AI-Powered Gray Bots Target Web Applications with Over 17,000 Requests Per Hour

Web applications are facing a growing challenge from “gray bots,” a category of automated programs that exploit generative AI to scrape vast amounts of data.

Unlike traditional malicious bots, gray bots occupy a middle ground, engaging in activities that, while not overtly harmful, often raise ethical and operational concerns.

Recent research highlights the scale of this issue, with some web applications receiving up to 17,000 requests per hour from these bots.

- Advertisement -

The Rise of Gray Bots

Gray bots are designed to harvest data for various purposes, such as training AI models or aggregating content.

They differ from “good bots,” like search engine crawlers, and “bad bots,” which are used for malicious purposes like account breaches or fraud.

Generative AI scraper bots, including ClaudeBot and TikTok’s Bytespider, have emerged as particularly aggressive players in this space.

Between December 2024 and February 2025, Barracuda’s detection systems recorded millions of requests from generative AI scraper bots targeting web applications.

One application alone received 9.7 million requests in a single month, while another experienced over half a million requests in just one day.

Notably, some web applications reported consistent traffic averaging 17,000 requests per hour an unusual pattern compared to the typical wave-like behavior of bot traffic.

Operational and Legal Implications

According to Barracuda, the aggressive nature of gray bots poses significant challenges for businesses.

Their relentless data scraping can overwhelm server resources, degrade application performance, and inflate hosting costs due to increased CPU usage and bandwidth consumption.

Moreover, the unauthorized collection of proprietary or copyrighted data may violate intellectual property laws and expose organizations to legal risks.

Gray bot activity also distorts website analytics by skewing metrics that businesses rely on for decision-making.

For instance, user behavior tracking and workflow analysis can yield misleading insights when bot traffic is indistinguishable from genuine user activity.

This distortion can lead to flawed strategies and poor business outcomes.

In industries like healthcare and finance, where data privacy is paramount, gray bots introduce compliance risks by potentially exposing sensitive customer information.

Furthermore, users may lose trust in platforms that fail to protect their data from unauthorized scraping or misuse.

Among the most active gray bots detected in early 2025 is ClaudeBot, developed by Anthropic.

This bot scrapes data to train Claude, a generative AI model designed for widespread use. Its high volume of requests has significantly impacted targeted web applications.

While Anthropic provides guidelines on blocking ClaudeBot via robots.txt files, this method is not legally binding and can be easily circumvented by less scrupulous actors.

TikTok’s Bytespider bot is another major player in this space. Operated by ByteDance, it collects data to enhance TikTok’s content recommendation algorithms and advertising features.

Known for its aggressive scraping tactics, Bytespider has drawn criticism for its lack of transparency and disregard for ethical boundaries.

Other notable generative AI scraper bots include PerplexityBot and DeepSeekBot, which have also been flagged for their high-volume activity.

To counter the growing threat of gray bots, organizations must adopt robust bot protection measures.

According to the Report, Solutions like Barracuda Advanced Bot Protection leverage artificial intelligence and machine learning to detect and block scraper bot activity in real time.

Techniques such as behavior-based detection and adaptive machine learning can help identify patterns unique to gray bots.

While deploying robots.txt files remains a common practice for signaling scrapers to avoid specific sites, this approach has limitations due to its voluntary nature.

Comprehensive security strategies are essential to safeguard proprietary data and maintain the integrity of web applications.

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!