AI Weekly Malaysia

Known Agents' Agentic Web Index reports that 35% of web traffic is bots, with 29% of that bot traffic being AI-related (up 11% over 90 days). Someone is conducting mass vulnerability scans while spoofing their user-agent as AI bots like ClaudeBot, making malicious scanning traffic harder to distinguish from legitimate AI crawler traffic.

Why: If you block or rate-limit by user-agent string, spoofed scanners can masquerade as known AI bots like ClaudeBot to evade detection. Don't rely on user-agent alone for access control or bot management—consider behavioral fingerprinting, IP reputation, and challenge mechanisms instead. The 98.5% robots.txt compliance rate also means robots.txt is not a security boundary.

Ars Technica reports on a new font-based technique designed to make ordinary webpages render correctly for human visitors but produce nonsense text when extracted by AI scrapers. The actual article body was not available in the source text provided, so technical details on implementation, availability, and effectiveness are missing.

Why: If you run a content site or SaaS with public-facing pages and are concerned about unauthorized AI training scraping, this font approach could be a lightweight defensive layer worth evaluating—but without the article's specifics on how to deploy it, what it costs, or which scrapers it defeats, there's nothing actionable yet. Track this for when implementation details surface.