Bot Traffic Jam: What Often-Unprotected Publishers Need To Know

AI scraping isn’t the only behind-the-scenes bot activity that publishers need to keep an eye on.

Of course, any business — publishing or otherwise — is susceptible to these bots, which DataDome calls “the most relentless threats to online businesses and a primary driver of digital fraud.”

In fact, according to its 2025 Global Bot Security Report, large language model (LLM) crawler traffic (usually associated with genAI training) has nearly quadrupled across its customer base, from 2.6% of all verified bot traffic in January to over 10% by August.

(Source: DataDome)

“The majority of online businesses remain fully exposed to even simple, script-based bots that carry out scraping, credential stuffing, carding, fake account creations, and more,” the report says. “Threat actors are increasingly blending basic automation with more advanced tactics such as leveraging agentic AI tools that simulate human behavior, bypass CAPTCHAs, manipulate TLS fingerprints, and adapt in real time. These bots aren’t just executing instructions; they’re making decisions in real time.”

DataDome, a cyber-protection platform, found that 3 out of 5 sites it tested (61.2%) were fully unprotected, with those fully protected dropping from 8.4% last year to 2.8% this year. When AI bots accounted for traffic, 64% touched forms, 23% touched login pages, and 5% reached checkout flows “introducing new fraud, compliance, and security risks.” DataDome noted that those in media and publishing specifically (with more than 68% unprotected) see “IP theft, SEO dilution, and lost revenue” as crawlers train and redistribute their content.

“The rise of agentic AI and LLMs makes it essential to assess intent, since not all AI traffic is bad,” the report says. “The outdated ‘bot or not’ model no longer applies.”