Cloudflare on November 5, 2026 published a long position paper arguing that AI agents acting for people on the web have broken the link between websites and their users, and that websites now absorb the cost when something goes wrong - from disputed purchases to content read without a visit or an ad view. The post, written by Bryan Becker and titled "Agents aren't humans (but they kinda are)," lists 14 problems agents create for site operators, sets out a four-level scale of user identity, announces a Trusted Agent Delegation coalition that will take the work to standards bodies, and describes three controls Cloudflare customers could use the same week.

In Short

AI agents now browse and shop for people, so a website often sees only the agent and not the person behind it, and Cloudflare says that leaves the website paying when an order is disputed, a password is abused or an article is read without anyone seeing an ad. That matters to anyone who sells, publishes or advertises online, because the tools used to stop fraud, recognise loyal customers and earn money from visits all assume a person arrives directly. Cloudflare wants open standards that let an agent prove who it is and who it works for, and in the meantime its customers can see which agents visit, block some of them only on pages carrying ads, and act against a single abusive user without shutting out everyone else using the same agent.

What Cloudflare published

The post appeared on the Cloudflare Blog on November 5 under the tags Agents, AI, Bots, Privacy and Security, and is listed as a 15-minute read. Its URL slug, trusted-agent-delegation, points to its main purpose: making the case for a new coalition. It follows a shorter Cloudflare post from November 4, written by Marina Elmore and Nicole Justus, which described the visibility and control features for personal agents that Becker's post later summarises.

The paper opens with definitions. "Personal AI Agents," according to Cloudflare, are "automations that take instructions from a human ('User') and pursue a goal by controlling a cloud computer or browser." They are usually run by an "Operator" as a managed service or consumer product. The company names two examples: Muse from Meta and dots from OpenAI. "More are launching all the time," the post says.

What separates agents from people, in Cloudflare's account, is the absence of human limits. "They don't tire, they run around the clock, they act in parallel, and they put up with friction no person would," according to the post. "Much of the web, from how Sites plan capacity to how they make money, assumes those limits."

The core of the argument is that a remotely hosted agent is an intermediary - something that sits between a user and a website, so that the website sees it instead of the user. Intermediaries are not new. Cloudflare lists cloud browsers, which software controls on a user's behalf, and proxies, including VPNs, as older examples. What has changed, according to the company, is scale: "Agentic traffic is growing rapidly and may eclipse traditional human browsing on the Internet in the near future." The post gives no figure for current agent traffic and no date for when that crossover might happen.

That trajectory, Cloudflare argues, removes a long-standing option. A website could once block intermediary traffic and ask users to switch off the service. "That stops working when the majority of traffic is agentic," the post states. Once blocking is off the table, "the Site loses direct information about the User and must decide whether to trust the intermediary without it."

The paper limits itself to agents hosted somewhere other than the user's device. Local agents, such as OpenClaw, or agents running in a user's own browser on their own machine, are treated separately near the end.

The Intermediation Principle

The whole document rests on one rule, which Cloudflare calls the Intermediation Principle: "The business relationship between Users and Sites, and each participant's security responsibilities, must be upheld regardless of intermediation."

In practice, according to the post, websites need new tools to "recognize, serve, and hold accountable" a user acting through an agent, as they could if that user had visited directly. The agent and its operator must also be recognisable and accountable, "because an Agent can do what no User could." Even behaviour that used to be harmless becomes a risk once agents can multiply a single person's access "almost without limit," in Cloudflare's words.

Security and fraud prevention, the post notes, have traditionally relied on three things - Identity, Reputation and Accountability - which let a website ask whether the person acting is truthful about who they are, whether that person is trustworthy, and who answers for the action. Agents, the company argues, break all three.

Ezra, the grocer and the bank

To make the problem concrete, Cloudflare tells a story about Ezra, a personal assistant who runs errands for four clients: Amy, a local CEO, and Bob, Charlie and Debra.

The corner grocer used to know Amy's tastes and set aside items she might like. Now only Ezra comes in, carrying orders for four people, and the grocer cannot tell whose preferences are whose. He does not want to turn her away, because she brings a lot of business.

