One in Forty 'Trusted' Bots Is an Impostor. Your Allow-List Lets It Right In.

Wed, 22 Jul 2026 00:00:00 +0000

Roughly one in every forty requests claiming to be PerplexityBot is a fake.

Not a rounding error. Not a theoretical risk. DataDome measured it across 7.9 billion AI agent requests in January and February of this year: nearly 2.4% of everything wearing Perplexity’s name was an impostor. Meta’s agent had it worse, with 16.4 million spoofed requests in those same two months.

Now the uncomfortable part. If your bot policy has an allow-list, and almost every bot policy does, those impostors are not sneaking past your defenses. Your defenses are holding the door for them, because the allow-list checks names, and a name is text anyone can type.

Web Bot Auth on Eknix — Web security & performance for the enterprise

One in Forty 'Trusted' Bots Is an Impostor. Your Allow-List Lets It Right In.