Website owners can now see a faster shift toward automated AI agents, with DataDome recording 41.5% quarter-over-quarter growth in AI bot traffic during Q3 2026. The traffic reached nearly 25 billion requests and included browser-driven agents that reached forms, login pages and payment endpoints, making bot policies and capacity plans a more visible part of site audits.
How much AI bot traffic reached DataDome?
AI agent traffic across DataDome’s network grew by 41.5% from the previous quarter to nearly 25 billion requests in Q3 2026. Nearly half of all AI agent traffic recorded in 2026 through September occurred during the third quarter, which left policies and capacity plans based on the previous quarter’s averages out of date.
Meta led the quarter’s traffic. Meta-ExternalAgent and Meta-WebIndexer generated a combined 12.4 billion requests, representing 49.7% of the AI agent traffic recorded. Meta-WebIndexer passed Meta-ExternalAgent in September, which DataDome interprets as a sign of continued investment in AI answer generation.
ClaudeBot ranked fourth for the quarter, moving ahead of GPTBot. DataDome’s report also tracks bots used by OpenAI, Anthropic and Amazon, but the article does not provide their individual traffic totals.
Why does browser-driven agent traffic matter for site audits?
Agentic browser traffic rose from 12.5 million requests in August to 58.2 million in September. After removing Muse from the category, traffic more than tripled to 38.7 million requests. ChatGPT’s cloud browser produced the most traffic in this category during September.
Meta’s Muse became fully available on September 22 and accounted for 33% of the month’s agentic browser traffic. It generated 29.1 million requests over its first 12 days of full availability. In DataDome’s sample, 99.3% of Muse requests came from cloud and CDN infrastructure, while its daily traffic patterns resembled user activity rather than a scheduled crawl.
Muse is a personal AI agent that operates from a dedicated cloud virtual machine containing a browser. DataDome classifies it as agentic browser traffic because its requests are browser-driven. The agent can reach sensitive website endpoints, including login, payment, account creation, shopping cart and form pages.
Forms received 81% of requests to those sensitive endpoints, with about eight times as many requests as login pages. A website audit should therefore distinguish automated access to ordinary public content from traffic aimed at transactional and account-related routes. That includes checking whether bot controls cover cloud and CDN traffic and whether agents can reach forms, logins, payment pages and account creation.
What do individual bot controls show?
OpenAI, Anthropic and Amazon use separate bots for collecting training data, indexing pages for AI search and retrieving pages when users ask questions. Each bot has a distinct name, which allows website owners to allow or block it individually.
They also support the development of search results with current information and source links, which may reduce the need to depend on Bing, Google or Brave. Each bot adds another access setting for the publisher to manage.
Those settings do not cover agents that browse through a regular browser without using the named bots. The distinction is visible in the traffic data because agentic browser requests may originate from cloud infrastructure and follow patterns associated with user activity.
Companies do not always explain in advance how each bot handles robots.txt, the file website owners use to set rules for automated access. An audit can therefore document the named crawler permissions while separately reviewing unprotected browser-driven traffic to sensitive endpoints.
What changed in browser-agent activity?
DataDome’s traffic patterns showed several notable shifts:
- Agentic browser requests increased from 12.5 million in August to 58.2 million in September.
- Excluding Muse, the category recorded 38.7 million requests in September, more than three times the August total.
- ChatGPT’s cloud browser generated the most traffic in the category in September.
- Meta’s Muse supplied 33% of the month’s total following its full availability on September 22.
- Comet’s traffic fell by 65% from July to September.
Jerome Segura, VP of Threat Research at DataDome, said the data shows where agentic traffic is heading. He said Muse’s cloud virtual machine makes almost all of its requests resemble data-center traffic rather than traffic from a user’s device, while a meaningful share reaches forms and checkout flows.
Segura said policies that trust residential or ISP-based traffic will not catch agents like Muse. His recommendation was for organizations to validate agent identity, understand intent and decide which agents to allow and what those agents may do.
What to do now
- Review bot rules against the latest traffic pattern. Compare current access settings with the sharp rise in AI agent traffic and identify policies that still depend on the previous quarter’s averages.
- Audit named AI bots separately. Record which OpenAI, Anthropic and Amazon bots are allowed or blocked for training, indexing or retrieval, and check how each bot handles robots.txt where the company provides that information.
- Check browser-driven access to sensitive routes. Review traffic to login, payment, account creation, shopping cart and form pages, with particular attention to forms, which received 81% of sensitive endpoint traffic in the sample.
- Do not rely on network origin alone. Account for agent traffic arriving through cloud and CDN infrastructure, since 99.3% of the sampled Muse requests came from those sources.
- Set permissions by agent and route. Validate agent identity, identify the apparent purpose of its requests and decide which agents can access the site and which areas they may reach.
FAQ
How much AI bot traffic did DataDome record in Q3 2026?
DataDome recorded nearly 25 billion AI agent requests in Q3 2026, a 41.5% increase from the previous quarter. Nearly half of the AI agent traffic recorded in 2026 through September occurred during that quarter.
Which AI bots generated the most traffic?
Meta-ExternalAgent and Meta-WebIndexer led with a combined 12.4 billion requests in Q3 2026, equal to 49.7% of recorded AI agent traffic. ClaudeBot ranked fourth and passed GPTBot for the quarter.
Why can named bot controls miss AI agent activity?
Named bot controls do not cover agents that browse websites through a regular browser without using those bot names. Browser-driven agents may send traffic through cloud and CDN infrastructure, which means network origin alone may not identify their activity.
Try the AI visibility report
SEOScanPro runs a full technical audit of a site and shows the measured result behind every check. Open the AI visibility report.