AI Bots Target Commerce in 2026: Akamai Report Reveals Escalating Threats

Akamai's latest report reveals that commerce has become the most targeted industry by cybercriminals, with AI bots constituting 47.9% of all commerce traffic as of December 2025. The report highlights a significant rise in API web attacks, which grew by 9% from Q4 2024 to Q4 2025, surpassing traditional application attacks. Threat actors are increasingly exploiting APIs as entry points to access sensitive customer data, with commerce accounting for 49% of all web attacks against API endpoints. Despite the prevalence of automated bot activity, organizations are hesitant to block bots entirely due to the risk of excluding legitimate customers. The report indicates that over 90% of Akamai-categorized AI bots are monitored for behavior to distinguish between legitimate and malicious traffic. Additionally, 85% of commerce organizations reported at least one API-related security incident in the past year, primarily due to misconfigurations and lack of dedicated security tools. The findings underscore the urgent need for enhanced security measures in the commerce sector.

Key Points: • Commerce is now the most targeted industry by cybercriminals, with 47.9% of traffic from AI bots. • API web attacks increased by 9% from Q4 2024 to Q4 2025, surpassing traditional application attacks. • 85% of commerce organizations experienced API-related security incidents due to misconfigurations.