Cloudflare says the web has an agent problem that CAPTCHAs and API scopes do not solve: a website sees the agent, not the person behind it. On November 5, 2026, the company published "Agents aren't humans (but they kinda are)" and announced the Trusted Agent Delegation (TAD) coalition (Cloudflare blog). The post lists the costs sites bear, argues for identity, reputation and accountability, and points to Web Bot Auth, MOLE and IETF work as building blocks.
This is a position paper plus a coalition, not a finished standard. It follows Cloudflare's personal agents analytics and access policies, which covered the product controls that the new post frames as a first step.
TL;DR: the questions people ask first
| Question | Answer (from Cloudflare's post) |
|---|---|
| What is the core claim? | Hosted agents are intermediaries, so sites lose sight of the user and bear the cost of fraud and abuse |
| What is new? | The TAD coalition, plus a named principle and a list of problems |
| Which standards? | Web Bot Auth, MOLE, OAuth, WIMSE, IETF AI Preferences, Privacy Pass, x402 |
| What can I do now? | Per-agent analytics, per-agent access policies, and user-level agent attribution on Account Abuse Protection (early access) |
| Does it cover local agents? | No, hosted agents only at first |
| Is it a standard? | No, it is a problem statement and coalition |
The intermediary problem, in Cloudflare's story
Cloudflare opens with Ezra, a personal assistant who runs errands for four clients. A grocer used to know one of them, Amy. Now only Ezra walks in, and the grocer cannot tell whose preferences are whose. Bob asks Ezra to buy an iPhone, then disputes the charge, and the store can only prove what Ezra did. Charlie hands Ezra a list of possible passwords for his bank. The bank sees an attack but can only ban Ezra, which also bans Amy, Bob and Debra.
Swap Ezra for an AI agent and the shops for websites, Cloudflare says, "and you have the web today." Examples named in the post include Meta's Muse and OpenAI's dots. We covered the latter in OpenAI Dots: always-on agents.
The post defines an agent as an automation that takes instructions from a user and pursues a goal by controlling a cloud computer or browser, usually hosted by an operator. Agents do not tire, run around the clock, act in parallel and tolerate friction no person would. Much of the web, from capacity planning to monetization, assumes those human limits.
The Intermediation Principle
Cloudflare rests the paper on one principle: the business relationship between users and sites, and each participant's security responsibilities, must be upheld regardless of intermediation. A site needs tools to recognize, serve and hold accountable a user acting through an agent, as it could if that user visited directly. The agent and its operator must be recognizable and accountable too.
Cloudflare's stated aim is "an Internet where all Users have equal or greater access to websites than they had before." It says agents should be able to browse privately, "But they probably won't be able to log in to a bank without additional verification."
Fourteen challenges sites face
Cloudflare gives a table of site goals that agents make harder. In its words, in nearly every case "the Site bears the primary cost." The main ones:
- Account sharing: one paid subscription can serve many users through one agent.
- Friendly fraud: a user approves an agent purchase, then disputes it. Normal evidence such as device, IP and address is missing because the purchase came from the agent's infrastructure.
- Identity spoofing: attackers copy a well-known agent's user agent string to gain its allowances.
- Identity verification breaks: liveness and KYC checks assume the person present is the person verified.
- Traffic commingling: when one user abuses a shared agent for credential stuffing or card testing, the site can only block the agent, which blocks every legitimate user.
- Resource exhaustion: agents poll constantly, hit expensive endpoints and use up free trials.
- Risk-based authentication breaks: agents run on cloud infrastructure and look unusual every time.
- Uncompensated consumption: an agent reads content to answer the user elsewhere, so the site gets no visit, ad impression or purchase.
- Unauthorized card users: agents have no authorized-user status, so when a user disputes a purchase, the site pays.
Others include compliance, human verification becoming irrelevant, misalignment and mistakes, policy circumvention and user attribution.
Why common fixes fall short
Cloudflare rejects two popular ideas.
Human in the loop. Passing a CAPTCHA through to the user proves some human is present at that moment, and nothing more. It cannot tell Bob from anyone else, and it adds back the friction agents exist to remove, so operators are incentivized to bypass it.
Tight scopes. Agents are built to do what a user could do, so they ask for and get permission to do everything. Even a narrow scope says what the agent was allowed to do, not who answers when it errs.