Then Bob asks Ezra to buy him an iPhone. A week later he calls the store, says he never authorised the charge, and keeps the phone. To win the dispute, the store must prove Bob asked for it - "But the only person the store ever saw was Ezra."

Charlie hands Ezra a list of passwords, one of which might open Charlie's bank account, and she patiently tries each one. The bank sees an attack under way, but the only person it can ban is Ezra. Banning her also bans Amy, Bob and Debra.

"None of these business owners has a problem with Ezra herself," according to the post. "Their problem is that they can only see Ezra, not the person she's acting for." Replace Ezra with an AI agent and the businesses with websites, the post says, and the result is the web as it stands.

Fourteen problems, one bill

The centrepiece of the paper is a table of 14 challenges that Cloudflare says were previously solved for websites but become harder once agents are allowed in. Each row pairs a problem with what a website owner is trying to achieve. The company's conclusion is blunt: "In nearly every challenge above, the Site bears the primary cost."

Fraud and payments

Three rows deal with money. Friendly fraud - a user approves an agent's purchase and then disputes it as unauthorised - is the clearest. Websites can sometimes win such disputes with circumstantial evidence, such as a purchase coming from the same device, IP address and delivery address as the user's earlier undisputed orders. "Agent purchases come from the Agent's infrastructure, so that evidence doesn't exist," according to the post. "Even when the Site wins, the dispute itself costs money." Cloudflare adds that keeping records of checkout behaviour lets websites reduce verification friction, lower decline rates and complete more checkouts.

Unauthorized card users is the second. When an authorised user makes a purchase on a card, the cardholder is responsible, and a cardholder who hands the card to someone else remains responsible for having done so. Agents, the post says, have no authorised-user status, so the website cannot tell whether the user stands behind a purchase. "In practice, when the User disputes it, the Site pays."

Misalignment covers agents simply getting things wrong: "the wrong item, the wrong date, duplicate orders." Websites may absorb the cost through refunds and support to keep customers happy, "with no way to tell which Agents are reliable."

Identity, compliance and security

A second cluster concerns knowing who is on the other end. Under Compliance and illegal activity, Cloudflare notes that some websites must meet legal requirements such as age or geographic restrictions, and that agents "do not provide guarantees that can meet the bar" for those websites to stay compliant if they allow agent access.

Identity verification breaks describes what happens to liveness checks and KYC identity checks, which assume the person present is the person being verified. "The Agent is never that human," the post says. The website must then accept verification passed through by the agent, which weakens the check, reject agents, or drop the check entirely.

Identity spoofing is the reverse problem. Agents often run on residential IP addresses and real browsers, are mixed in with human-directed traffic and, according to Cloudflare, "take efforts to not distinguish themselves from human traffic." Attackers then copy a well-known agent's user agent string to receive the same allowances. Policy circumvention follows: a website that wants to block, rate-limit or admit only partners cannot do so reliably when agents do not identify themselves or bring information about the user they act for.

Risk-based authentication breaks because such systems expect device, location and behaviour to match the user, and agents running on cloud infrastructure "look unusual every time." Traffic commingling is the bank scenario from the Ezra story: when one user abuses a shared agent for credential stuffing, scraping or card testing, the website can detect the abuse "but can only block the Agent, which also blocks all of its legitimate Users."

The row titled Human verification is irrelevant argues that CAPTCHA tests and similar human checks lose their meaning. "Agents are never expected to be humans," according to the post. Solutions that pass the check through to the human user "add no new information and just make Agents less efficient."

Content, capacity and the user relationship

The rows closest to the advertising and publishing business concern who pays for content and who gets credit for a visitor. Uncompensated consumption describes an agent that reads or extracts articles, product data or reviews "to answer the User somewhere else." In that case, according to Cloudflare, "The Site pays to serve it and gets no visit, ad impression, or purchase."

User attribution covers personalisation, recommendations and loyalty programmes, which rely on analytics tied to a user's session and device. Agent traffic, the post says, "either groups many Users into one client or shows up without the User's session at all." Account sharing raises a related worry for subscription businesses: a website sees one account and one client when an agent connects, so it cannot tell whether one paid subscription serves many people.

Resource exhaustion completes the list. Free services and engagement-driven websites were built around assumed limits on how much a person would do. Agents, according to Cloudflare, "poll constantly (e.g. stock and price checks), hit expensive endpoints (e.g. search, inventory, or support chat), and use up free trials and promotions."

