Bots over humans, and who actually wins when the models get cheaper

00:00:04 Cloudflare just reported something that quietly passed through the news cycle without much commentary: bot traffic has crossed a threshold no one expected for another eighteen months. For the first time in the internet's history, machines generate more HTTP requests to HTML content than people do.

00:00:25 Cloudflare's Radar dashboard puts bots at fifty-seven point five percent of all requests, humans at forty-two point five. Matthew Prince, Cloudflare's CEO, had predicted this crossover would happen by the end of twenty-twenty-seven. We got here eighteen months early.

00:00:44 That isn't what shifted. The culprit is agentic AI. At SXSW earlier this year, Prince described the request-volume asymmetry of these new agents: a human shopping for a camera visits maybe five websites. The agent doing the same task visits five thousand. HUMAN Security reported that AI-driven traffic grew eight times faster than human traffic across twenty-twenty-five.

00:01:10 Agent-driven bots acting on behalf of users rather than scraping for training data went from one point seven percent of automated traffic at the start of last year to an eight-thousand-percent increase by the end. Digital ad pricing, SaaS conversion funnels, and e-commerce UX all rest on one assumption: users are people who look at pages, scroll, and click.

00:01:36 When agents replace humans as the primary request generator, those assumptions break in ways that aren't immediately visible in total traffic numbers. Bot traffic does not generate pageviews or session times or the conversion events that underpin programmatic advertising rates.

00:01:56 Even when it carries genuine user intent, a majority-bot internet structurally deflates inventory value even as total requests increase. Imperva called it directly in its twenty-twenty-six Bad Bot Report: companies operating under the assumption that users are human risk misreading their own systems.

00:02:17 Cloudflare launched Pay Per Crawl last year precisely for this — letting publishers charge AI scrapers for content access. They've already blocked over four hundred sixteen billion AI bot requests at site owners' request. Detection is just as complicated. HUMAN Security found only half a percentage point separating the rate of benign automation from malicious automation across its platform.

00:02:45 The old binary of bot or not no longer holds, which means the security stack built for that binary is already obsolete. The next infrastructure cycle is about trust rails for machines: agent identity, intent verification, and API-native content delivery. Cloudflare's Radar data is live.

00:03:05 The market is still priced for the old internet.

00:03:09 Here's a framework circulating in AI circles recently that's worth testing against today's financial signals. George Hotz laid it out: there are four layers to who wins in AI. Data center operators — Google, Amazon. Model providers — OpenAI, Anthropic. Interaction-layer platforms like Cursor or OpenCode.

00:03:30 Hardware producers: Nvidia, AMD, and Google itself through its custom silicon partnership with Broadcom. Hotz's argument is that pure model providers face unexpectedly shallow competitive moats. DeepSeek and open-source models from Chain show that the protection of large institutes isn't as deep as assumed.

00:03:52 Building good AI interaction harnesses is hard to replicate, sure, but Cursor demonstrated this by releasing its own Composer two-fast model optimized for their platform. Which leaves the people running data centers and building hardware as the real winners. Google does all four layers: Gemini models, custom data center hardware with Broadcom, massive operations, and cloud infrastructure.

00:04:19 Broadcom is essentially Google's primary custom silicon partner. Its stock dropped today despite an unchanged AI chip forecast. The sell-off was driven by weak software sales, but it signals something broader. When a company that deep in the stack sees its stock drop on unchanged guidance, it suggests the market is pricing in demand uncertainty even as these builders project public confidence.

00:04:47 SK Hynix also announced today a doubling of manufacturing capacity for high-bandwidth memory chips to address what they're calling a structural — not cyclical — shortage. Chairman Choi said the shortage could last until twenty-thirty, but they now view AI demand as structural enough to justify long-term capital deployment.

00:05:10 It probably won't help the crunch in the short term, but it's a different posture from the past, where manufacturers waited out chip cycles. The hardware layer is making real long-term bets while the model layer competes on a rapidly narrowing gap. Both can be true.

00:05:29 A concrete signal today about where core AI inference actually lives: Apple is using Google's custom Nvidia-powered chips for its revamped Siri, launching in September. Watcher.Guru reported it this morning. Apple designs its own silicon — the M-series for Macs and the A-series for iPhones — but is going to Google for Siri's core model processing.

00:05:54 That's a hardware-layer move that matters: Siri's intelligence lives in infrastructure controlled by someone else. It fits the vertical integration thesis from the previous segment without needing a grand conclusion. Apple gets specialized AI compute, Google picks up a major inference workload, and the rest of us get to watch which platform actually captures value when underlying models get commoditized.

