A post going around lines up five figures on AI agent traffic: the crossover past human traffic in May, a 60.6% against 39.4% split, Cloudflare’s forecast of bots generating a thousand times more traffic within five years, 450% more traffic per task, and 100 Pbps from a hundred thousand Starlink satellites, attributed to Elon Musk.

I opened the source for each one. The phenomenon is real and documented, nearly all the numbers exist, and nearly none of them says what the post has it say.

The crossover, and of what

Cloudflare declared the crossover on its second-quarter 2026 analyst call, on 6 August: “For the first time in human history, in Q2, more than 50% of the traffic flowing across Cloudflare’s network was not human”. On the company blog, on 1 July 2026, the same thing reads “more than 50% of traffic on the Internet is now non-human”, and the press release of 13 July says “roughly 57% of all web requests”.

The denominator moves the result by twenty points. The figures above 50% hold for requests for HTML content, not for all HTTP traffic, and Cloudflare says so: “because we are focusing on just HTML content here, the bot and human shares of traffic will differ from that shown on Radar, which analyzes request traffic for all content types”. On the public Cloudflare Radar page, which counts every request, the automated share through 2026 hovers around a third. Read the 57% and then open Radar and you find a different number, on the same network.

The post dates the crossover to May and reports 60.6% against 39.4%. The statement refers to the quarter, Matthew Prince announced it on 3 June 2026, and that pair of percentages appears in no Cloudflare document.

What non-human traffic is made of

The last breakdown by bot type Cloudflare published is dated 2 December 2025, in the Radar Year in Review, on HTML requests: humans 47%, bots not attributable to AI 44%, AI bots 4.2%, Googlebot 4.5%. The non-human part was almost entirely conventional automation, and AI crawlers were a twentieth of it.

For the 57% of 2026 no equivalent breakdown appears to have been published. So the sentence “AI agents have overtaken humans” has, today, no measurement behind it: what crossed the halfway mark is non-human traffic as a whole. For crawlers alone Cloudflare does publish the declared purpose: as of June 2026, 52% of requests are for training, against 22% in spring 2025, with more than 36% classed as mixed.

The two thousand-fold projections

On the same call of 6 August the full sentence runs: “with the big caveat that I have called it wrong at every point along the way, if the current trends continue, we think in five years, non-human traffic will be as much as 1,000 times as much as human traffic”.

The post keeps the number and drops three things: the condition, the ceiling (as much as, not “equal to”), and the subject, which is non-human traffic rather than bots. The figure appears neither in the results release nor on the blog: it exists only in the spoken part. The transcripts I read attribute it to chief executive Matthew Prince, some outlets to chief financial officer Thomas Seifert.

There is then a second “thousand times”, from March 2026, measuring something else: at SXSW Prince said that for a task where a person would visit five sites, the agent visits “1,000 times the number of sites”. One is a ratio between aggregate volumes five years out, the other the intensity of a single task. The two get swapped often.

The 450% and the 9x

Both figures come from the same document, the Cisco report AI Impact on Wide Area Networks of May 2026, and they belong to different categories.

The 450% reads “up to 450% more total traffic […] per task when performed by an agent”, and figure 7 derives it from a single test: one agent, LangChain’s Open Deep Research, on one public-information gathering task, 44 sources visited, 26.8 MB of traffic in total. The human baseline is never measured: the report writes that the traffic would be “much larger than the network traffic generated if the same task was performed manually by a human”, in the conditional and with no figure. It is a ceiling observed in one case, over a denominator the document does not state.

The 9x is marked twice as “Source: Cisco model”, concerns enterprise traffic and runs to 2035. In the same report the agentic traffic measured today is described as “currently small but growing fast”. Placing the two side by side, as the post does, suggests both are observations: one is a lab test, the other a projection.

Cisco sells network equipment, and the tool used for the measured part of the report is one of its own products. The document states no sample, no variance and no raw data.

The 100 Pbps

This figure is not Musk’s. On 9 August 2026, at 19:43 UTC, Aaron Burnett writes on X that “100,000 V3 Starlinks equals 100 Pbps”. An hour later, at 20:45, Musk joins the same thread with a different sentence: “AI agentic Internet traffic will obviously VASTLY exceed human usage. Not a close call at all. Cloudflare’s forecast is accurate”. No petabit figure, and the forecast he endorses is Cloudflare’s.

