GenAI scraper bots have been found to target websites 24 hours a day with up to half a million requests, a new report by security firm, Barracuda Networks. The threat report has called them ‘grey bots,’ which although not malicious scrape through large volumes of data while burdening the web traffic. 

The report stated that between December last year and February this year, millions of requests were submitted from GenAI bots like ClaudeBot and TikTok’s Bytespider bot to collect information from web applications.

In one instance, a web app received 9.7 million GenAI scraper bot requests over a month. In another, a web application received more than half a million GenAI scraper bot requests in a single day. 

According to the study, the bots were consistently targeting web applications leading to 17,000 requests per hour.

“GenAI gray bots are blurring the boundaries of legitimate online activity,” said Rahul Gupta, Senior Principal Software Engineer, Application Security Engineering at Barracuda. “They can scrape vast volumes of sensitive, proprietary, or commercial data and can overwhelm web application traffic and disrupt operations. Frequent scraping by these bots can degrade web performance, and their presence can distort website analytics leading to misleading insights and impaired decision-making.”

Normally, websites add robots.txt in their code as a signal that scrapers can’t steal data but this isn’t legally binding. GenAI scraper bots have taken to ignore this guideline now.