Cloudflare says automated traffic overtook human traffic in May
Cloudflare opens Birthday Week with a founders' letter saying automated traffic passed human traffic in May 2026, 18 months ahead of its own forecast. Plus two exploited NetScaler zero-days and a new Lambda data center in Oklahoma.
A quiet Sunday, apart from Cloudflare starting its Birthday Week with a number worth remembering: by its count, bots and agents now make more requests on the web than people do. That changes what it costs to run a website and who pays for it. The day’s other news is a patch-now warning for NetScaler admins.
The web now has more bots than people
What was said. Cloudflare’s 2026 founders’ letter, the traditional opener of Birthday Week, puts dates on the shift to agent traffic:
- Cloudflare had forecast that automated traffic would pass human traffic in the second half of 2027. Agents and AI crawlers “pulled that date forward to May of 2026.”
- It expects automated traffic to reach 1,000 times human traffic within five years.
- More than half of what well-behaved bots fetch hasn’t changed since their last visit.
- More than 7 million developers build on its developer platform.
The letter says Cloudflare is working on two fixes: letting crawlers fetch only what’s new, and giving anyone who publishes content or apps a way to get paid when agents use them. It names no products; those were left for the rest of the week.
What it means for you. If you run a site or an API, plan for most of your traffic being machines, and make repeat visits cheap. Return ETag or Last-Modified headers and answer conditional requests with 304 Not Modified, so a crawler re-checking an unchanged page costs you almost nothing. If you build agents, the same habits make you a “good bot”: cache, send conditional requests, and don’t re-download what you already have.
Cloudflare wants to be the agents’ toll booth. Cloudflare sits in front of a large share of the web, so it sees the traffic shift first and is in a position to charge for it. Its pitch is to be the toll booth between agents and publishers: crawler controls, pay-per-crawl, and now efficient re-crawling. A 1,000x forecast is a vendor projection, not a measurement, but even a fraction of that growth makes bot management and bandwidth costs a bigger line item for every site, and a bigger business for whoever sits in the middle.
Quick hits
- Two NetScaler zero-days are being exploited: CVE-2026-88771 and CVE-2026-88772, both rated 9.5, allow remote code execution on NetScaler ADC and Gateway. The first affects default configurations. Citrix has fixed builds (14.1-73.37 and 13.1-64.23), and some admins were told to shut appliances down until they patch.
- Lambda is building a data center in Mayes County, Oklahoma, promising $500 million in tax revenue over a decade and to pay all of its own energy costs. It doesn’t say how many megawatts, a sign of how sensitive local power bills have become for AI data centers.