Seven in ten sites waved a fake GPTBot straight through
The cheapest credential-stuffing kit of 2026 does not need a bot farm. It needs you to trust a name.
DataDome's annual bot report finds that spoofed AI crawlers walked past more than seven in ten websites, and that two-thirds of the sites it tested stopped none of the ten bot types it sent at them.
The test ran in June: ten bot types, 21,491 sites, 15 industries, all requests sent from residential addresses in the US, Canada and France. Of those sites, 65.3% blocked nothing at all, and the share reaching full protection has fallen two years running — 2.4% this year, down from 8.4% in 2024, even after accounting for the harder bot types the 2026 test added. Telecommunications was the weakest industry on the board, with 82.9% of sites unprotected. The most useful number is the identity failure. A request that simply claims to be GPTBot or ClaudeBot is routinely admitted on the name alone, which is why only 5.5% of sites caught the test's disguised bot — the one that forges a real browser's network fingerprint instead of announcing itself.
That is a structural problem, not a tuning problem. Name-based allowlists were a reasonable proxy when crawlers were mostly search engines with stable infrastructure; against an agent that can claim any name at any time, they are an open door with a guest list nobody reads. DataDome's Jerome Segura puts the operational version bluntly: identifying automation is no longer the hard part, deciding whether a given session is helpful or hostile is. Most defences in production, he says, are still built around binary choices — block or allow — while the decisions that matter now need to separate a shopping agent from a credential-stuffing campaign. Businesses that block everything also cut off the agents they are about to depend on for revenue.
Vast Data launched DataEnclave, a confidential-computing environment that lets models run over sensitive data without either side surrendering its keys.
The capability sits inside Vast's AI operating system and uses Nvidia's confidential computing to encrypt CPU memory, GPU memory and NVLink traffic, isolating live models and data from the infrastructure operators and other tenants on the same hardware. Cryptographic attestation verifies the hardware and policy before anything is decrypted, and each party keeps its own key management system — which lets a developer's base weights and a customer's fine-tuned weights interoperate while remaining separately owned. Vast co-founder Jeff Denworth said the target customers are the ones who currently cannot use hosted AI at all: large banks, defence and intelligence agencies, pharmaceutical companies. It is in preview and ships in the first quarter of 2027, bundled into the AI operating system rather than priced separately. The same trust is being funded at scale elsewhere — Bloomberg reported that the Finnish neocloud Verda raised $189 million led by Emergence at a valuation above $1 billion, with the company declining to give an exact figure.
The volume behind those failures: AI agent traffic grew 82.3% over the past year, and 605.6 million agent requests hit login, cart, payment and account-creation pages in the first half of 2026 alone.
DataDome logged 52.7 billion AI agent and crawler requests across its customer base, dominated by Meta-affiliated bots (46.3%) and OpenAI-affiliated bots (34.6%) — so most of the traffic is not malicious. Where it goes is what changed. Of the 29.02 billion AI bot requests in the first half of the year, 97.9% went to homepages and general content; the remaining 2.1% is where the money is, and login pages took 51.7% of those agent requests, against 23% a year earlier. Monthly login-page volume from AI bots went from 11.9 million requests in January to 99.7 million in June. Scalping rose 290.7% and DDoS attacks grew 39.9%, peaking above 2 billion requests in a single day in April.
What to watch: whether sites move off name-based crawler allowlists to cryptographic verification before an incident forces it.
If you run a site that allows AI crawlers by user-agent, do you actually know what's hitting you? Tell us in the comments.
