Definition:
A bot is a program or service that performs actions automatically based on instructions, events, rules or model outputs. It can operate on a website, in an application, on a messaging platform, through an API or within an internal system.
A bot does not need artificial intelligence to operate. Many bots use deterministic rules, scheduled tasks or predefined workflows. Others incorporate statistical or generative models to interpret information, select responses or decide the next step.
How bots work
Operation depends on the task and environment, but it usually involves four elements:
- Input: The process starts with a scheduled time, request, message, data change, user interaction or another event.
- Decision: The bot evaluates rules, conditions, available data or a model response to determine what to do.
- Action: It may retrieve information, send messages, crawl pages, update records, complete operations or trigger another system.
- Verification: Logs, statuses, alerts and outcomes help detect failures, duplicates or incomplete actions.
A bot can use an API, act within an application or operate an interface through automation. Its scope depends on the permissions, credentials, usage limits and data available to it. Some bots keep state or history to connect several actions, while others process each request independently.
Automating a task does not guarantee that it will be completed correctly. Incorrect responses, interface changes, service limits or failures in connected systems may occur. Relevant operations need validation, error handling and, where appropriate, human oversight.
Bot classification
Bots can be classified by the main activity they perform:
- Crawling and indexing bots: They visit resources, follow links and collect information. Googlebot, for example, is the generic name for the crawlers used by Google Search, according to its official documentation.
- Monitoring bots: They check availability, performance, content changes, prices or other conditions and generate alerts or records.
- Conversational bots: They exchange messages with people or other systems through programmed responses, information retrieval or language models.
- Social and messaging bots: They publish, distribute, moderate or respond to messages within platforms, according to the functions and permissions available.
- Operational and transactional bots: They update data, send communications, process requests or connect stages of a workflow.
The classification describes a function and does not by itself determine whether a bot is legitimate, secure or useful. The same technology can be used with authorisation to automate a service or used abusively to generate spam, collect data without permission or attempt to access accounts.
Scope of the term bot
Chatbots and virtual assistants
A chatbot is a type of bot focused on exchanges through text or voice. It may follow decision trees, consult a knowledge base or use a language model. The term bot is broader and includes automation without a conversational interface.
The term virtual assistant is often applied to conversational systems that can also retrieve information or take actions. The ability to hold a conversation does not mean that a system can understand every request or act beyond its available tools and permissions.
Artificial intelligence agents
An AI agent interprets information and selects actions to progress towards an objective within an environment. It may use tools, memory and language models, whereas many bots are limited to a fixed sequence or predefined rules.
The concepts can overlap when an agent is presented as a bot within an application or platform. The useful distinction lies in how it operates: a deterministic workflow executes established instructions, while an agent can adapt the sequence of actions according to context and obtained results.
Automated traffic management
Websites and applications need to distinguish automated traffic according to its purpose and behaviour. Management usually combines three groups of measures:
- Identification: It analyses headers, network addresses, frequency, navigation sequences and other indicators. A user agent can be declared or spoofed, and an IP address can be shared, so one signal alone is not conclusive.
- Assessment: It separates authorised automation, such as crawlers and monitoring systems, from activity that breaches policies, distorts metrics or creates risk. In web analytics, exclusion reduces some distortion but does not guarantee data that is entirely free from automated traffic.
- Control: It may apply authentication, permissions, rate limits, request validation, CAPTCHA, firewall rules or behavioural review.
robots.txtcommunicates preferences to crawlers that choose to respect them, but it is not a security barrier.
Controls also need to account for false positives. Blocking any fast or repetitive activity can affect search engines, accessibility tools, integrations and legitimate services.
A botnet is a different case: it comprises compromised devices that a third party controls to perform coordinated actions. Bot-related risk is not limited to botnets. It also includes form abuse, mass account creation, advertising fraud, unauthorised extraction, inventory hoarding or automated access attempts. The response needs to match the action, the protected resource and the observed impact.