Your Users may not be Human

In June 2026, Cloudflare confirmed that machines now generate more web traffic than people. Roughly 57% of requests for web pages across their network are automated, a figure you can watch move on Cloudflare Radar. At SXSW three months earlier, their chief executive Matthew Prince had told an audience the crossover would happen in 2027. By his own account he had privately walked that forecast forward twice, from the end of 2027 to early 2027, and it still arrived earlier.

His post about it offers a staggering perspective:

Welp, that happened faster than I predicted. Thought it would be end of 2027, then early 2027, but agentic traffic growing so fast that bots have now passed human traffic online for the first time in the Internet's history.

Matthew Prince, Cloudflare

The man with the best view of the internet's plumbing was eighteen months out on his own forecast. The people best positioned to see it were surprised by their own prediction being out-paced.

What this actually means

Before drawing conclusions, let's examine where this number actually comes from.

Cloudflare's figure measures HTTP requests for HTML content across the sites they front. Not video, not email, not APIs, and not the internet as a whole. It settled somewhere between 57.3 and 57.5% depending on which day you read it, and Prince's own caveat was blunt: the data is "a bit messy (so charts are too). But clearly on the other side now." It is a measure of requests, not sessions, not revenue, and not intent.

In Cloudflare's June 2026 bot report, roughly 52% of crawler requests were for AI training, 36% were mixed purpose, and pure search crawling was described as small and declining. Training was 22% in spring 2025, so the direction is not subtle. Googlebot dominates combined AI and search crawling; GPTBot and ClaudeBot are the largest AI-specific crawlers, and they trade places month to month. A large share of the 57% is therefore not an agent doing something on behalf of a person. It is a machine reading your site to build a model.

But the growth is not in the training half. It is in the agentic half: an assistant checking a price, comparing two flights, filling a form, completing a booking. Stripe and OpenAI shipped the Agentic Commerce Protocol and Instant Checkout, Salesforce added support, Airwallex building agentic commerce, and the plumbing for machines transacting on your site now exists natively in the most popular AI platforms.

Considering this, a more accurate description of what's happening would be: a small but rapidly growing share of the traffic hitting your product is a software agent trying to accomplish a task for a person who is not present.

A new user to consider

Mature product teams have a sophisticated methodology for understanding human users. Analytics with funnels and drop-off. Session replay. Heatmaps. Error boundaries wired to alerting. Usability sessions, moderated and unmoderated.

Now consider what any of that tells you about an agent.

Time on page for a client that parses the DOM in four hundred milliseconds. Scroll depth is meaningless for something that never scrolls. Hover states, rage clicks, mouse movement heatmaps: all of them measure proxies for human attention, and none of the proxies tell us anything about the success and intentions of a non-human user. Where a two-second extraction visit registers as a bounce, it may not be.

The instrumentation is not merely thin here, it is actively misleading, and it is doing so at a scale growing faster than the best predictions.

What breaks in practice is not yet well studied, which is itself part of the problem. The clearest evidence we have comes from BrowserArena, an open evaluation of browsing agents on real web tasks, which found three consistent failure modes: CAPTCHA resolution, pop-up banner removal, and direct navigation to URLs. Beyond that we are mostly reasoning from first principles, and the principles point at forms that depend on hover states, custom JavaScript submit handlers with no native form semantics, unlabelled inputs, infinite scroll with no pagination, and content that arrives three async hops after the HTML does. Treat that second list as informed engineering judgement rather than measured fact, because nobody has measured it properly.

An agent hits one of these, fails silently, and leaves. Nobody files a ticket. Nobody rage-quits in a session replay you can watch back. The failure produces no artefact at all and agents will simply choose an alternative provider to complete their task, creating invisible opportunity cost for brands not addressing this new audience.

Gartner puts it more starkly for anyone selling software: "By 2028, 90% of B2B buying will be AI agent intermediated, pushing over $15 trillion of B2B spend through AI agent exchanges."

Nobody can ask the most important design question: and why?

User-centred design methodology traditionally assumes you observe behaviour, which gives you the what, then ask about intent, which gives you the why. Usability testing without a think-aloud protocol is just watching someone struggle. Contextual inquiry, jobs-to-be-done interviews, diary studies, the post-task debrief: every qualitative method we have today assumes a subject who holds a reason and can be prompted to surface it.

How would you assess the perspective of an agent using your product, and the intent of the human behind it?

Let's start with the practical problem: you cannot easily recruit an agent. There is no screener, no incentive, no scheduling link, no channel back to it of any kind. It arrives, it acts, it leaves. The party who could explain the behaviour is a model running inside somebody else's product, under a system prompt you will never see, orchestrated by a loop you have no visibility into.

