
The Guardrails
Seven in ten sites waved a fake GPTBot straight through
The cheapest credential-stuffing kit of 2026 does not need a bot farm. It needs you to trust a name. DataDome's annual bot report finds that spoofed AI crawlers walked past more than seven in ten websites, and that two-thirds of the sites it tested stopped none of the ten bot types it sent at them. The test ran in June: ten bot types, 21,491 sites, 15 industries, all requests sent from residential addresses in the US, Canada and France. Of those sites, 65.3% blocked nothing at all, and the sha










