traffic could become as much as 1,000 times human traffic within five years. He said humans would become a statistical rounding error because machine traffic would grow, not because people would stop using the Internet. He also said networks would need much greater efficiency and security. Musk endorsed the direction on X, saying AI-agent traffic would "vastly" exceed human usage. The forecast makes the scale of the possible change clear, but remains uncertain because neither Cloudflare nor independent measurements show that a 1,000-to-one ratio is inevitable.
Where things stand
The strongest conclusion is narrower than the headline may suggest. Automated requests have moved above human requests in several large infrastructure datasets, and AI-driven automation is the fastest-growing part. Cloudflare sees bots ahead of likely humans on HTML-page requests; Imperva measured automation above 53% for 2025, while Fastly found bots at 49% in January 2026. HUMAN Security also found automation growing roughly eight times faster than human traffic and agentic AI rising rapidly from a small base. Because each company measures different customers and defines traffic differently, none is a complete count of all Internet activity.
The practical effect is more server work, not simply more bandwidth. Networks must plan for requests per second, many simultaneous connections, weaker cache performance, heavier load on website servers and APIs, more computing and more security checks. Human video use can still account for enormous data volumes even if machines make most HTML-page requests. No verified evidence shows that Starlink, satellite broadband or any single network design is uniquely needed to carry this traffic.
Security and identity are the more immediate changes. Websites increasingly need cryptographic proof of which agent is connecting, behavioral checks that separate authorized assistants from scraping or fraud, and limits and permissions for each agent. They also need records that distinguish the human user, the agent platform and the action requested without unnecessarily exposing private information. HUMAN's findings show why: useful agents increasingly reach login, account and checkout pages while account compromise, malicious scraping and carding attacks are also rising.
What remains unknown is how far the growth goes. Cloudflare's 1,000-to-one five-year figure depends on current trends continuing, and Seifert acknowledged that Cloudflare has previously underestimated or mis-timed the shift. The key tests are whether agent traffic keeps compounding after its early low-base growth, whether requests produce similar growth in data volumes and computing demand, whether Web Bot Auth or rival identity systems become widely used, whether publishers charge agents at meaningful scale, and whether other large network operators reproduce Cloudflare's majority-machine result using comparable definitions.