On June 3, Cloudflare CEO Matthew Prince posted four words on X that summed up the moment better than any analyst report: “Welp, that happened faster than I predicted.”
The thing that happened: automated traffic crossed 57% of HTTP requests on Cloudflare’s network, against roughly 43% from people. For the first time since the web went public, machines generate the majority of its requests. Prince had told an SXSW audience in March that this crossover would arrive in 2027. It took less than three months to prove him wrong, and by his own account the data suggests the line was crossed sometime in late April. The driver, in his words, is agentic traffic: AI systems browsing the web on behalf of humans, at machine speed.
At Atwix, we have spent the past week reading this story carefully, because headlines like “bots now rule the internet” tend to produce two equally wrong reactions in eCommerce: panic and dismissal. Both miss what the number actually tells us. So before we draw any conclusions, let’s be honest about what this milestone is and what it is not.
What the number does not say
First, the metric measures HTTP requests, not attention. An AI agent comparing prices fires off hundreds of page loads in seconds. A person watching a product video generates almost none. By time spent, humans still utterly dominate the web. Nobody’s customer base became a robot overnight.
Second, the 57% is not one thing. It includes search crawlers, AI training scrapers, monitoring tools, and outright malicious bots alongside the genuinely new category: agents researching and completing tasks for real people. Cloudflare itself only recently started classifying traffic into verified bots and signed agents, which is why its charts barely go back a year. A large share of that bot traffic will never buy anything from anyone.
Third, the figure is Cloudflare’s view of its own network, and it fluctuates daily. Prince himself called the data “a bit messy.” Treat 57% as a signal, not a precise census of the internet.
What it does say
Here is the part that survives all the caveats: the research layer of buying is being delegated to software, and the volume of that delegation is growing faster than the people closest to the data expected. Prince’s own comparison makes the scale concrete. A person might visit five websites before a purchase. An AI service doing the same job might visit five thousand.
That asymmetry is the whole story for merchants. Even if agents complete only a small fraction of transactions today, they are increasingly the ones doing the comparison work that decides which storefront a human ever sees. The shortlist is being compiled by something that does not look at your hero banner.
This is also why we would push back on framing this purely as a security or bot-management problem. Blocking bad bots still matters; AI scrapers consuming your bandwidth without sending you a customer is a real cost, and the industry fight over who gets to crawl what is far from settled. But somewhere inside that automated traffic is a growing slice that represents purchase intent wearing a machine’s user agent. Blocking it indiscriminately means blocking the researcher your future customer sent.
The uncomfortable questions worth sitting with
We will not pretend anyone has this figured out, including us. A few open problems we think every merchant should be tracking:
- How do you tell a customer’s agent from a freeloading scraper? Standards for agent identification are emerging but immature. Until they settle, every storefront is making this call with incomplete information.
- Who pays for the traffic? Site owners fund the servers and bandwidth. If most requests come from machines that do not view ads or click affiliate links, the economics that justified open product pages start to wobble. The web’s business model is being renegotiated in real time.
- How do agents choose? A human can be persuaded. An agent reads structured data, compares attributes, and drops slow or broken sources first. Nobody fully knows the ranking logic of each assistant, but it is safe to say clean product schema, accurate feeds, queryable pricing and availability, and fast, reliable infrastructure all matter more in this world, not less. They are quietly becoming conversion infrastructure rather than technical hygiene.
Our take
The honest read of Cloudflare’s data is that nothing about your human customers changed last month, and something about how they reach you is changing quickly. People still buy. People still spend their hours on the web. But a growing share of the path between a need and a checkout now runs through software intermediaries, and that share crossed a symbolic threshold years ahead of forecast.
The practical response is not to redesign your store for robots. It is to stop treating machine readability as an afterthought. Structured data, API quality, performance, and uptime have always been good practice. The shift is that they now have a second audience, one that evaluates thousands of options without fatigue and remembers exactly who was slow.
“Built for humans” is still the goal. “Built for humans only” is becoming a constraint. The merchants who internalize that distinction early will not need to win the agentic era. They will simply still be on the shortlist when it arrives.