00:06:23 On the policy side, today's executive order on AI model sharing went through one of the strangest legislative processes I've seen, and I don't use that phrase lightly. A draft order circulated two weeks ago with a ninety-day voluntary pre-release window for labs to share their most advanced models with the government before public release.

00:06:46 It seemed like a done deal — a signing ceremony had been scheduled, tech CEOs invited. Then hours before the event, Trump pulled it, saying he didn't like certain aspects and thinking it would hurt U.S. leadership over China. David Sax from AISI intervened at the eleventh hour with a call to the president.

00:07:07 The order was re-signed — this time in private, with zero fanfare. It's substantially the same as the scrapped draft. Both versions make testing voluntary. All major AI labs have already agreed to submit advanced models for testing anyway. The only significant change between versions is the pre-release window: thirty days instead of ninety.

00:07:30 That ninety-day period triggered industry backlash for its potential to slow down release cycles. Neither version gives the government any mechanism to block a model's release. In fact, the new version includes an explicit disclaimer that nothing authorizes mandatory licensing or pre-clearance requirements — which reads like a direct response to that critique.

00:07:55 The NSA gets primary responsibility for model testing. Treasury runs a cybersecurity clearinghouse with DHS and CISA involvement. There are provisions instructing civilian and military agencies to harden systems against AI-driven cyber risk. And there's language reaffirming commitment to U.S.

00:08:15 AI global dominance, which is the sort of line that doesn't do anything on its own. The White House Office of Science and Technology Policy called the New York Times' reporting on this lazy and inaccurate — they want to draw a clear line between oversight and voluntary sharing.

00:08:34 David Sax said it only covers models representing meaningful step changes in cyber capabilities, like Mythos, not incremental updates. He also addressed the slippery slope argument directly: bureaucratic mission creep is always a danger but should be closely monitored.

00:08:52 Former White House adviser Dean Baquet called it a fairly major win for the safety contingent and a significant loss for the acceleration side, writing that the classified thresholds for what triggers review are egregious because most lab staff don't have clearances.

00:09:11 Researchers won't know whether what they're training is regulated if the literal regulatory thresholds are classified. Here's the strangest detail: both Steve Bannon and Bernie Sanders want more regulation on this executive order. Bannon said it's the first time there's been a structure on paper and that he's heading toward mandatory within months.

00:09:34 Sanders, who had called efforts to regulate AI foolish just weeks ago, now says Trump finally acknowledged AI poses a real threat — and that the voluntary approach does almost nothing. David Remler from CNAS said the order effectively formalizes what's already happening between the U.S.

00:09:54 government and leading AI companies. Which is fair — it doesn't create new authority so much as codify existing practice. But the classified thresholds question remains unresolved, and nobody outside a small circle of cleared personnel knows how this system actually works.

00:10:13 A few quick items from today. Anthropic expanded access to their Mythos model through Project Glasswing, adding one hundred fifty new partners across fifteen countries, spanning energy, water, communications, healthcare, and computer hardware. A successful attack on any of these sectors could disrupt over a hundred million people.

00:10:35 Most testers are running through millions in tokens, and Anthropic is still subsidizing use for now. They also noted that safeguards preventing the model's cyber capabilities from being misused don't yet exist anywhere — which reads like a subtle reversal from their earlier timeline for general access to Mythos-level capabilities.

00:10:57 The messaging is getting harder to parse. Microsoft at Build today continues its server Linux push: a new server Linux, a container Linux, and a Windows eleven built for Linux programmers. It's the continuation of a multi-year shift in how Microsoft positions itself relative to the open-source stack they once competed against.

00:11:19 And Challenger reported that U.S. tech companies announced cuts to over thirty-eight thousand jobs in May alone — the most since August twenty-twenty-four. The year-to-date total is one hundred twenty-three thousand, up sixty-five percent year-over-year. That number matters alongside the infrastructure buildout stories.

00:11:40 The throughline across these items isn't that models are losing — it's that whoever controls the layers beneath them has more durable leverage than anyone assumed last year. The local reading puts weight on the hardware and infrastructure signals: Broadcom's stock, Apple's chip choice, Cloudflare's bot data, SK Hynix's capacity expansion.

00:12:02 Those are concrete actions with long timelines. The model layer is still where all the attention lives, but the money in this buildout cycle is settling into the rocks underneath. Seln Oriax.