Benjamin Fabre is the cofounder and CEO of DataDome
getty
For many years, bot defense was basic. You stopped bad stars at the door and let genuine clients through. That worked when bots were mainly spiders that scraped your homepage and proceeded.
That’s not the case any longer. According to my business’s”State of Bot & Agent Security Report, 2026,””AI representatives created 605.6 million demands to high-risk endpoints “throughout our client base in simply the very first half of 2026. We’re not discussing web page or post. AI representatives are appearing on login pages, checkout and payment circulations and account-creation types, following the exact same courses as your clients.
From Crawlers To Customers
AI traffic utilized to be passive and ran similar to an online search engine spider. Now AI representatives finish the exact same multistep actions that utilized to need an individual at a keyboard.
Month-to-month AI bot demands to login pages grew more than 8 times in 6 months. Login pages comprised 51.7% of all high-risk AI traffic in the very first half of 2026, up from 23% a year previously. That implies your login page, not your homepage, is now the busiest AI entry point into your organization.
The Authentication Problem
Login pages exist for a factor. They protect order history, conserved payment techniques and commitment balances. A genuine AI shopping assistant looking at a shipment needs to visit someplace, which’s a legitimate usage case.
The exact same login page is simply as appealing to a scammer trying credential stuffing or account takeover. The action looks similar, however the intent isn’t. That dive in login traffic might be genuine agentic commerce, credential attacks or both simultaneously. Block whatever, and you locked out your own clients’tools. Wave whatever through, and you hand aggressors an opening. Neither works.
Habits, Not Identity
You can’t rely on a bot based upon what it declares to be any longer. According to my business’s report”AI representative spoofing increased by 45 %in between February and July 2026.”Spoofing of user-prompted representatives(the live assistants acting for genuine individuals in genuine time)quadrupled because window. A bot declaring to be ChatGPT-User or PerplexityBot might extremely well be neither.
The choice on whether to enable, throttle or obstruct a visitor can’t rest on identity. It needs to rest on habits, what pages it touches, how quickly it moves and whether the pattern matches a genuine representative or an attack.
The Cost Of Getting This Wrong In Both Directions
Tightening up controls throughout the board might feel safe, however it isn’t complimentary. If you obstruct indiscriminately, you likewise obstruct genuine AI representatives finishing genuine purchases on behalf of paying clients. That’s lost conversions, right as agentic commerce is growing. Adobe discovered AI-driven traffic to U.S. retail websites grew 138 %year over year in May 2026, transforming 54% much better than other sources.
The opposite error expenses simply as much. If you presume AI traffic is safe by default (or do not have the exposure to examine ), you leave the door available to credential abuse, payment scams and stock adjustment. Endpoints acquiring high-risk AI traffic like cart, payment and account production link directly to purchases and saved worth, and getting it incorrect programs up on the P&L quick.
What A Better Posture Looks Like
Start with exposure. Know what share of your login traffic is AI-driven. Without that, you’re making choices blind on among the most significant shifts in how your website gets utilized.
Develop behavioral context at the session level. What did this visitor touch before the login effort? How rapidly? Does the pattern match any recognized genuine representative profile, or does it match a recognized attack signature? That’s what separates obstructing the ideal traffic from obstructing whatever.
The boundary has actually moved. It’s not the front door any longer; it’s every login, every kind and every checkout on your website. Defenses constructed for doorstep bots aren’t constructed for 2026.
Forbes Technology Council is an invitation-only neighborhood for first-rate CIOs, CTOs and innovation executives. Do I certify?
Discover more from PMN S.P.O.R.T.S - A PRIME MEDIA NETWORK BRAND
Subscribe to get the latest posts sent to your email.
