Cloudflare argues AI agents break the web's model of who a visitor is

Agents obscure who is actually visiting

Cloudflare has published a blog post arguing that personal AI agents are quietly dismantling one of the web's oldest assumptions: that a visit corresponds to a person a site can identify, evaluate and, when necessary, hold responsible.

According to Cloudflare, these agents are automations that take instructions from a human and pursue a goal by controlling a cloud-hosted computer or browser, typically run by an operator as part of a managed service. The post cites Muse from Meta and OpenAI's dots as examples, with more launching continuously.

To a site, Cloudflare explains, an agent may be indistinguishable from a human carrying out a task, or it may look like a single visitor acting on behalf of many users. Either way, the site loses direct visibility into the people behind the actions, and the site is often the party left bearing the cost when something goes wrong.

Agents strip away the limits the web was built on

Cloudflare notes that agents can potentially take any action their user could, without the constraints that shape human behavior. They do not tire, they run around the clock, they act in parallel, and they tolerate friction no person would accept. Much of how sites plan capacity and earn revenue implicitly depends on those human limits.

The post frames agents as intermediaries, the newest entry in a lineage that already includes cloud browsers and proxies such as VPNs. What has changed, Cloudflare argues, is the trajectory: agentic traffic is growing quickly and could surpass traditional human browsing in the near future. Sites could historically respond to intermediaries by blocking them and asking users to switch off the service, but that option collapses once agents make up the majority of traffic. The post limits its main argument to remotely hosted agents, setting aside local agents such as OpenClaw that run on the user's own device.

The errand-runner analogy

Cloudflare illustrates the problem with Ezra, a human assistant who runs errands for four clients. The corner grocer who once knew his best customer now sees only Ezra carrying combined orders, and can no longer tell whose preferences are whose, yet he does not want to turn her away because she brings business. When one client disputes an iPhone purchase he actually authorized, the store must prove he asked for it, but the only person it ever saw was Ezra. When another client hands over a list of forgotten passwords to try at his bank, the only party the bank can ban is Ezra, which cuts off all four clients at once.

Swap the assistant for an agent and the shops for websites, Cloudflare says, and you have the web today.

Where existing defenses fall short

The post catalogs problems that were previously considered solved:

• Account sharing: a single paid subscription can quietly serve many users through one agent, since the site sees one account and one client.
• Compliance: age and geographic restrictions require guarantees about users that agents do not provide.
• Friendly fraud: a user approves an agent's purchase, then disputes it. The usual corroborating evidence, such as a matching device, IP address or shipping address, does not exist because purchases originate from the agent's infrastructure, and even a won dispute costs money.
• Human verification: CAPTCHAs and similar checks are pointless against agents, which are never expected to be human; passing the check through to the user adds no information.
• Identity spoofing: agents often run on residential IPs with real browsers and deliberately blend into human traffic, while attackers copy well-known agents' user agent strings to obtain the same privileges.
• Identity verification: liveness checks and KYC processes assume the person present is the person being verified, and an agent never is, forcing sites to weaken checks, reject agents or drop them.
• Misalignment: experimental agents make mistakes such as wrong items, wrong dates or duplicate orders, and sites absorb refunds and support costs with no way to judge which agents are reliable.
• Policy enforcement: sites imposing blocks, partner-only access or rate limits lose their usual levers.

The Intermediation Principle

Cloudflare grounds its argument in a single principle: the business relationship between users and sites, and each participant's security responsibilities, must hold regardless of intermediation. Sites need tools to recognize, serve and hold accountable a user acting through an agent just as they could if that user visited directly, and the agent and its operator must be recognizable and accountable too.

The post ties this to the three pillars of security and fraud prevention: identity, reputation and accountability, which let a site answer whether the actor is truthful about who they are, whether they are trustworthy, and who answers for the action. Because agents scale human access almost without limit, Cloudflare warns they create new risks even for behavior that was previously benign.

Why it matters

If agentic traffic really does overtake human browsing, the blocking strategies sites use today stop being viable, and the identity infrastructure the web runs on, from CAPTCHAs to KYC, loses its meaning. Cloudflare is signaling that the ecosystem needs new mechanisms for delegation and attribution before that shift completes, and as the operator of a network that sits between much of the world's traffic and its destinations, its framing of the problem is likely to shape how site owners and agent providers respond.