Cloudflare, the web security company, announced on 5 November that websites can no longer treat AI agents like ordinary visitors, and it has started an industry group to work out what should replace the old rules. The plan is laid out in a Cloudflare blog post titled “Agents aren’t humans (but they kinda are).” The group is called Trusted Agent Delegation.
The problem starts when an AI assistant buys something or logs in for you. The website sees the assistant, never you. Cloudflare explains it with a human stand-in named Ezra, a personal assistant who runs errands for four clients. One client, a local CEO, used to be known at her neighborhood grocer, who set aside what she liked. Now Ezra shows up with four sets of orders and he cannot tell them apart.
It gets worse from there. One client keeps an iPhone Ezra bought and then tells the shop he never approved the charge. The shop only ever met Ezra, so it cannot prove he asked. Another client hands Ezra a list of passwords to try at his bank. The bank sees the attack, yet the sole party it can block is Ezra, and that locks out her other clients too.
Cloudflare’s post lists more than a dozen versions of this, and in nearly all of them the website pays. In a purchase dispute, a store normally leans on evidence such as the same device and address as the customer’s earlier orders. An agent shops from its own servers, so that trail is missing. Agents that read articles and answer the user somewhere else cost the publisher money to serve, and the publisher earns no visit, no ad view and no sale.
Two popular fixes get a quick dismissal. Passing a CAPTCHA to the human proves that somebody is around at that moment and nothing more, and since agents exist to remove friction, Cloudflare expects the companies running them to find ways around it. Narrow permissions fare no better, because agents tend to ask for permission to do everything, and even a tight limit describes what the agent could do and says nothing about who answers when it gets it wrong.
What Cloudflare proposes instead is a ladder of disclosure that each site chooses for itself. At the bottom, a visitor brings no identifier at all. Next comes a session identifier, then an account identifier that persists across visits, and at the top a unique ID from a third party, which Cloudflare reserves for high-risk actions. Along the way it points to Web Bot Auth, a way for an agent to put a cryptographic signature on every request, and MOLE, a proposed method for limiting request rates without tracking individual users. It also wants sites to publish machine-readable rules for what agents may do, since robots.txt only covers which pages a crawler may visit.
Some of this ships now. Cloudflare says its Security Analytics dashboard now gives personal assistants a traffic category of their own, and customers can allow, block, or partly block individual agents, for example only on pages with ads. Sites on its early-access Account Abuse Protection can see which agent made a login or sign-up, and block one abusive account without cutting off everyone else using that agent.
The post comes from a company that sells the tools it describes, and it names no coalition members, only categories such as payment providers, publishers and identity verification companies. Its claim that agent traffic “may eclipse” human browsing comes without a figure. The post also leaves out agents that run on a user’s own device, which have no single operator to hold accountable.
Agent makers who want their products let through should expect to sign their requests and say whose behalf they act on, because that is the price of getting past the blocks.
Reported by the Cloudflare blog on 5 November 2026.
