TECH & AI / INFRASTRUCTURE

The Internet Is Going Dark For Humans: AI Bots Will Outnumber People Online by 2027

Cloudflare's CEO just told SXSW something the tech industry has been dancing around for a year: AI agents don't browse the web - they flood it. The same infrastructure built for humans is about to be overwhelmed by machines. And this week's news proves the stakes are higher than anyone admits.

The internet was built by humans, for humans. Thirty years of infrastructure, protocols, and design assumptions rest on that foundation. The assumption is now wrong.

Matthew Prince, the CEO of Cloudflare - a company whose networks carry traffic for roughly one-fifth of all websites on earth - stood on the SXSW stage in Austin this week and said out loud what engineers have been whispering: AI bots will generate more web traffic than human beings by 2027. Not a rounding error. Not a niche phenomenon. A majority. Machines will own the internet.

The announcement landed with the quiet thud of a fact everyone suspected but nobody wanted to quantify. And in the same week, a ransomware attack on a breathalyzer company stranded tens of thousands of drivers across 46 states. Jeff Bezos was reportedly circling the globe hunting for $100 billion to use AI to gut and rebuild American manufacturing. And venture capital data confirmed that 41 cents of every dollar invested in startups in 2025 went to artificial intelligence.

These stories look separate. They are not. They are four edges of the same map - a map of an economy and an internet being rebuilt around machines, faster than anyone has a plan for.

Bot traffic share of internet has climbed from roughly 20% pre-GenAI to an estimated majority by 2027. Source: Cloudflare CEO Matthew Prince, SXSW 2026.

The Cloudflare Warning: What a Majority-Bot Internet Actually Looks Like

Prince's framing at SXSW was deliberately concrete. He didn't talk about AI in the abstract. He walked through what happens when a single person asks an AI agent to help them shop for a digital camera.

"If a human were doing a task - let's say you were shopping for a digital camera - you might go to five websites. Your agent or the bot that's doing that will often go to 1,000 times the number of sites that an actual human would visit. So it might go to 5,000 sites. And that's real traffic, and that's real load, which everyone is having to deal with and take into account." - Matthew Prince, Cloudflare CEO, SXSW 2026 (via TechCrunch)

That ratio - 1,000x more sites visited per task - is the key number. It's not that AI bots are doing things faster than humans. It's that they work differently. An AI agent completing a travel research task doesn't read five review sites. It queries dozens of booking engines, cross-checks pricing APIs, scrapes hotel metadata, reads hundreds of review pages, and compares dozens of flight combinations. Each "task" for the user becomes thousands of requests for the web.

Before generative AI reshaped the industry, Cloudflare estimated the web was approximately 20% bot traffic. The overwhelming majority of that was Google's web crawler. A small portion came from legitimate services - uptime monitors, archive crawlers, RSS fetchers. The rest was malicious: credential stuffers, scrapers, spam bots.

Now the category of "legitimate but voracious" AI bots has exploded. Every query to ChatGPT, Claude, Gemini, or any third-party AI assistant that needs real-time web data triggers multiple web requests. Every AI agent workflow that "browses" on a user's behalf multiplies that further. And the agentic future the industry is building - where AI agents autonomously manage tasks, check prices, file forms, research topics, and make reservations - hasn't even properly arrived yet.

A single AI agent task generates 1,000x more web requests than a human completing the same task. The infrastructure implications are severe.

Prince's projection is that sometime in 2027, the cumulative weight of this AI-generated traffic tips the balance. Bots become the majority of internet users. That inflection point has profound second-order effects that nobody is adequately planning for.

Infrastructure costs are the most immediate. During the COVID lockdowns of 2020, Netflix, YouTube, and Disney+ triggered a near-crisis in internet capacity - a rapid spike in video streaming that some European ISPs begged regulators to control. Prince's warning is that the AI traffic surge is analogous but slower and more relentless: no plateau in sight, and growing in both volume and complexity.

The economics of the web will also shift. Websites built on advertising revenue assume that traffic equals humans. When most of your traffic is AI agents - which don't click ads, don't fill out lead forms, don't subscribe - the core business model of the open web breaks. Publishers have already noticed AI crawlers consuming their content without driving any traffic back. That problem gets structurally worse as the bot-human ratio inverts.