What Cloudflare wants, and what it rejects

The company frames its aim as "an Internet where all Users have equal or greater access to websites than they had before." Before agents, websites managed these risks by fingerprinting a user's device, session and history. Users could still browse in private mode, and Cloudflare says agents should be able to do the same. "But they probably won't be able to log in to a bank without additional verification."

None of this, according to the post, requires an agent to behave like a human, or a human to be present for every action. It requires that websites can obtain or demand information about the user "to hold them accountable, when applicable, with or without an Agent."

Two popular fixes are dismissed. The first is passing a website's CAPTCHA through to the user. That proves some human is present at that moment - "human in the loop," or HITL - "and nothing more," the post says. Cloudflare treats HITL mainly as a guard against misalignment, which it describes as a matter between the operator and the user. It cannot tell Bob from anyone else, and "Agents exist to remove friction, and HITL adds back that friction, so Operators are incentivized to remove or bypass it for the User."

The second is tightly scoped access controls. "Agents are built to do anything a User could, so in practice they ask for, and get, permission to do everything," according to the post. "A scope of 'everything' tells the Site nothing." Even a narrow scope, Cloudflare argues, only says what an agent was allowed to do, not "who answers when the Agent gets it wrong, which is the question the Site actually needs answered."

The building blocks Cloudflare proposes

Rather than a single new product, the post points to a set of existing and emerging protocols, several of which Cloudflare co-authors.

Protocols

For rate limiting, the company points to MOLE, which it describes as an approach that "aims for rate limiting without User-specific identifiers." The Internet-Draft linked from the post expands the acronym as Moderation of unLinkable Endorsements. That draft lists three authors - S. Schlesinger of Google, D. Jackson of Mozilla and T. Meunier of Cloudflare - carries a publication date of November 3, 2026, has informational status and expires on May 7, 2027. It describes a system in which a third party, called an Anchor, vouches for a client; the client exchanges that endorsement with the party controlling access, called a Moderator, for a credential without revealing which Anchor vouched for it; and the Moderator can then adjust trust over time, including by changing rate limits.

Cloudflare compares MOLE with the x402 protocol, which "aims to enable payments on the web while remaining privacy-preserving." The post also describes Private Access Tokens as "one early way in which we tried to establish trust without identifying the user," and states that MOLE "is intended to be the successor to this technology."

Identities

For identifying the agent itself, Cloudflare names Web Bot Auth as "our preferred method." The scheme, abbreviated WBA, lets an agent cryptographically sign its requests, which identifies the agent and, implicitly, its operator. Cloudflare concedes a gap. It still has to define how the scheme handles chains of intermediaries: "when Agent A uses Agent B inside Browser C, the Site needs to be able to know this."

User identity, in Cloudflare's framing, is "a spectrum," ideally applied with principles of data minimization. In many cases, the post says, privacy-preserving tools such as Privacy Pass and MOLE can establish whether a client can be trusted without establishing who it is. Where more is needed, the company sets out four levels of disclosure:

  • Nothing - users act online without bringing any identifier.
  • Session - requests in one session are linked to a single agent, so a website can build reputation for that session. The post cites Poppy, which it says has a notion of a session ID for this purpose. The Personal Agent Protocol website that Cloudflare links describes Poppy as a draft open protocol under the Apache 2.0 licence, using short-lived session tokens bound to a key held by the agent; the site does not name the organisation behind it.
  • Account - requests are attributed to the same user across sessions through a stable identifier from the operator or a third party. Cloudflare's example use case is letting a user bind a website account to an agent account.
  • Unique - a per-user identifier from a third party that persists across operators, accounts, agents and sessions, suited to high-risk actions, scarce resources or strict compliance duties. Government IDs, third-party identity verification and "decentralized technologies like Proof of Human" are given as examples.

The decision rests with the website, according to the post, which must work out what it needs to answer "is the entity behind this request allowed to do this action at this time?" Cloudflare maps the tools it expects to carry that information: WBA for an agent's platform identity, MOLE for user reputation and OAuth for account identities.

