Half the traffic is already machines.

Most of this week's coverage has been about who gets to move the money. The more useful number came out five days ago and got far less attention: on Akamai's network, almost half of all commerce traffic is now automated. The settlement layer is being built at speed. The layer that establishes who is asking is not keeping pace.

The traffic mix has already flipped

Akamai's State of the Internet report, published 15 July, puts AI bots at 47.9 percent of commerce traffic across its global network as of December 2025, with training crawlers accounting for more than 70 percent of AI bot triggers [1]. That makes commerce the most targeted industry in the dataset, and the tactics have moved on from credential stuffing. The report describes agent hijacking, where a legitimate AI assistant is compromised and its stored payment credentials abused, alongside synthetic identities assembled by language models to clear static checks [1].

Merchants are watching rather than deciding

The posture data is the part worth sitting with. Commerce organisations put more than 90 percent of AI bot activity into a monitoring category, then let roughly three quarters of the remainder through unrestricted [1]. Meanwhile API-directed web attacks rose 9 percent year on year and 85 percent of commerce respondents reported at least one API incident in the past year [2]. Logging a request is not the same as making a decision about it.

The money layer keeps shipping

The contrast is stark. Visa opened stablecoin services to more than 200 million merchants this month, SWIFT now runs a blockchain-based ledger across its network of over 11,500 institutions, and Open Standard is working with Stripe, Visa, BlackRock and roughly 140 other firms on a stablecoin called Open USD [3]. Circle's Jeremy Allaire framed the thesis directly, arguing that an economy run by software agents has to run on software money, software contracts and software governance [3].

The rulebook is still a draft

The GENIUS Act passed a year ago and regulators are still working through the rules issuers will have to meet, with proposals out for comment covering identity checks comparable to those at traditional financial firms [4]. On the protocol side, the x402 Foundation launched on 14 July with 40 founding members drawn from the card networks, processors, cloud providers and several chains [5]. Standards for how value moves are arriving well ahead of standards for who is permitted to move it.

Read from the rails

47.9 percent is the number I would put in front of a risk committee. Not because bots are inherently bad traffic, but because a merchant fraud stack built for a human-majority internet is now being asked to make calls on a population that is roughly half software, and it is answering most of those calls with "log it and continue."

Ten years in payments operations taught me that the control you do not enforce is not a control, it is a report. If more than 90 percent of agent traffic sits in monitoring, you have visibility without policy, and visibility does not stop a hijacked assistant spending a stored credential. The practical question for anyone accepting agent traffic today is whether the request carries a verifiable identity for the agent, a named principal behind it, and a scope you would be willing to enforce at the point of authorisation rather than describe afterwards in a report. Everything else in this week's news is settlement, and settlement is the easy half.

Deciding how money moves is straightforward. Deciding who is allowed to move it is the work nobody has finished.