In September and October 2026, Russia experienced a series of DDoS attacks involving bots that mimic legitimate AI agents. StormWall reports that attackers are using these deceptive tactics to bypass standard security filters by spoofing HTTP User-Agent headers, such as GPTBot or ChatGPT-User.
The primary targets of these attacks in September included media outlets, which accounted for 32% of incidents, followed by online retailers at 26%, banks at 17%, and telecommunications companies at 14%. Attackers specifically targeted platforms that allow AI search bots to index their content.
Identifying these malicious bots is challenging because they use current identifier versions. However, security experts note that these bots differ from genuine AI agents by making requests to APIs and other non-standard website sections. StormWall predicts that such AI-mimicking traffic could reach 5–10% of total bot traffic in Russia by the end of 2026.
To mitigate these threats, experts recommend implementing behavioral analysis, machine learning tools, and stricter access control policies. These measures help distinguish between legitimate AI indexing activity and malicious bot traffic that attempts to exploit the trust placed in AI-related headers.