Claims

Some actions need a fact about the real person rather than an identity - being over 18, for instance, or being the cardholder. Often, the post notes, the operator verified this at sign-up, or a third party already holds the information. What is missing is a way for websites to ask for such claims and for operators or third parties to supply them.

Site Agent access policy

Today, according to Cloudflare, an agent learns a website's rules by trying something and seeing whether it is blocked. "That wastes resources on both sides, and in some cases makes honest Agents appear to be malicious," the post says. Robots.txt tells a crawler where it may go, "but isn't fully suited to express what Agents may do."

Websites need a machine-readable way to publish which actions agents may take, the company argues. The Internet Engineering Task Force's AI Preferences Working Group is working on preference signals, but its focus is on uses such as training, inference and search, and, according to the post, "there is still not a group focused on the larger need for preference expression mechanisms discussed here."

Local agents left for later

Agents that are not run as intermediaries - on-device agents or locally hosted ones such as OpenClaw - raise different concerns, according to the post. "Primarily, they look like (and are) automation, and they have no single party to build reputation or hold accountability with." One option would be asking them to present a unique ID, but Cloudflare states that this "is not the initial focus of Trusted Agent Delegation."

The Trusted Agent Delegation coalition

The organisational announcement comes near the end. Cloudflare says it has been working with "major Operators, identity verification companies, payment providers, merchants, publishers, proxy providers, and cloud browsing companies" to align operational needs with standards work in the IETF and elsewhere. It lists the working groups and activities it is following: Web Bot Auth, AIPREFs, OAuth, WIMSE and MOLE.

The Trusted Agent Delegation (TAD) coalition is meant to bring representatives from across that ecosystem together to discuss the problems in the paper, "examine all existing protocols," and then take better-defined problems to the IETF "as needed." Cloudflare says it intends to hold side meetings at the IETF and workshops "in the future." No dates are given.

The post does not name a single coalition member, and neither does the coalition's own website, trustedagentdelegation.org, which offers an email subscription form rather than a membership process and says the open standards are being developed in the IETF and the W3C. Becker's paper invites companies building agents or agent runtimes, running edge or cloud platforms, or managing commercial or compliance infrastructure to take part. Who has agreed to do so, and on what terms, is not disclosed.

Three controls already switched on

The final section turns from standards to products. "As of this week," according to Cloudflare, its customers can take three steps.

Visibility. Security Analytics now shows Personal Assistants as a separate traffic category, and a new widget lists every agent visiting a website, how many requests each sends, the paths it hits and the errors it encounters. Enterprise Bot Management customers can also use Business Insights for a broader view of how AI crawlers and bots affect their business, "including how much each Operator crawls versus the traffic it sends back."

Per-agent access. Through AI Crawler and Agent access policies, a website can allow an agent across the whole site, block it only on pages that carry ads, or block it entirely. Search and Training policies, the post says, "stay independent" of those agent settings.

User-level action. For websites using Account Abuse Protection, which is in early access, every login and sign-up now shows whether a personal agent made the request, and which one. When an attacker abuses a shared agent on one account, the website can mitigate that account with a WAF rule on its Hashed User ID, without blocking the agent for every other legitimate user. Cloudflare calls this "a first, concrete answer to the Traffic commingling challenge."

"These are the first building blocks of the vision, already in production," the post says. "More will follow as the standards mature." Companies with "a more restrictive position on Agents" are invited to contact Cloudflare through customer support or by email.

The post does not say which Cloudflare plans include the Personal Assistants analytics or the per-agent policies, how many agents Cloudflare currently recognises, or how it identifies an agent that does not sign its requests.

Why this matters for marketers and publishers

For advertisers and publishers, the most direct line in the paper is the one about content consumed elsewhere: a website "pays to serve it and gets no visit, ad impression, or purchase." The option to block an agent only on pages with ads is a practical response to that problem. It also extends a business model Cloudflare has been building for more than a year, which began when Cloudflare launched pay per crawl in July 2025 and shifted in July 2026 when Cloudflare stopped charging AI per crawl and started paying per answer. Separating agent access from Search and Training settings follows an August decision in which Cloudflare blocked opaque AI crawlers from sites that disallow training.

