For those suggesting fail2ban as a solution, that's dinosaur software from the palaeolithic. If you have a website of any size then the number of bots will overwhelm the block list in days with their millions of unique IPs.
The big problem with AIs is that they can try new paths/payloads very easily, adapt quickly, I'd be more worried about that.