As web designers, we're used to constant change. The demand to keep up with the evolution of the web has made a lot of us in the industry feel like "the new" rarely feels that earth shattering anymore. There's "the new" over and over again, every day.

But this is different.

Within one year we went from designing websites to convert humans to building them to convert AI agents. Whiplash.

Some context for how fast this has happened. Back in 2019, humans accounted for roughly 63% of web traffic. By the end of 2024, bots had officially crossed over to become the majority. Cloudflare's December 2025 data puts humans at just 47% of HTML requests. The rest is split across search crawlers, scrapers, monitoring tools, AI training bots, and the new kid on the block: AI agents. And the agent piece is moving fast. BrightEdge data from April 2026 shows AI agent activity already equals 88% of human organic search volume, with OpenAI driving 95% of it. A year ago that number was effectively zero.

Good news is that what these new visitors need is largely the same stuff assistive technology has needed for years and that search engines have always rewarded. Structure. Semantics. Clear labels. The work lines up.

Less good news: this same shift is jacking up the stakes on security and privacy in ways most websites just aren't ready for.

What works for a screen reader used by someone with blindness, also works an AI agent and search bot.

Quick take

• AI agents are real visitors to your site right now, not a future scenario
• May 2026 Google publishes Build Agent-Friendly Websites guide highlighting the role of the “Accessibility tree” for GEO.
• A 2025 Semrush study of 10,000 sites found accessible sites get 23% more organic traffic and rank for 27% more keywords
• Assistive technology built for people with disabilities turns out to be the same foundation AI agents use to read your site
• The agentic shift is also accelerating the security threat to websites, especially WordPress sites with plugin sprawl
• Accessibility regulation is tightening globally, and privacy law is multiplying state by state
• If your site isn't current, secure, accessible, and structured for machines, this is the year to rebuild it

We've watched this pattern before, but never this fast

When I started Propeller back in '97, the web was a brochure. Then ecommerce arrived and sites had to actually do things. Search engines became the primary discovery channel and structure suddenly mattered. Mobile broke everything that wasn't responsive. Then accessibility became enforceable and the lawsuits started landing.

Every one of those shifts followed the same pattern. A new way of using the web shows up. Sites built on solid foundations adapt. Sites built on shortcuts and bolt-ons scramble, and a lot of them never get the ground back.

The agentic shift is moving faster than any of these. Mobile took a decade to reach the point where a non-responsive site was unacceptable. Agents went from novelty to mainstream visitor in under two years. The runway is gone.

How AI agents read your site like a screen reader does

If you took accessibility seriously years ago, you're about to look really smart.

For decades, web accessibility has been seen as something you do for a small slice of your audience. Screen readers, keyboard navigation, captions, contrast ratios, ARIA labels... all built so people with disabilities could use the web. Important, ethical, legally required, but in a lot of minds, niche.

Except it wasn't. The same accessibility tree that screen readers depend on is the same map AI agents use to read your page. Every property, label, role, and heading that got added for assistive tech turns out to be exactly what an agent needs to navigate and act on your site.

So companies that invested in accessibility early didn't just build a more inclusive experience. They built sites that are positioned to be read, understood, and chosen by the next generation of visitor.

Agents are about to swarm the web in numbers that will dwarf any audience accessibility was originally built for. Sites that did the work are mostly ready already. Sites that skipped it, treated it as a checkbox, or slapped on an overlay plugin to "fix" it... those are the ones with work to do.

SEO is bleeding. Accessibility is the unexpected lifeline.

Most marketers and web teams responsible for organic traffic are getting creamed right now. The stories aren't subtle. Sites watching 20% of organic traffic disappear. Some down 50% or more.

Zero-click searches eating the rest. AI Overviews answering the question right in the SERP so users never have a reason to click through. The traditional SEO playbook is failing in real time and most teams don't have a clear answer for what to do next.

Now here's the part most are missing.

Back in August 2025, Semrush dropped a study with AccessibilityChecker.org and BuiltWith analyzing 10,000 websites. Sites with stronger accessibility scores saw a 23% increase in organic traffic, ranked for 27% more keywords, and showed a 19% stronger domain Authority Score than less compliant sites. More than 70% of websites failed to meet current accessibility guidelines... which means most of your competitors are still leaving this on the table.

We dug into the study in a recent post, but the takeaway is pretty simple. While most teams scramble to recover lost traffic with content tactics that get less effective by the month, accessibility work is quietly producing measurable SEO gains. Same structural fixes that make your site readable to screen readers and AI agents also make it more visible to search.

The agentic web also raises the security stakes

The same AI that's putting agents on your site is also being used by attackers to find and exploit weaknesses at machine speed. We covered this in detail in our piece on AI hackers and vibe coding. Short version: AI is squeezing websites from both sides. Attackers using AI to find vulnerabilities faster than ever. Developers using AI to ship code they don't fully understand.

