Akamai: AI Drives 300% Bot Traffic Surge and 113% Rise in Daily API Attacks

Akamai's 22 September State of the Internet report says AI fueled a 300% jump in bot traffic and a 113% rise in daily API attacks from 2024 to 2025, with verified AI crawlers now sending POST requests to commerce and travel sites.

Two same-day reports (22 September 2026) cover Akamai's State of the Internet report on AI-driven threats. Infosecurity Magazine reports that AI helped drive a 300% increase in bot traffic, mainly against the commerce vertical, and a 113% rise in daily API attacks between 2024 and 2025. Eighty-seven percent of surveyed organizations had an API security incident in 2025, up from 76% in 2022. Enterprise AI adoption also carries risk: 40% of enterprise users installed AI browser extensions, 6% of chatbot conversations contained sensitive corporate information, and 47% of AI chats on enterprise devices used personal accounts. Help Net Security adds findings from Akamai's 30-day traffic review: verified AI crawlers, including ChatGPT, have moved from GET page fetches to high-frequency POST requests used for logins, carts, and checkouts. Ecommerce accounted for 44.8% of those AI bot POST transactions, travel reached 30% within a single month, and Model Context Protocol (MCP) traffic was 4.1%. Akamai warns that unsanctioned MCP services without authentication can expose personal data, and that indirect prompt injection via MCP can let adversaries manipulate agents into high-impact actions. The two reports are consistent, with no factual disagreements. Akamai declined to publish vulnerability findings from its early access to Anthropic's Mythos model under Project Glasswing.

• Bot traffic rose 300%, mainly hitting the commerce vertical.
• Daily API attacks increased 113% from 2024 to 2025.
• 87% of surveyed organizations had an API security incident in 2025, up from 76% in 2022.
• 40% of enterprise users installed AI browser extensions.
• 6% of chatbot conversations contained sensitive corporate information; 47% of AI chats on enterprise devices used personal accounts.
• Verified AI crawlers, including ChatGPT, shifted from GET page fetches to high-frequency POST requests for logins, carts, and checkouts in a 30-day review.
• Ecommerce accounted for 44.8% of AI bot POST transactions; travel reached 30% within a single month.
• Model Context Protocol (MCP) traffic was 4.1%; unauthenticated MCP services may expose personal data.