AI-driven bots surge in September 2025

September 2025 was a significant month for digital ecosystems, with a measurable and widespread surge in AI-driven bot traffic. Across multiple sectors, particularly publishing, financial services and paid media, data from several industry sources showed sharp increases in both the volume and sophistication of automated traffic.

Where bots were once easy to identify through repetitive patterns or non-human behaviour, the new wave of AI-powered bots now closely mimics genuine user interactions, complicating traditional detection methods.

The changing landscape of bot traffic

Industry monitoring tools and publishers reported that bots now account for more than half of all internet traffic in some environments. Advances in AI scraping, automation and autonomous browsing tools have made it easier for bad actors, and even legitimate developers, to deploy bots at scale.

This has led to noticeable spikes in invalid traffic (IVT), fake lead submissions, and artificially high click-through rates (CTRs). Many advertisers saw performance metrics fluctuate as bots increasingly interacted with media placements, login pages, and data-sensitive forms.

Financial services were among the most affected sectors. While some institutions saw a temporary decline in attacks thanks to improved fraud defences, the overall trend points to a net rise in sophisticated bot activity through Q3 2025.

Key metrics from September 2025

Verified Bot Traffic Share

• AI-crawler traffic quadrupled, growing from 2.6% of verified bot requests in January to over 10.1% by August and September 2025 (SecurityBoulevard).
• According to industry wide accessible data, Bots now represent nearly one-third of all global web traffic, with AI-driven bots reaching record levels and in some industries, surpassing human traffic.

Endpoint and Page Interaction Rates

In an analysis of a number of industry sources we identified;

• In September, 64% of AI bot traffic touched web forms, 23% hit login pages, and 5% reached checkout flows, highlighting expansion into sensitive financial and transactional functions.
• Server request rates spiked, with some sites seeing up to 39,000 bot-driven requests per minute.

Bounce Rates and Session Duration

• Bot sessions showed abnormally high bounce rates (90–100%) and near-zero session durations, compared to normal human sessions averaging 1–3 minutes and bounce rates between 40–60%.

Google Impressions and Analytics Drops

• Google Search Console and analytics tools recorded noticeable drops in impressions and reported engagement, likely due to updates filtering out non-human and invalid traffic. This shift suggests that some of the “lost traffic” was never human to begin with.

What this means for brands and marketers

The September spike underscores a critical shift: bot traffic is no longer just a background issue, it’s an active, dynamic force that can distort analytics, skew campaign performance, and drain marketing budgets.

For marketers and publishers, the key takeaways are:

• Re-evaluate traffic quality metrics: Look beyond impressions and CTRs; analyse form fills, session time, and authenticated interactions.
• Update detection and mitigation tools: AI-based threats require AI-based countermeasures.
• Collaborate across data and media teams: Align on identifying and excluding invalid or non-consenting traffic before it impacts spend efficiency.

Bot detection metrics snapshot

The rise of AI-driven bots marks a turning point in digital media and analytics. As automated traffic grows more human-like, accurate measurement, brand safety and campaign efficiency will increasingly depend on the sophistication of detection technologies, and the vigilance of marketers who use them.