Malicious Bots and Web Predators: How Automated Attacks Are Reshaping Internet Security

As artificial intelligence becomes ubiquitous, a silent yet growing threat looms over the web ecosystem: malicious robots — “bad bots” — becoming more numerous, automated, and increasingly hard to detect. According to the latest 2025 Imperva Bad Bot Report, automated bot traffic has reached a symbolic threshold: for the first time in a decade, it surpasses human traffic, accounting for 51% of global web traffic. Among them, 37% is considered malicious.

But what do we really know? How do these bots operate? And, above all, what does this shift mean for businesses, online content… and more broadly, for the health of the Web?

From useful automation to silent armies: the evolution of bots

Historically, some bots served legitimate purposes — search engine crawlers, price comparators, indexing tools, etc. But things have changed. In recent years, the rise of AI and large language models has enabled the development of “intelligent” bots capable of mimicking human behavior, navigating complex sites, interacting with APIs, and bypassing traditional protections.

According to the 2025 Global Bot Security Report from DataDome, traffic from LLM crawlers and AI-powered web agents has quadrupled in a matter of months among their customer set — confirming that these are no longer primitive scrapers but dynamic agents capable of executing JavaScript, managing authenticated sessions, filling forms, and even interacting with critical services.

A silent tsunami: alarming numbers

The recent data is staggering. Imperva reports that in 2024 bots automated accounted for 51% of global traffic — a historic turning point. Among them, 37% are labeled malicious “bad bots”.

Meanwhile, DataDome audited nearly 17,000 websites across 22 industries, and concluded that only 2.8% of those domains were “fully protected” against bots as of 2025 — down sharply from 8.4% in the prior year. This means an overwhelming majority remain vulnerable, often without realizing it.

In other words, the rise of malicious bots is not matched by an equivalent rise in defenses — at least not universally.

What do malicious bots do?

Their utility for malicious actors is diverse — and often harmful:

• Massive scraping of content (texts, images, private or public data): some bots collect vast amounts of data to train AI models, to exfiltrate sensitive information, or to resell content — often without consent.
• Automated app analysis/vulnerability scanning: bots can explore hidden endpoints, test injection flaws or weak configurations — simulating legitimate user behavior.
• Fraud, API abuse, impersonation, resource exploitation: credential stuffing bots, automated checkout bots, bots sending massive requests (DoS-like), bots abusing forms or critical endpoints, etc.

In the current context, the availability of AI tools makes entering the “malicious bot ecosystem” much easier — increasing the pool of potential attackers, including less experienced ones.

Why is containment so difficult?

Several factors complicate defense:

• Traditional defenses are outdated: many websites still rely on older methods — “robots.txt”, simple user-agent filters, IP blocking — which are inadequate against “human-like” bots capable of simulating real browsers, rotating IPs (via residential proxies), varying behavior.
• Scale and volume: with billions of automated requests, server resources get saturated, performance and logging suffer, infrastructure costs rise, etc.
• Fragmented security practices: many organizations — especially SMEs, small players, open-source projects — remain “partially” or “non-protected”. Many sites cannot even stop basic bots, let alone AI-powered ones.
• Rising complexity of bots themselves: “agentic” bots capable of interacting, executing JS, browsing like humans — broadening their attack surface.

Impacts for society, businesses and the Web

This rise of aggressive bots raises major issues beyond simple cybersecurity:

• Digital economy destabilized: for websites relying on advertisements, subscriptions or human engagement, a massive presence of bots “extracting value for free” skews metrics, reduces revenue, and makes monetization harder.
• Inequality between actors: large companies with security budgets can implement advanced protections. Smaller structures — SMEs, associations, small blogs, open-source projects — are far more vulnerable.
• Risks of espionage, data theft, abuse: automated bots can exfiltrate data, test vulnerabilities, compromise servers or serve as first step for targeted attacks. The rise of “agentic bots” multiplies those risks.
• Weakening of human-centric Web: if human traffic becomes minoritary, bots saturate content, interactions, real value — it is diversity, creativity, small-scale actors of the Web who are threatened.

What are today’s real solutions — and their limits

In response to these threats, several protective strategies emerge:

• Multi-layer protections: Web Application Firewall (WAF), behavioral detection, access/anomaly analysis, IP/request filtering. But these defenses must evolve rapidly to match bots’ new capabilities.
• Honeypots or decoys: fake pages, lures to identify bots, trap or divert them — some security firms explore “smart decoy” methods rather than simple blocking.
• Advanced behavioral analysis: distinguishing human from automated traffic not by static rules but by intent, coherence, anomaly detection. Solutions increasingly need to “learn” to stay effective.
• Hardening configurations, reducing attack surface: closing unused endpoints, securing APIs, restricting access, strengthening authentication — basic but essential measures.

Despite these efforts, limitations remain. Bots are becoming so sophisticated — “human-like” navigation, residential proxies, code execution, real-time adaptation — that distinguishing a real user from a malicious bot becomes increasingly fuzzy. As warned by academic research “FP-Inconsistent”, bots can alter their “browser fingerprints” to evade detection, rendering many classical tools obsolete.

The Web could gradually become an environment dominated by hostile automation — an “Internet of machines” — at the expense of humans, trust, and diversity.

Why information remains partial — and what remains to clarify

Despite the recent abundance of reports, many uncertainties persist:

• Many studies come from private companies (cybersecurity firms, commercial platforms), which may introduce biases in site selection and interpretation. Numbers vary widely depending on methodology and types of sites analyzed.
• When it comes to “agentic” bots (web agents, AI, multi-tab, JS execution, etc.), academic analysis exists — but public cases of large-scale real-world compromises remain rare or under-reported. The theoretical risk is real, but that does not guarantee widespread disasters have already occurred.
• Finally, the rapid evolution of technology means what holds today may be outdated tomorrow. A defense that works now might be bypassed soon — making the fight against malicious bots a permanent cat-and-mouse game.

Conclusion — towards a Web under high surveillance… or a sick Web?

The verdict is clear: malicious bots, automated and AI-powered, are redefining threats on the Web. They exploit infrastructure power, weak defenses and easy automation — and threaten, in the long run, the very balance of the Web as we know it.

For businesses, it’s imperative to strengthen security, revise defense strategies, and adopt proactive practices. But for society at large, this might be a deeper warning: if the Web becomes an increasingly hostile terrain flooded with automated actors, it is not only technical security at stake — but value, diversity, gratuity, trust and creativity.

A bot-driven Web could quickly resemble an automated battleground, where only the strongest (technically, financially) survive. Unless a collective awakening — technical, regulatory, ethical — occurs in the coming years, the risk is real: we may drift towards an Internet dominated, not by humans, but by machines.

Note of caution: this article relies on recent studies and reports, mostly from private firms. Figures vary depending on methodology, samples and types of sites analyzed — making the trends worrying, but not absolute.