Cloudflare has published a position paper arguing that websites lose the ability to identify, serve and hold accountable the people behind AI agents, and that the web needs identity, reputation and accountability mechanisms for agents.
The post, published on 5 November, defines a hosted personal AI agent as an intermediary that takes instructions from a user and acts through a cloud computer or browser. It lists the problems that follow for a site. Account sharing, risk-based authentication, identity verification and fraud disputes all assume the site sees the user, and with an agent it sees the agent. Cloudflare also says one user abusing a shared agent for credential stuffing, scraping or card testing leaves the site able to block only the agent, which blocks every legitimate user of that agent as well.
Why it matters
For security teams the post describes why familiar controls stop working. Cloudflare says agents often run on residential addresses with real browsers, mixed in with human traffic, and that attackers copy a well-known agent’s user agent string to get the same allowances. Human verification adds little, since agents are never expected to be human, and risk-based authentication breaks because agents on cloud infrastructure look unusual every time.
Cloudflare favors Web Bot Auth, which lets an agent sign its requests, as the identity method. It points to MOLE as an upcoming approach to rate limiting without user-specific identifiers, and to OAuth for account identity. It says passing a CAPTCHA through to the user proves only that some human is present at that moment.
What to do
In our reading, the near-term step for defenders is inventory. Record which agent platforms your staff and customers use against your applications, decide which signed agents you will accept, and set separate rate limits and logging for agent traffic. The Cloudflare paper is a vendor proposal and no standard yet. Earlier CyberTech coverage of Bolster AI data on scams and of cloud billing admin as a privileged role shows the same abuse of automated access.
Source: Cloudflare Blog, Agents aren’t humans (but they kinda are)