And the "why" is genuinely split in a way that has no human equivalent. When an agent abandons your checkout, the cause might be your form. Or the model's tool-calling loop. Or a safety refusal. Or a context window running out. Or an instruction the human gave three turns earlier that you will never read. Behind every agent session is a human intent, compressed into a prompt, then transformed by machinery you do not control. Session replay would show you a cursor that was never there.

So the discipline loses both halves at once. Quantitative instrumentation stops measuring anything real, and qualitative research loses its subject entirely. For the fastest-growing segment of users on the internet, we have neither numbers we can trust nor a person we can talk to.

That is not just a tooling gap, it is a methodological one.

The only agent you can interview is one you run

Synthetic participants have a bad reputation in research circles, and mostly they have earned it. Simulating a human user is an attractive proposition, because real people are expensive, slow to recruit, and hard to schedule, and you spend the rest of the study caveating how far the outputs may sit from the real thing. The criticism is fair. A model's guess at what a nurse in Leeds would find confusing is not evidence about that nurse, and previous human research is not evidence of future behaviour. But the shortfall lies with the operating model, not the idea. Most synthetic participants project a future assumption from historical research without ever using the product they are being asked about, and they are unapologetic about positioning their outputs as human when they never can be.

A simulated agent is not a lesser stand-in for a real agent. It is the same but with the added observability and control required for qualitative analysis. Both are a model with a goal, a set of tools, and a browser. The advantage of the one you run is that it is fully instrumented: you set its goal, you watch every action, you capture everything it saw, and when it finishes you can ask it what it expected to happen and why it did what it did.

Observe behaviour, interrogate intent, iterate an improvement. User-centred methodology, for a class of user that otherwise offers you none of it.

Presenting these findings with the right framing is essential, so we set two rules about anthropomorphism:

• When the user is a machine, you need a machine to act like that user.
• When the user is human, a machine cannot, and should not, be identified as or represent a person.

This is not a hypothetical for us. It is what Stunt Double was built for. We call them actors, because they act rather than impersonate: real browsers, real products, real goals, with preferences and varying patience. They never use human personas, names, or identities. We built them to give teams early validation in a controlled and automatable environment. What we did not anticipate is that they turn out to be the only honest way to study the non-human half of your traffic, and the speed and scale at which this new category of user is growing.

Where this gets overstated

While I belive in a future full of agentic users, there are several caveats.

57% is requests, not value. A crawler making ten thousand cheap requests is not 57% of your business. Do not let the headline number become a budget argument on its own.

Most of it is still training crawlers, not agents acting for users. The genuinely agentic slice is small. It is growing fast, and fast growth from a small base is exactly what caught Cloudflare out, but "your users are increasingly agents" and "most traffic is bots" are different claims and only the second one is currently supported.

Your mix is not the network average. Cloudflare measures HTML requests across the sites it sits in front of. Your product is not that average. Segment your own traffic before you rebuild anything, and be ready to find your particular corner is 90% human, or 90% machine.

Adobe's encouraging numbers are about people, not machines. AI-referred retail traffic converting better than other channels is a story about humans arriving from an assistant, not about assistants buying things. The two get conflated constantly and they imply completely different work.

And "designing for agents" is mostly just designing well. The concrete fixes are semantic HTML, real form elements, labelled inputs, structured data, and content that exists without waiting on three JavaScript bundles. That is the accessibility work that should already have been prioritised. Agents are simply the first users to fail loudly enough, and in large enough numbers, to turn it from a moral argument into a commercial one.

Three things to take-away today

Segment agent traffic out of your analytics. Not to block it, just to stop it contaminating your human metrics. A two-second extraction visit is not a bounce, and until the two populations are separated, every number you look at is an average of two things that have nothing in common.

Run your critical flows the way an agent would. Keyboard only, no hover, no visual affordances, semantic DOM only. Whatever breaks is already breaking silently, today, at volume. Or employ an actor to walk those flows and capture the evidence for you.

Get a subject you can question. This is the part with no workaround. If a growing share of your users cannot be recruited, cannot be observed properly, and cannot be interviewed, then the only path back to evidence is running the agent yourself.

Twenty years of software design methodology point at one conclusion: the best outcomes come from talking to the people using your product. Machine users are now the majority of the requests and the fastest-growing share of the intent. So the question worth arguing about is not whether to keep doing user-centred design. It is what "user" is going to mean.

If you want to see what that looks like in practice, try Stunt Double.