Cloudflare CEO: AI bots will outnumber humans by 2027

If you've ever wondered who's really browsing the internet, the answer is increasingly clear: it's not humans. Cloudflare CEO Matthew Prince told the audience at SXSW 2026 that AI bot traffic will surpass human traffic online by 2027 — a prediction backed by data from the company that handles roughly 20% of all global web traffic.

The numbers are staggering

Before generative AI exploded, bots accounted for about 20% of internet traffic. That was mostly Google's web crawler indexing pages. Now, AI-powered agents visit websites at a completely different scale.

Prince gave a simple example: when you shop for a camera, you might visit five websites. An AI agent doing the same task could visit 5,000 sites — a thousand times more — to find you the best answer. Multiply that by hundreds of millions of AI queries per day, and the math becomes obvious.

Retailers are split on how to respond

The shift is already forcing companies to pick sides. According to Prince's SXSW presentation, the three biggest U.S. retailers are taking completely different approaches:

This split illustrates a dilemma every website owner will soon face: let bots in to stay relevant in AI search results, or block them to protect original content.

Why publishers are caught in the middle

The traditional internet worked like this: you search Google, click a link, visit a website, see an ad, and the publisher gets paid. Generative AI breaks that chain. When ChatGPT or Perplexity answers your question directly, nobody clicks through to the original source.

Publishers now face a lose-lose choice. If they block AI bots, their content disappears from AI-generated answers. If they allow bots, their content gets consumed without the page views that pay the bills. Prince described this as the need for an entirely "new economic contract" between content creators and the machines that consume their work.

AI is also making cyberattacks easier

It's not just friendly shopping bots. Cloudflare's report found that generative AI is erasing the technical barrier to launching cyberattacks. Hackers who previously needed years of coding experience can now use AI to map networks, develop attack tools, and create deepfakes (AI-generated fake voices or faces used to impersonate real people).

One AI-assisted supply chain attack described in the report compromised hundreds of corporate software accounts in a single operation. North Korean operatives were caught using AI-generated deepfakes and fake IDs to infiltrate companies remotely.

The shift from "breaking in" to "logging in"

Perhaps the most unsettling finding: attackers have largely stopped trying to break into systems through technical exploits. Instead, they just log in with stolen credentials. With 94% of login attempts coming from bots and 63% using already-compromised passwords, the strategy makes sense — why pick the lock when you have a copy of the key?

As Cloudflare put it: "Security is no longer about keeping strangers out — it's about proving that users inside your network are who they say they are."

What this means if you run a website or business

The bot-majority internet is coming whether businesses are ready or not. Here's what to think about:

• If you run a website: review your bot management settings now. Decide whether you want AI crawlers indexing your content
• If you run a business: assume every login attempt is a bot until proven otherwise. Multi-factor authentication (a second verification step like a text message code) is no longer optional
• If you create content: the value of original work is rising — but only if you control how it's distributed

The internet as we know it — built for human visitors clicking through pages — is being rebuilt around machines talking to machines. The question is who captures the value.

Related Content — Get Started with Easy Claude Code | Free Learning Guides | More AI News