The Infrastructure Cloudflare is Building - And Why It Matters

Prince didn't just diagnose the problem at SXSW. He outlined what Cloudflare is building in response, and his vision reveals how fundamentally the internet's plumbing needs to change.

The core concept is on-demand "sandboxes" for AI agents - lightweight isolated environments that can spin up in milliseconds when a user asks an AI to do something, execute whatever browsing or API interaction is needed, then terminate. Prince described a future where these sandboxes are created "as easily as you open a new tab in your browser," and where millions of them might be created every second.

"What we're trying to think about is, how do we actually build that underlying infrastructure where you can - as easily as you open a new tab in your browser - you can actually spin up new code, which can then run and service the agents that are out there." - Matthew Prince, Cloudflare CEO, SXSW 2026

This is a non-trivial engineering challenge. Current web infrastructure assumes persistent connections - browsers that stay open, sessions that last minutes or hours, users that navigate between pages with intent. The agent model is the opposite: massively parallel, ultra-short-lived, purpose-built bursts of traffic with no browsing "intent" in the human sense.

The closest analogy in existing infrastructure is serverless computing - AWS Lambda, Cloudflare Workers, Azure Functions - where compute spins up on demand and tears down immediately. Prince is essentially describing a version of that for network-layer agent execution. The difference is scale. Serverless functions run millions of times per day for large enterprises. AI agent sandboxes could run billions of times per day, globally, for anyone with a chatbot.

There's also the authentication problem. How do websites verify that an AI agent acting on behalf of a human actually has permission to do what it's doing? Current web auth is built for humans: cookies, sessions, OAuth flows with visual confirmation steps. None of that works cleanly when the "user" is a bot executing a task autonomously at 3 AM.

Cloudflare's position here is strategic. The company already sits at the network layer between the public internet and a significant portion of the web's servers. It already filters bot traffic. Now it wants to become the infrastructure layer for legitimate AI agents too - authentication, sandboxing, rate limiting, billing, and coordination. That's a massive business expansion dressed up as a technical challenge.

Intoxalock: When Critical Infrastructure Meets a Ransomware Gang

On March 14 - six days before Prince's SXSW talk - a cyberattack hit Intoxalock, a US company that makes ignition interlock devices: the breathalyzers that people convicted of DUI offenses must use to start their cars. Drivers across 46 states use the service. The attack took down the company's systems, and the cascading effect was immediate: thousands of drivers could not get their mandatory device calibrations, and cars literally would not start.

Drivers posting on Reddit described being unable to get to work. Auto shops in Massachusetts, Maine, New York, and Minnesota reported cars parked in their lots all week - vehicles physically immobilized not by any mechanical failure but because a piece of connected software could not reach its server. One shop in Middleboro, Massachusetts told WCVB Boston it had been accumulating stranded cars since the attack began.

The Intoxalock story seems disconnected from the Cloudflare announcement. It isn't. Both stories are about the same underlying shift: physical, real-world systems are now entirely dependent on network connectivity and cloud services that were never designed to be as critical as they've become.

Intoxalock's interlock devices don't just mechanically test breath samples. They phone home. They sync calibration schedules. They log driving data. They require periodic connectivity to a server to confirm compliance with court-mandated programs. The actual breathalyzer hardware became inert not because the hardware failed but because the software dependency was severed.

This is the pattern playing out across critical infrastructure. Cars need connectivity. Medical devices need connectivity. Industrial control systems need connectivity. Court-mandated monitoring systems need connectivity. Every one of these dependencies is an attack surface. And unlike a data breach - which is invisible and embarrassing - a ransomware attack on a calibration service physically strands tens of thousands of people who have done nothing wrong.

Intoxalock has not disclosed whether it paid a ransom, what kind of attack it was, or when full service will resume. That opacity is standard in ransomware cases, where disclosing negotiations can complicate them. But the company's technology is used in 46 states. The public interest in knowing the status of a system tens of thousands depend on to commute legally is higher than the company's interest in negotiating quietly.

