Sites can now see which AI agent acts for which user

Cloudflare is giving websites a clearer view of personal AI agents, the assistants that turn a person's instructions into requests and actions on a site. Until now, a customer asking an agent to compare products, find a support article or complete a purchase showed up to the site simply as automated traffic. In Cloudflare's bot analysis, Personal Assistants now appear as their own category alongside verified bots, likely humans and automated traffic, and a new widget lists which agents visit and how many requests each sends.

The view goes down to the account. For sites using Cloudflare's Account Abuse Protection, still in early access, fraud teams can see which personal agents are active across their users and which agents act for a given account. That lets an analyst tell whether an unusual login came from an agent a customer has used for weeks or from one that appeared for the first time today.

The controls follow the analytics. Cloudflare is extending the agent policy it introduced this summer and renaming the setting AI Crawler and Agent access policies. Sites can set an overall agents policy and then choose, for each supported personal agent, to allow it, block it, or block it only on pages with ads. During onboarding Cloudflare now asks whether a site monetises pages with ads and tailors its recommended policies to the answer.

The next problem is context. A site may recognise the agent but not the person behind it: whether they are an existing customer or what they authorised the agent to do. Cloudflare says solving that will need privacy-aware ways to carry user context through an agent, to assess reputation and to establish accountability when something goes wrong, and that it is working with agent operators on it.