AI shopping bots used to just read your product pages. Akamai’s own data, shared with Help Net Security, says a growing share of them are now sending POST requests — the same request type your site uses to log a user in, add an item to a cart, or submit a checkout. In a 30-day analysis across Akamai’s global customer base, ecommerce sites accounted for 44.8% of all AI-bot POST transactions, more than any other vertical (Help Net Security, September 22, 2026).

GET reads a page. POST does something to it.

A GET request asks a site for a page — the way a crawler indexes a product listing. A POST request tells the site to act: sign a user in, add a line item to a cart, submit a payment form. Akamai’s Advisory CISO, Steve Winterfeld, told Help Net Security: “We are seeing a wider variety of transaction types, including a consistent rise in non-GET requests from some of the verified AI crawlers for training and searching.” That’s a verb-level shift, not a volume story — the same crawlers that used to only fetch pages are now issuing the request type a store reserves for state-changing actions.

Winterfeld didn’t break the 44.8% down into logins versus cart-adds versus checkout submits, and pointed retailers at their own logs instead: “The advice for retailers remains the same: ensure AI bot visibility and apply a well-informed security strategy for governance.” Your access logs, not this article, are the source of truth on which of those three your AI traffic is doing.

Ecommerce leads; travel is closing the gap fast

Ecommerce’s 44.8% share was the largest single vertical in Akamai’s sample. Travel sites climbed to 30% of AI-bot POST traffic “in a single month,” per the same report — the two verticals where a POST is most likely to be a cart-add or checkout-submit rather than a blog comment or a login somewhere unrelated to a transaction.

This builds on, but differs from, Akamai’s earlier finding that AI bots made up roughly 48% of all commerce traffic by volume, which we covered in July. That report measured how much AI traffic there is; this one measures what kind of requests it’s making.

MCP is a named, measured slice of it

Model Context Protocol (MCP) traffic — the connector standard that lets an AI agent call outside tools and APIs — made up 4.1% of the AI-bot POST transactions in Akamai’s 30-day sample. Asked what Akamai’s MCP-tracking rule has caught, Ryan Gao, who leads Akamai Threat Intelligence Services, described the exposure without giving a count: “As the MCP becomes the standard ‘USB connection’ between AI agents, data, and tools, it also introduces an emerging attack surface as it grows exponentially in 2026. The primary risks include unsanctioned services running without proper authentication and potential PII exposure.” Neither Winterfeld nor Gao gave a figure for how many MCP endpoints are reachable without authentication, or whether Akamai’s customers have seen tool-poisoning or cross-server attacks.

On telling a legitimate shopping agent from an impostor sending the same kind of request, Gao pointed to combining “GEO with specialized bot tracking, monitoring transactional shifts (GET vs. POST behaviors), and adaptive behavioral analytics for evasion tactics and nonhuman identity and schema validation.”

What this means for your store

If your bot-management dashboard reports AI traffic as a single “bot” bucket, you can’t tell whether it’s reading your catalog or acting on it. Akamai’s numbers say that distinction is now large enough to matter: check whether your access logs or WAF split GET from POST on /cart, /checkout and login endpoints for traffic already tagged as AI. If they don’t, that’s the gap this report points at.

FAQ

What’s the difference between GET and POST bot traffic?

A GET request asks a server to return a page, the way a search or AI crawler indexes content. A POST request submits data that changes state on the server — logging in, adding to a cart, or completing a checkout. Akamai’s report says verified AI crawlers are increasingly sending the second kind, not just the first.

Does the 44.8% figure mean 44.8% of ecommerce bot traffic is checking out?

No. It means ecommerce sites accounted for 44.8% of all the POST transactions Akamai observed from AI bots across its customer base — a share of one traffic type, not a conversion or checkout-completion rate. Akamai did not break those POSTs down into logins, cart adds or checkout submissions.

How much of that POST traffic comes through MCP versus a browser-driven crawler?

In Akamai’s 30-day sample, MCP traffic made up 4.1% of AI-bot POST transactions. Akamai didn’t publish a further breakdown by crawler or agent type for the remainder.

Sources

Whether your AI traffic is reading a page or submitting a form is exactly the distinction a discovery-only audit can’t see and a transaction audit is built to check.