Lumen CEO: AI bots now generate more than half of global internet traffic

Lumen CEO Kate Johnson has warned that AI bots now generate more than half of global internet traffic. For business, this is no longer a curious statistic but a signal: automated agents speed up services and widen the attack surface at the same time.

Why traffic is changing

The internet was long built around human actions: opening a page, sending an email, clicking a button, uploading a file. Now a growing share of requests comes not from people but from software agents, from support systems and search crawlers to internal assistants that look up data, check statuses and perform routine tasks on their own.

If such traffic already exceeds half, as the Lumen chief says, corporate networks and public services are increasingly interacting in machine-to-machine mode rather than user-to-server.

This changes the network load profile itself. Bots work faster than people, repeat the same operations more often and can hit services around the clock without pauses. As a result, familiar filtering rules, request limits and monitoring methods reflect the real picture less accurately. What used to count as a spike of suspicious activity may now turn out to be legitimate automation. The reverse is also true: it is easier to hide unwanted scanning, vulnerability probing or quiet data exfiltration behind bot traffic that looks normal.

Where the business risk lies

The problem for companies is not the growth of bots as such, but the fact that useful and malicious agents use the same infrastructure. The network, contact center, website forms, APIs and analytics face a stream of requests where intent is increasingly hard to judge from outward signs. In this environment, businesses have to rethink not only perimeter defense but also how customer scenarios, billing, data access and request prioritization are built.

• Support teams receive more automated inquiries and must distinguish real customers from bot agents.
• Security teams see more background traffic, in which scanners, parsers and attacks are easier to mask.
• Infrastructure costs rise if bot requests load APIs, CDNs, databases and external integrations.
• Product analytics and marketing get distorted metrics if some of the "users" are in fact agents.

Hence the shift in management logic: it is no longer enough to keep a site available and answer tickets quickly. Companies need to understand exactly who is calling the system, at what speed, with what behavior pattern and to which data. For some companies this means stricter identification of customers and bots; for others, a review of rate limits, anti-bot protection, network segmentation and access rules for internal services.

What companies will change

The Lumen statement matters because it comes not from a chatbot developer but from a major network player that looks at infrastructure at scale. If most traffic is already generated by machines, businesses will have to design services on the assumption that agents are always present. This applies to external products and internal operations alike: from customer support to vendor monitoring, financial systems and corporate assistants.

In practice, companies will invest in behavioral traffic analysis, separate policies for humans and machines, API protection and more precise telemetry. Trusted partner bots and a company's own AI agents are a separate question: they need controlled access, clear limits and action logging. Otherwise, automation that was meant to speed up processes will start creating bottlenecks, false positives and new channels for leaks.

What this means

The internet is quickly becoming an environment where machines serve, check and attack other machines. For business, the winners will not be those who simply add one more AI bot, but those who learn to see all automated traffic as a whole and manage it as a separate layer of digital infrastructure.