What Cloudflare says the web needs
The post groups the fix into protocols, identities, claims and site policy.
| Layer | What Cloudflare names | What it does |
|---|---|---|
| Protocols | MOLE, x402 | MOLE aims at rate limiting without user-specific identifiers; x402 targets privacy-preserving web payments |
| Agent identity | Web Bot Auth | The agent signs its requests, identifying itself and implicitly its operator |
| Reputation without identity | Privacy Pass, MOLE | Answer "can we trust you?" without "who are you?" |
| Account identity | OAuth | Conveys account identities |
| Claims | Mechanisms still needed | Prove facts such as over 18 or being the cardholder |
| Site policy | IETF AI Preferences | Machine-readable statements of what agents may do |
Cloudflare describes identity as a spectrum: nothing, session, account, or unique. A site should ask for only what it needs. Session IDs let a site build reputation for one agent session. Account IDs let a site bind a site account to an agent account. Unique IDs, such as government ID or proof-of-human systems, suit high-risk actions.
It also admits gaps. Web Bot Auth does not yet say how to represent several layers, such as Agent A using Agent B inside Browser C. And robots.txt "isn't fully suited to express what Agents may do." The IETF AI Preferences working group focuses on preferences about how content is collected and processed for AI development, deployment and use, and its charter puts technical enforcement and client authentication out of scope. That leaves the larger set of agent actions without a home.
For background on related identity work, see our posts on Know Your Agent identity, World ID for banks and agents and Cloudflare Wallets for agent payments.
The TAD coalition
Cloudflare says real solutions "won't emerge from fragmented, vendor-specific mechanisms." The TAD coalition will bring representatives across the ecosystem to discuss the problem set, review existing protocols, and take defined problems to the IETF. Cloudflare says it works with operators, identity verification companies, payment providers, merchants, publishers, proxy providers and cloud browsing companies. It intends to hold side meetings at the IETF and later workshops.
The post does not list coalition members. Treat the member list as unconfirmed until Cloudflare publishes one.
What site owners can do this week
Cloudflare lists three steps it says are available now:
- See which agents visit. Security Analytics breaks out Personal Assistants as their own traffic category. A widget lists each agent, its request count, the paths it hits and its errors. Enterprise Bot Management customers can use Business Insights for crawl-versus-referral data.
- Set access per agent. AI Crawler and Agent access policies let you allow an agent across your site, block it only on pages with ads, or block it fully. Search and training policies stay independent.
- Tie an agent to the user. For sites on Account Abuse Protection (early access), each login and sign-up shows whether a personal agent made the request and which one. You can mitigate one account with a WAF rule on its Hashed User ID without blocking the agent for everyone else.
If you run agents yourself, expect more sites to ask you to sign requests and identify yourself. Build for that now: sign with Web Bot Auth where supported, keep one agent identity per operator and avoid copying other agents' user agent strings.
Security view: what to protect
An agent that can log in, pay and read accounts is a high-value target, and a site that cannot separate agent users is a high-value victim. Two defenses matter at the agent end: limit what an agent may do before it acts, and log what it did. AgentBeam is the agent security platform from the explainx.ai team that stops AI agents before they take dangerous actions. Pair that with site-side controls above.
Compare how banks are reacting in our coverage of banks blocking AI agents from customer accounts, and the Paul Graham take on Amazon banning agents. Cloudflare's paper is, in effect, an attempt to give those blocking decisions finer tools than yes or no.
What this means for what you build or pay
If you build agents, the direction is clear: sites will want signed identity, an operator who answers for the agent, and sometimes a user claim. Agents that hide behind residential IPs and copied user agents will be easier to block as these tools spread. If you run a site, the costs Cloudflare lists, from friendly fraud to uncompensated reads, now have named categories and a place to raise them. Nothing here changes Cloudflare pricing in the post, and the Account Abuse Protection feature is early access.
Caveats
- Vendor viewpoint. Cloudflare sells the traffic controls it describes. The problems are real, but the proposed answers favor edge-based enforcement.
- No adoption data. The post gives no figures on agent traffic share. It says agentic traffic "may eclipse" human browsing "in the near future," which is a forecast.
- Standards are early. MOLE is described as upcoming, and several mechanisms are still undefined.
- Local agents are out of scope.
Related reading
- Cloudflare personal agents: analytics and access policies
- Know Your Agent identity
- Cloudflare Wallets and agent payments
- Banks block AI agents from accounts
- MCP security guide
Details are accurate as of November 5, 2026. Product availability and protocol drafts may change.