Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot
The Rise of the Agentic Web: Analyzing AI Bot Traffic and Spoofing
The digital landscape is undergoing a fundamental transformation. We are migrating away from an internet designed primarily for human consumption and moving toward an "Agentic Web"—an ecosystem increasingly navigated and utilized by autonomous machines.
The Agentic Web Index tracks this evolution, monitoring how AI agents, scrapers, and crawlers are redefining the discovery and utilization of online information.
📊 Ecosystem Vital Signs
Based on data from over 5,000 websites utilizing AI Chat Referral Tracking and Agent Analytics, the current state of web traffic is as follows:
| Metric | Current Value | Trend (Last 90 Days) | Description |
|---|---|---|---|
| Human Traffic | The ratio of human visitors vs. automated bots. | ||
| Agentrification | The portion of total bot traffic specifically linked to AI. | ||
| AI Chat Referrals | Human visits originating from AI chat interfaces. | ||
robots.txt Compliance | Stable | The rate at which bots adhere to exclusion protocols. |
Human-centric browsing is the dominant force Machine-centric interaction is accelerating.
🤖 Taxonomy of Web Agents
The "Agentic Web" consists of various specialized bots. Below is a comprehensive breakdown of the agents currently active:
AI-Specific Agents
- AI Agent: Uses a full browser to autonomously execute complex tasks for humans.
- AI Assistant: Retrieves real-time content to populate AI-generated responses.
- AI Coding Agent: Scours documentation to assist in software development.
- AI Data Provider: A third-party service that crawls the web to sell structured data to AI firms.
- AI Data Scraper: Downloads massive datasets to train Large Language Models (LLMs).
- AI Search Crawler: Indexes content specifically for citations in AI-powered search engines.
- Undocumented AI Agent: An anonymous crawler that collects data without disclosing its intent.
General Automation & Utility
- Archiver: Creates historical snapshots for digital preservation.
- Automated Agent: Programmatic browser interaction without human oversight.
- Developer Helper: Used for
debugging, testing, and site optimization. - Fetcher: Grabs metadata for link previews or RSS feeds.
- Intelligence Gatherer: Analyzes sites for competitive intel or brand safety.
- Scraper: General high-volume data extraction (often unauthorized).
- Search Engine Crawler: The traditional backbone of web indexing.
- Security Scanner: Probes for
vulnerabilitiesand configuration errors. - SEO Crawler: Analyzes site architecture for search optimization.
- Uncategorized: Agents that have not yet been identified.
📈 Traffic Distribution & Hierarchy
Distribution by Agent Category
The following percentages represent the volume of activity per agent type:
Top Individual Agents
The most active specific bots currently traversing the web:
| Agent Name | Category | Primary Function | Traffic Share |
|---|---|---|---|
bingbot | SRCH | Search Indexing | |
Googlebot | SRCH | Search Indexing | |
AhrefsBot | SEO | SEO Analysis | |
Known Agent | DEV | Dev Assistance | |
ChatGPT-User | ASST | AI Response Fetching | |
ClaudeBot | SCRP | LLM Training | |
PetalBot | SRCH | AI Search Indexing | |
SemrushBot | SEO | SEO Analysis | |
facebookexternalhit | FTCH | Metadata Fetching | |
meta-externalagent | SCRP | LLM Training | |
Amazonbot | SCRP | LLM Training |
Leading Operators
The organizations controlling the most significant bot footprints:
- Google:
- Microsoft:
- Ahrefs:
- Meta:
- OpenAI:
- Known Agents:
- Anthropic:
- Amazon:
🔍 Focus: AI Scraping Activity
AI scraping is a distinct subset of bot activity focused on the ingestion of data for model training. This is split between first-party AI companies and third-party data brokers.
Definition: AI Scraping activity encompasses both AI Data Providers (who resell structured data) and AI Data Scrapers (who harvest raw content for LLM training).
To manage these bots, administrators often use a robots.txt file. A typical configuration to block specific AI scrapers might look like this:
User-agent: ClaudeBot
Disallow: /
User-agent: GPTBot
Disallow: /
By monitoring these trends, website owners can better understand the balance between being discoverable by AI search engines and protecting their intellectual property from unauthorized training sets.