Bezos, Project Prometheus, and the $100 Billion AI Manufacturing Bet

While Prince was warning SXSW about AI infrastructure, Jeff Bezos was reportedly in Singapore and the Middle East pitching sovereign wealth funds on a $100 billion bet.

According to sources cited by the Wall Street Journal, Bezos is raising a massive fund tied to his AI startup Project Prometheus - a company he co-founded alongside former Google executive Vik Bajaj. Prometheus launched with $6.2 billion in funding and focuses on building high-level AI models for manufacturing, engineering, aerospace, and automotive sectors. The new $100 billion fund would acquire companies in those sectors - chipmakers, aerospace firms, defense contractors - and then apply Prometheus' AI models to transform them.

The logic is vertically integrated AI disruption at industrial scale. Instead of selling AI tools to manufacturers and hoping they adopt them, Bezos wants to own the manufacturers and apply the tools directly. It's the same move Amazon made in retail: don't just sell to businesses, become the business, then automate it.

Project Prometheus represents something structurally different from the consumer AI land-grab happening at OpenAI and Anthropic. Those companies are fighting for the interface layer - who handles your queries, who runs your agent, who processes your workflows. Prometheus is targeting the physical layer: the factories, the supply chains, the aerospace systems that actually produce things in the world.

If successful, this creates an economy where AI-automated factories - owned or controlled by a Bezos-aligned fund - outcompete traditional manufacturing on cost, speed, and quality by margins that human labor simply cannot match. The capital requirement alone ($100 billion to start) signals how Bezos reads the timeline: this needs to happen in years, not decades, and it requires controlling physical assets, not just licensing software.

AI companies are raising at historical scale. The pattern reveals a race to lock in dominance before any regulatory framework can catch up. Sources: TechCrunch, Crunchbase, company filings.

The Venture Capital Reckoning: AI Has Eaten the Industry

Carta's Q4 2025 fund performance report, released this week, confirmed what anyone watching deal flow already knew: AI has not just attracted venture capital interest, it has absorbed venture capital itself. AI startups accounted for 41% of the $128 billion raised by companies on Carta's platform in 2025. That's a record high - and a number that overstates concentration because it excludes the even larger AI rounds done through direct institutional channels.

The top of the distribution is staggering. OpenAI raised $110 billion in early 2026 in one of the largest private funding rounds in history - a round that moved the company toward a $1 trillion valuation. Anthropic raised $30 billion at a $380 billion valuation in February. xAI, Elon Musk's AI company, raised $20 billion in January. Three companies, three months, roughly $160 billion in capital.

AI startups claimed 41% of all venture dollars raised on Carta in 2025 - a record share. The concentration accelerated further in Q1 2026. Source: Carta Q4 2025 Fund Performance Report.

Peter Walker, Carta's head of insights, noted the K-shaped nature of the market. Capital is concentrating in fewer funds backing fewer companies at much larger round sizes.

"While funding rounds have gotten slightly harder to raise, the capital for each round has increased. So fewer bets, but more capital. AI startups are raising bigger rounds not because they have lots of employees - they don't - but because the cost of running AI models is high." - Peter Walker, Head of Insights, Carta (via TechCrunch)

The underlying pressure is compute costs. Training large models and serving inference at scale requires infrastructure expenditures that traditional software startups never faced. OpenAI reportedly spends billions per quarter on compute. That spend justifies the multi-billion rounds because without sustained capital, you simply cannot keep the servers running. The VC market has effectively transformed into an infrastructure financing vehicle for compute-hungry AI companies.

Early fund returns look strong. Carta's data shows that funds raised in 2023 and 2024 - post-ChatGPT - are posting higher IRRs than older vintages. But Walker's caveat is important: early IRR in venture is often a paper phenomenon. A seed investment looks great when the company raises a Series A at a higher valuation, but no cash has changed hands. The real test comes at exit - IPOs, acquisitions - and those are still mostly pending for the AI generation. OpenAI, Anthropic, and xAI have all teased IPOs, but none have materialized yet.

The bubble or breakthrough question remains genuinely open. The compute thesis is real: these models actually work, they generate real revenue, and enterprises are spending real money deploying them. But the valuations price in a winner-take-most dynamic that assumes current leaders maintain their leads for a decade. History suggests that's almost never how platform transitions play out.