The numbers are not great. WordPress saw 11,334 new plugin vulnerabilities in 2025, up 42% from the year before. Median time from public disclosure to mass automated exploitation is about 5 hours. And 46% of disclosed vulnerabilities have no patch available at the time of disclosure.

That's not a problem you fix with a firewall plugin. It's the reality of the environment your site is operating in. If your site is built on a stack of 25 plugins from developers you've never heard of, running on shared hosting with default configurations... yeah, you're a target. The fix isn't another security plugin. It's a hard look at how the site is actually built.

The plaintiff bar is about to go agentic too

There's an entire cottage industry of trolling plaintiff law firms scanning websites for easy targets. Accessibility violations. Cookie banner failures. Missing privacy disclosures. Tracking scripts firing before consent.

The playbook has been the same for years. Find a violation, send a demand letter, settle for an amount that's cheaper than fighting it. Most demand letters and complaints have been pretty formulaic, often barely tailored to the actual site they were sent to. Cut and paste with the URL swapped out.

The only reason this hasn't completely overrun the web is that the testing has been manual. Paralegals and junior staff clicking through sites looking for problems. There are limits to how fast a human can do that, and that's basically the only thing keeping the volume contained.

Agents change that math entirely.

One developer vibe coding for a weekend can train an agent to crawl thousands of sites, run automated testing, identify specific violations, document them with screenshots, draft a tailored demand letter or complaint citing the actual findings, and queue it for an attorney's signature. End to end. What used to be a clumsy cut-and-paste lawsuit becomes a precise, evidence-backed filing in minutes.

And the exposure is enormous. The 2026 WebAIM Million report found that 95.9% of home pages have detectable WCAG failures on just the home page. That's actually up from 94.8% the year before, reversing six years of small improvements. WebAIM points to AI-assisted "vibe coding" and the increasing complexity of third-party frameworks as a primary cause.

So the web is getting less accessible because of AI, at the same time AI is being weaponized to find and litigate those exact failures. The vise is closing from both sides.

The same playbook works on the privacy side. Cookie consent failures. Tracking scripts firing before consent. Missing or misleading disclosures. Session replay tools recording sensitive data. All visible from the outside. All testable at scale. We covered the privacy compliance side in our cookie banners and CIPA piece.

Sites with real compliance work in place are unlikely to be the easy targets. Sites that have been kicking the can down the road are about to find out what automated enforcement at scale actually looks like.

Frequently asked questions

What is the agentic web?

The agentic web is the current phase of the internet where AI agents (software acting on behalf of human users) browse, read, and complete tasks across websites in real time. Examples include Anthropic's Claude with Computer Use, OpenAI's Operator, and Perplexity's Comet browser. Unlike chatbots that just answer questions, agents take action: they fill out forms, compare products, complete purchases, and pull information back to the human who asked.

How does the agentic web affect SEO?

AI agents and AI-powered search are reducing direct traffic to websites. Zero-click searches are climbing, and AI Overviews answer questions inside the SERP. At the same time, agents and AI search rely on the same underlying structure that traditional SEO has always rewarded. Sites with clean semantic HTML, proper heading hierarchy, and accessible markup are getting cited and visited more than sites without that structure.

Do AI agents really use the same accessibility tree as screen readers?

Yes. The accessibility tree is the structured representation that browsers expose to assistive technology. AI agents use the same tree to understand what's on a page, what's interactive, and how to act on it. Alt text, ARIA labels, semantic HTML, and proper form labels all serve agents the same way they serve screen readers.

Will my website get more lawsuits because of AI?

Likely yes, especially for accessibility and privacy violations. The bottleneck on demand letters has been manual testing. Agents remove that bottleneck, allowing plaintiff firms to scan thousands of sites at machine speed and generate evidence-backed filings in minutes. WebAIM's 2026 report shows 95.9% of home pages have detectable WCAG failures, which means most sites are exposed.

What should I do first if my site isn't ready?

Start with an honest accessibility audit (not an automated scanner, a real one). Then check your security basics: TLS configuration, HTTP security headers, plugin inventory, and authentication. Then evaluate your Consent Management Platform for both GDPR opt-in and US privacy compliance. The same structural fixes pay off across SEO, AEO, accessibility compliance, and security.

---

Wrap-up

AEO, security, accessibility, and privacy all come back to the same foundation. Clean structure. Current code. Real maintenance. And treating every visitor as worth the effort, whether they're a person, a screen reader, a search bot, or an AI agent.

Almost three decades in and the pattern hasn't really changed. Every web era rewards sites built on solid foundations and punishes the ones built on shortcuts. Agentic web is no different. Just faster.

If you want a straight read on where your site stands, get in touch. Better to have that conversation now than after something breaks.