SAN FRANCISCO, 11 AUG 2026 — Machine traffic overtook human traffic on Cloudflare's network in May. The company had been predicting that crossover for 2027, and it arrived early enough that the chief financial officer used an earnings call to say what he thinks comes next.

"If the current trends continue, we think in five years, non-human traffic will be as much as 1,000 times as much as human traffic," Thomas Seifert told analysts on 6 August. "In other words, humans will be a rounding error on the internet."

What was actually claimed, and by whom

Two different statements are bundled in that quote and they deserve separating.

The first is a measurement. Cloudflare says machine-generated requests passed human ones across its network in May 2026. Cloudflare sits in front of a large share of the web, so this is a substantial sample, and it is the company's own instrumentation rather than a survey.

The second is an extrapolation, offered on an earnings call by the officer whose job is to explain why revenue will keep growing. A thousand-to-one ratio in five years is not a measurement. It is a trend line drawn forward by someone with an interest in where it points.

Both can be true. It is still worth noticing that the company reporting the flood also sells the levee. Cloudflare's Q2 revenue was $696 million, up 36 per cent year on year, and it raised full-year guidance to between $2.864 billion and $2.870 billion.

Over 50%Share of network traffic now non-human, per Cloudflare's Q2 slides.
1,700%Rise in daily AI agent requests against the prior-year period.
May 2026Crossover month. Cloudflare had previously forecast 2027.
1,000×The CFO's five-year projection for non-human over human traffic.

The 1,700 per cent figure is the one doing the most work. A share of traffic can cross 50 per cent because human traffic fell; a seventeen-fold rise in daily agent requests cannot be explained that way. Whatever else is arguable, the agent volume is compounding.

Why the crossover happened early

The 2027 estimate was made before assistants started browsing on their users' behalf at scale.

A person reading an article generates one request. An agent answering a question about that article may fetch it, fetch what it links to, and do the same again for three competing sources — and it may do that every time somebody asks, because a model with a retrieval step does not have a memory of yesterday's page. Add training crawlers on top, which fetch broadly rather than in response to any user at all.

So the ratio is not really humans-versus-bots. It is one human question turning into a variable and growing number of machine fetches, and nothing about that conversion rate is fixed.

What it does to the economics of publishing

The number stops being a curiosity when it hits a publisher's economics.

The advertising-funded web assumed a rough proportionality between the cost of serving a page and the chance of being paid for it. A human arrives, sees an ad or a subscription prompt, and some fraction of the time that pays for the bandwidth.

Machine traffic breaks the proportion in both directions at once. Serving costs rise with every crawl, and the revenue event moves somewhere the publisher cannot see: into an answer, generated elsewhere, that may not cite the source and certainly does not display its advertising.

Publishers have responded in three ways so far — blocking crawlers, charging them, or, as we reported when Time began serving a different version of its site to AI crawlers, writing content specifically for the machines and selling placement inside it. That last one is the tell. When a publisher starts producing pages no human will read, it has already accepted that the machine audience is the one being monetised.

It quietly breaks measurement too

The shift hits web analytics before it hits the balance sheet.

Web analytics counts events, and every layer of the stack has its own idea of which events are real. Server logs see every request. A JavaScript beacon sees only clients that execute JavaScript, which historically was a decent proxy for "a person" and is a worse one every quarter as agents get better at rendering. Filters for known bots work on a list, and the interesting traffic is the part not on it.

The practical consequence is that two dashboards over the same site can disagree by a wide margin and both be correct about what they measured. When machine traffic was a rounding error the discrepancy did not matter. At a majority it decides whether a report is describing an audience or a workload.

Anyone publishing a traffic figure should now be able to say which layer produced it and what it excludes. That is a small documentation discipline, and it is the difference between a number that means something and one that merely exists.

The security argument is the stronger half

Seifert's framing on the call ran through infrastructure efficiency and security threats, and the security half is more concrete than the traffic ratio.

Defences built around human behaviour degrade as the ratio shifts. Rate limits calibrated on what a person can plausibly do, bot-detection heuristics that assume automation is rare and therefore suspicious, CAPTCHA as a gate — all of them assumed machine traffic was the exception. When it is the majority, "is this a bot" stops being a useful question and "is this bot permitted, and doing what it said it would" becomes the only one worth asking.

That is a different engineering problem. It needs identity for agents, declared purpose, and enforcement against the declaration, none of which the web currently has in any agreed form.

How to read a number like this

Treat the May crossover as reported fact from a large but single vantage point, and the thousand-to-one figure as a directional claim from an interested party.

For anyone running a site, the useful question is narrower and answerable today. Find out what fraction of your own traffic is automated, which of it you want, and what it costs to serve the rest. That is a log query, not a forecast, and the answer will be specific to you rather than to Cloudflare's network.

What to watch

Look for comparable figures from other large networks. One company's measurement is a data point; agreement between several would make it a fact about the web.

Agent identity is another open question. Every proposal so far relies on crawlers to declare themselves honestly, a system that works right up until the moment it becomes expensive.

Finally, watch the ratio itself. Does it keep accelerating, or does it settle? A thousand-to-one assumes the number of machine fetches per human question keeps climbing. Cheaper caching and better retrieval would push the other way, and both are being worked on hard for reasons that have nothing to do with anyone's traffic bill.