The arithmetic itself holds, since the V3 satellite is designed for 1 Tbps of downlink. What it adds up, though, is the nameplate capacity of a constellation that does not exist. SpaceX filed with the FCC on 30 June 2026 for up to 100,000 Gen3 satellites; the authorisation in force, from 9 January 2026, stops at 15,000. In orbit in August 2026 there are about 11,000 Starlink satellites and no operational V3. In the Form S-1 filed with the SEC on 20 May 2026 SpaceX states “over 700 Tbps of cumulative downlink capacity”: 0.7 Pbps, roughly one hundred and fortieth of the figure quoted, and that one is a statement made under SEC liability.

The missing number

The post builds its asymmetry on volumes. The asymmetry that gets measured is about the exchange: how many pages an operator takes for every visitor it sends back. Cloudflare has published the metric since 1 July 2025, and in the 2025 monthly series Anthropic’s ratio falls from 286,930 to 38,066 between January and July, OpenAI’s from 1,217 to 1,091, while Google’s rises from 3.8 to 5.4.

Two caveats sit in the source itself. The ratio is a network aggregate and shifts a great deal by sector: in the week of 1 to 7 August 2025 Anthropic is 50,000:1 unfiltered and 2,500:1 for news, which is the sector under discussion. And the denominator does not count referrals from native apps, which send no Referer header — Cloudflare says as much for Claude — so the ratio is inflated precisely for the operators used mostly in-app.

For 2026 those per-company ratios have moved inside Radar and a dashboard reserved for Enterprise customers. The 2026 figures circulating in summaries have no primary source: for Anthropic there are at least five different ones for the same quarter, from 2,237:1 to 10,300:1, all credited to “Cloudflare Radar” with neither address nor date of access.

On the arrivals side, Chartbeat measures pageviews from Google Search down 34% between December 2024 and December 2025, with small publishers at -60%, and chatbots below 1% of pageviews: 200% growth on a base under 1% does not make up the difference. It is the same phenomenon seen from the publisher’s side.

The tools that exist

Anyone wanting to regulate that traffic has two declarative levers today, and neither binds.

The first front is declaring preferences. robots.txt has been standardised by RFC 9309 since September 2022, and the text says of itself that it authorises nothing: “These rules are not a form of access authorization”. The IETF AI Preferences group is working on a vocabulary for expressing usage preferences, but the document defining how to attach them to content, draft-ietf-aipref-attach, has stood at revision 04 since October 2025 and has expired. Across 200,000 domains measured by Cloudflare in April 2026, 78% have a robots.txt and 4% declare AI usage preferences in it.

The second front is the identity of whoever knocks. The cryptographic building block is a published standard, RFC 9421 of February 2024, but the IETF Web Bot Auth group had adopted no document as of August 2026, so implementers follow an individual draft. Google signs some agents and calls the arrangement experimental; the ChatGPT agent signs and publishes its keys, while OpenAI’s crawlers still identify themselves by User-Agent and address ranges; on AWS the feature is in preview and off by default.

The two fronts solve disjoint problems, and neither solves compliance: an agent can sign its requests in cryptographically impeccable fashion and ignore everything the site declares. The sources say so themselves, RFC 9309 and the AWS documentation. What remains is the problem of recognising an agent before you can stop it, which is where the operational constraint sits.

Limits

Every share quoted here comes from a single operator’s network, and the composition depends on the sites that operator protects: these are not measurements of the web. The breakdown by bot type I use is dated 2 December 2025, so on the agentic part of the 57% of 2026 I say nothing, because the figure is not published.

I did not read the official transcript of the 6 August call: I worked from two third-party transcripts that match word for word on the passage quoted, and that remain at odds with the outlets over attribution to Prince or to Seifert. The Cisco PDF answers 403 to non-browser clients and I read it from a Wayback Machine copy. I did not open the posts on X directly, as the site answers 402: the texts come from search engine indexing and the timestamps are computed from the post identifiers. I did not read the FCC filing in full, only the docket number and the quotations reported by two trade outlets.

Cover image: pneumatic road tube counter, photo by Z22, 2015 — CC BY-SA 4.0 — https://commons.wikimedia.org/wiki/File:Pneumatic_road_tube_counter.jpg