Cape Partners
Français

Cape Partners · Research

Agents are taking over the web

Automated traffic passed human traffic in 2026. The question that matters for anyone who runs a website is narrower: how much of that traffic is agentic — software acting for a principal — and how fast is that share growing?

Published October 2026 · Third-party data, triangulated · Cape Partners

~20% of automated requests are agentic (assistants and AI search), not crawlers. Cloudflare Radar, Oct 2026
+1,700% growth in daily AI-agent requests in a single year. Cloudflare, Sep 2026
~2% of legitimate agent sessions prove who they are with a signed identity. Arkose Labs, Q3 2026

Short answer

No one publishes a single "agentic share of the web" figure, because no one measures it directly. What exists is a set of bot-traffic censuses, each cutting the population differently. Read together, they say that agentic traffic is on the order of 15–25% of automated requests — roughly 4–12% of all web requests depending on which population you count — and that it is the fastest-growing slice of the machine web by a wide margin.

First, the denominator is not one number

Three well-cited sources report "how much of the web is bots" and they disagree — because they are counting different things:

  • 57.4% automated — Cloudflare, June 2026, on HTML web-page requests to a sample of sites. This is the milestone figure: bots passed humans for the first time.
  • ~39% automated — Cloudflare Radar, October 2026, across all HTTP requests on the whole network.
  • 53% automated — Imperva/Thales 2026 Bad Bot Report, across its customer base (2025 data).

Page views and API calls are different populations; a vendor's customers are a different population again. Any "agentic %" has to name its denominator before the number means anything.

What counts as agentic

The cleanest way to separate an agent from an older bot is by purpose. Cloudflare Radar tags each automated request; the October 2026 split of bot requests looks like this:

Search crawlers 26.3% AI crawlers 17.3% AI assistants 11.6% SEO tools 9.7% AI search 8.6% Link previews 8.3% Advertising 7.4% Webhooks 5.3% Monitoring 2.9%
Agentic — acts for a principal Other automation
Share of bot requests by purpose · Cloudflare Radar, snapshot 2026-10-21 (7-day).

The agentic categories are the ones where a person asked for something and software is fetching or acting on their behalf: AI assistants (11.6%) and AI search (8.6%) — together about a fifth of all bot traffic. Crawlers, SEO tools, link previews, advertising and monitoring are automation too, but nobody is behind them in the moment.

The extrapolation

~20% agentic × ~39% automated ≈ 8% of all web requests are agents acting for someone. On the narrower HTML page-view population (57.4% automated), the same ~20% implies ~11%. Treat 4–12% as the honest range, not a measured figure.

Independent measurements point the same way. HUMAN Security's 2026 benchmark splits AI-driven traffic by type: training crawlers are 67.5% of it — still the majority, but a share that fell through 2025 as agentic traffic grew. Arkose Labs, looking at login, registration and checkout flows, found agents reached 65.2% of its customers, and that 77.4% of AI-agent sessions were legitimate against only 7.9% of known bot sessions — agents are a distinct, mostly-benign population from classic bots.

The growth rate

Every source that tracks the agentic slice agrees on the direction and the steepness:

  • +1,700% — Cloudflare, daily AI-agent requests year over year (September 2026).
  • +7,851% — HUMAN Security, agentic and agentic-browser traffic year over year; AI-driven traffic growing roughly 8× faster than human traffic.
  • 15% → 66% — agents' share of traffic to documentation sites, in about seven months (Mintlify, mid-2026). A vertical outlier, but a well-measured one.
  • +200% — agentic search as the first step in a purchase journey (Salesforce, September 2026).

One caveat worth keeping

Identity lags the volume. Signed requests — where an agent proves who it is with a cryptographic key — went from under 2% of bot requests in January 2026 to about 11% by April. But Arkose Labs still finds only 2.3% of legitimate agent sessions carry a verified signature; almost all of them arrive unverifiable. For a website, the practical consequence is that a helpful agent acting for a real customer and a fraud bot can look nearly identical. The volume of agentic traffic is now well established; its identity is not.

How to read these numbers

  • Always state the population: all HTTP requests, HTML page views, or a vendor's customer base.
  • Separate crawlers (read once, for training or indexing) from agents (return on demand, for a person).
  • Expect wide vertical skew — documentation and commerce run far above the ~8% network average.
  • Treat vendor-published percentages as directional; most publish shares, not raw counts.

Sources

  1. Cloudflare Radar — bot and AI-bot purpose taxonomy (network-wide HTTP traffic). radar.cloudflare.com/bots
  2. Cloudflare blog, "The Internet has a second audience" (30 Sep 2026). blog.cloudflare.com/agentic-web
  3. Cloudflare blog, "Content Independence Day, one year on" (1 Jul 2026). blog.cloudflare.com/agentic-internet-bot-report
  4. NBC News / Mashable — Cloudflare's 57.4% automated milestone (June 2026).
  5. Imperva / Thales 2026 Bad Bot Report. imperva.com
  6. HUMAN Security, 2026 State of AI Traffic & Cyberthreat Benchmark Report. humansecurity.com
  7. Arkose Labs, The State of Agentic AI Trust Report, Q3 2026 (20 Oct 2026).
  8. Mintlify, "The state of docs traffic" (mid-2026). mintlify.com
  9. Salesforce, "Agentic Search Grows 200%" (30 Sep 2026). salesforce.com
  10. Volance / Overwing Atlas — aggregations of Cloudflare Radar and x402 data (Oct 2026).

This note reports third-party measurements, not Cape Partners' own data. Where a figure is an extrapolation it is labelled as one. Measurements move fast; the dates are given so each number can be re-checked against its source.