DoorDash's Gig Workers Are Now Training the Robots

One story this week landed without much notice, but it deserves more: DoorDash launched a standalone "Tasks" app that pays its delivery couriers to generate AI training data. Couriers can earn money by filming themselves performing everyday physical tasks - washing dishes, navigating entrances, handling packages - or recording themselves speaking in other languages.

The footage will be used to train AI models and robotic systems, both DoorDash's internal models and those of its partners in retail, insurance, hospitality, and tech. DoorDash's own blog post described the goal as helping "AI and robotic systems understand the physical world."

The structural irony is precise. DoorDash couriers are being paid to generate the training data that will eventually make AI-powered delivery robots capable enough to replace them. The gig economy workers who powered the first wave of platform capitalism are now financing the machine learning infrastructure of the second wave - which doesn't need them.

Uber announced a similar program in late 2025, offering drivers income from AI data labeling tasks. Both companies frame this as a benefit - more earning opportunities for flexible workers. What it actually describes is a transition period: the humans are still needed to teach the machines what the physical world looks like, and this is the cheapest way to gather that data at scale.

DoorDash has a partnership with Waymo where couriers are paid to close the doors on Waymo's self-driving delivery cars. That detail - humans manually compensating for a gap in robot capability, while simultaneously training AI to close that gap - captures the current moment exactly. The gig workers are the scaffolding around a machine that's still being built.

The Timeline of a Web Takeover

What Happens When the Bots Win

The "bots outnumber humans" threshold is not just a statistics curiosity. It's a structural inflection point with concrete consequences across several systems simultaneously.

Website economics break. The advertising model assumes that a page view is a human with purchasing intent or brand awareness. When the majority of page views are AI agents collecting information - and not buying anything, not seeing ads, not subscribing - the revenue math collapses. This is already happening at publishers who report that AI crawlers now represent a significant fraction of their traffic. The inflection point makes it the majority. Publishers will need to charge AI companies directly for access, or wall off their content entirely. Both options restructure the open web.

Infrastructure costs redistribute. AI agent traffic is more compute-intensive per request than human traffic. Agents don't just fetch a page - they often fetch dozens of resources in parallel, execute JavaScript, parse complex structures, and follow multiple redirects. CDNs, hosting providers, and bandwidth suppliers will see costs rise while the human traffic that historically justified those costs stagnates. The economics get passed down in ways that will affect small website operators disproportionately.

Cybersecurity changes fundamentally. When bots are the majority, distinguishing "legitimate" traffic from attacks becomes harder. Current CAPTCHA and bot detection systems are calibrated for a world where most traffic is human. In a majority-bot world, security systems have to verify bot credentials, not just screen out bots. The Intoxalock attack is a preview: attackers will target the AI agent infrastructure itself, not just the data it processes.

Regulation will lag badly. There is no regulatory framework for AI agent traffic. No disclosure requirements for when a human is using an AI agent versus browsing personally. No liability rules for damage caused by an AI agent acting on someone's behalf. No standard for what websites are obligated to serve to AI agents versus humans. Legislators are still arguing about AI in the abstract while the network-layer transition is already underway.

Prince's proposed solution - Cloudflare-operated sandboxes for AI agents - is plausible but centralizing. If the internet's agent layer runs on Cloudflare infrastructure, Cloudflare becomes an extraordinary chokepoint for the next generation of internet access. That's a significant concentration of power in a single private company, dressed up as an infrastructure service. The potential for surveillance, filtering, and control is substantial.

The alternative - decentralized agent protocols where AI systems negotiate access with websites directly - exists mostly in research papers and early protocols. Projects like Anthropic's Model Context Protocol and various agent-to-agent communication standards are early attempts to build the plumbing. They are nowhere near ready for the volume Prince is describing.

What's clear is that the window for proactive design is closing. The 2027 inflection point - if Prince's estimate is right - is 12 months away. The infrastructure, legal frameworks, and business models that will handle a majority-bot internet need to be built before the transition completes, not after. And based on this week's news, the industry is far more focused on raising its next $100 billion than on answering that question.