Generative AI 'Gray Bots' Flood Websites with Millions of Daily Requests, Raising Security and Ethical Concerns

The Rise of Generative AI 'Gray Bots'

Recent research conducted by Barracuda has unveiled a new category of web crawlers known as "gray bots," which are powered by generative AI technology. These bots occupy a space between benign and malicious automated programs, raising concerns about their impact on web applications and data privacy 1

1

Gray bots are designed to extract large volumes of data from websites, potentially for training AI models or collecting web content such as news, reviews, and travel offers. While not overtly malicious, their activities blur the lines of legitimate online behavior 2

2

Staggering Scale of Bot Activity

Barracuda's detection data reveals the significant impact of these AI-powered bots:

• Between December 2024 and February 2025, millions of requests from GenAI bots were received by web applications.
• One tracked web application received 9.7 million GenAI scraper bot requests in just 30 days.
• Another application faced over half a million GenAI scraper bot requests in a single day.
• Analysis of gray bot traffic on a tracked web application showed consistent activity, averaging around 17,000 requests per hour 3

  3

  .

Potential Risks and Concerns

The prevalence of gray bots poses several challenges for website owners and organizations:

1. Data Privacy: Websites containing sensitive customer information, such as those in healthcare or financial services, may be at risk of unauthorized data extraction 1

   1

   .

2. Web Performance: The high volume of requests can overwhelm web applications, potentially disrupting operations and degrading overall performance 3

   3

   .

3. Copyright Infringement: Gray bots may collect copyright-protected data to train AI models, potentially violating intellectual property rights 1

   1

   .

4. Analytics Distortion: The presence of gray bots can skew website analytics, making it difficult for organizations to assess genuine traffic and user behavior accurately 1

   1

   .

Related Stories

AI Bots Surge to 1 in 31 Web Visits as Publishers Face Traffic Crisis and Arms Race

Cloudflare Unveils 'AI Labyrinth' to Combat Unauthorized AI Web Scraping

AI-driven bot attacks surge 12.5x as bad bots claim 40% of all internet traffic

AI Web Crawlers Pose New Challenges for Companies and Content Providers

Defensive Measures and Recommendations

To protect against GenAI gray bots and unauthorized data scraping, organizations can consider the following strategies:

1. Implement robots.txt: This code can be added to websites to signal that scraping is not permitted. However, it's important to note that this measure is not legally binding and relies on bot owners respecting the guidelines 3

   3

   .

2. Deploy Advanced Bot Protection: Utilize bot protection systems capable of detecting and blocking generative AI scraper bot activity. Features such as behavior-based detection, adaptive machine learning, and real-time blocking can help mitigate the threat 3

   3

   .

As the landscape of AI-powered web crawling evolves, organizations must remain vigilant and adapt their application security strategies to address the unique challenges posed by gray bots.