Full Report
Akamai has watched verified AI crawlers, ChatGPT among them, move from reading web pages to sending high-frequency POST requests. In a 30-day analysis of its global customers, ecommerce accounted for 44.8% of those AI bot POST transactions, and travel climbed to 30% in a single month. A GET request asks a website for a page.…
Analysis Summary
# Tool/Technique: AI Crawler POST Transaction Escalation
## Overview
This technique involves verified AI crawlers (such as ChatGPT/OpenAI bots) transitioning from passive data collection (GET requests) to active interaction with web applications via high-frequency POST requests. While these are "verified" bots, their shift toward transactional endpoints (logins, carts, checkouts) introduces new risks regarding resource exhaustion, unauthorized data scraping of authenticated sessions, and the circumvention of traditional bot management strategies focused on GET-based crawling.
## Technical Details
- **Type:** Technique / Bot Behavior
- **Platform:** Web Applications (specifically Ecommerce and Travel sectors)
- **Capabilities:** Automated form submission, session interaction, high-frequency transactional requests.
- **First Seen:** Reported as a significant trend in September 2026 (per Akamai analysis).
## MITRE ATT&CK Mapping
- **[TA0009 - Collection]**
- **[T1119 - Automated Collection]**
- **[TA0043 - Reconnaissance]**
- **[T1594 - Search Open Websites/Domains]**
- **[TA0040 - Impact]**
- **[T1499.002 - Endpoint DoS: Service Exhaustion]** (Potential side effect of high-frequency POSTing)
## Functionality
### Core Capabilities
- **Active Interaction:** Moving beyond reading HTML to submitting data via POST requests.
- **Transactional Crawling:** Interacting with Ecommerce carts, checkout flows, and login pages.
- **High-Frequency Execution:** Sending requests at scales that mimic traditional automated scrapers or credential stuffing tools.
### Advanced Features
- **Engine Optimization Interaction:** Leveraging Answer Engine Optimization (AEO) and Generative Engine Optimization (GEO) to influence how AI models index and represent commercial data.
- **Stateful Interaction:** Potentially maintaining session states to navigate multi-step checkouts or booking flows in the travel sector.
## Indicators of Compromise
*Note: As these are "verified" crawlers, indicators often mirror legitimate service IPs.*
- **Network Indicators:**
- High-volume POST traffic originating from verified OpenAI/ChatGPT IP ranges.
- Traffic from user-agents associated with AI search engines (e.g., `GPTBot`, `OpenAI-Search`).
- **Behavioral Indicators:**
- Anomalous spikes in POST requests to `/checkout`, `/cart/add`, or `/login` endpoints without corresponding GET-based navigation.
- Unusual patterns of automated form interaction on ecommerce and travel booking sites.
## Associated Threat Actors
- **Verified AI Crawlers:** OpenAI (ChatGPT), and other generative AI search/training entities.
- **Note:** While these are legitimate tools, they are being monitored for behavior typically associated with aggressive scraping or bot-driven resource exhaustion.
## Detection Methods
- **Behavioral Detection:** Monitoring for a shift in the GET-to-POST ratio from specific bot-identified IP ranges.
- **Traffic Analysis:** Identifying "Verified Bot" signatures that are interacting with sensitive transactional endpoints rather than public content pages.
- **Telemetry:** Using WAF/Bot Management logs to track AI crawler interaction with API endpoints.
## Mitigation Strategies
- **Governance Policies:** Establish clear rules for AI bots in `robots.txt` specifically addressing POST request permissions.
- **Visibility Tools:** Implement bot management solutions that distinguish between "Good AI" (for SEO/AEO) and aggressive scraping.
- **Rate Limiting:** Apply specific rate limits to POST endpoints for known AI crawler IP ranges to prevent service degradation during peak periods (e.g., holiday seasons).
- **Optimization Strategy:** Balance security with AEO/GEO (Answer/Generative Engine Optimization) to ensure the brand is indexed without compromising infrastructure.
## Related Tools/Techniques
- **Web Scraping:** Traditional scraping using tools like Scrapy or Selenium.
- **Credential Stuffing:** Though not the primary goal, the use of POST on login pages shares technical similarities.
- **AEO/GEO:** The strategic counterpart to SEO for AI-driven search engines.