The agent Cloudflare names first already dominates third-party counts. In early October, Meta's Muse accounted for 72% of AI agent requests in HUMAN's data, and Amazon blocked Meta's Muse agent from shopping on its site - the kind of blanket block Cloudflare says stops working once most traffic is agentic. A week later, DataDome found Muse produced 33% of agentic browser requests in September despite only nine days of measurement in that month. DataDome later reported that Meta's Muse agent started carrying a signed ID in a quiet test from around October 12, using the same Web Bot Auth scheme Cloudflare calls its preferred method.

How rare that kind of signature remains is the point of Cloudflare's identity argument. Arkose Labs found 97.7% of legitimate AI agent sessions carried no verified ID between July 1 and September 30, while agents reached login, registration and checkout flows at 65.2% of its customers. Detection is no easier: in Resemble AI's own test, bot tools caught between 3.1% and 14.8% of disguised AI agents, a vendor figure with no published sample size. In January, PPC Land reported on AI agents caught masquerading as humans to bypass website defenses, the behaviour Cloudflare's Identity spoofing row describes.

The fraud rows matter because agents are already reaching the checkout. Microsoft Clarity data showed checkout appearing in 25% of AI agent sessions versus 15% for humans, and in June PPC Land examined the merchant side of the problem under the headline AI agents are now buying things - and fraud looks identical. The claims layer Cloudflare describes - proving age or card ownership without full identity - overlaps with services such as Experian's Agent Trust, launched to verify the humans behind AI shopping. Payment protocols are a parallel track; Cloudflare partnered with Visa and Mastercard to secure AI agent shopping in October 2025, and updated its x402 template in January 2026.

Several pieces of the agenda have been visible for months. Cloudflare unveiled a registry format for bot and agent authentication in November 2025, and in October 2026 Cloudflare outlined trust scores for Verified bots that ignore site rules - reputation for the bot. The November paper extends that logic to the person behind the agent. The scale behind the urgency is a Cloudflare forecast: in September, Cloudflare CEO Matthew Prince forecast bot traffic reaching 1,000 times human traffic within five years.

The standards picture is crowded. W3C's Strategy Team in October drafted a nine-point declaration putting people ahead of AI agents and proposed an Agentic Web Working Group. At the IETF, the AI Preferences group, whose focus Cloudflare describes as narrower than the problem, is where Google, Microsoft, OpenAI and Anthropic backed one AI training opt-out on October 30. Courts are moving too: in March, a court blocked Perplexity's Comet browser from Amazon's accounts. Cloudflare's own record on undeclared automation includes a dispute with Perplexity, which denied training AI models as Cloudflare documented stealth crawlers.

What the post leaves open

Several questions sit outside the paper. Cloudflare publishes no figures on how much agent traffic it sees, how many disputes or refunds agents generate, or how many customers use the new controls. The coalition has a name, a website and an agenda, but no listed members, no meeting dates and no stated governance. The multi-intermediary problem - Agent A using Agent B inside Browser C - is flagged as unsolved. Account Abuse Protection, the feature Cloudflare presents as its first concrete fix for commingled traffic, is still in early access.

The paper is also an argument made by a company that sells bot management to the websites it says are bearing the cost. That does not make the problems it lists less real; several of them match what other vendors and researchers have reported. It does mean the proposed fixes run, at least for now, through Cloudflare's own products and through protocols it co-authors. The test of the Trusted Agent Delegation coalition will be whether agent operators such as Meta and OpenAI - both named in the post as examples, neither named as members - agree to carry the user information websites say they need.

Timeline

Summary

Who: Cloudflare, in a blog post by Bryan Becker, with a companion post by Marina Elmore and Nicole Justus. The issues affect website operators, publishers, retailers, payment providers and advertisers, and the operators of personal AI agents such as Meta's Muse and OpenAI's dots, which the post names as examples.

What: A position paper listing 14 challenges that remotely hosted AI agents create for websites, with Cloudflare arguing that websites bear the primary cost in nearly all of them. It proposes an Intermediation Principle, a four-level scale of user identity (nothing, session, account, unique), the use of Web Bot Auth, MOLE, x402 and OAuth, and a machine-readable way for websites to state what agents may do. It announces the Trusted Agent Delegation coalition, which names no members, and describes three customer controls: a Personal Assistants analytics category, per-agent access policies including blocking on pages with ads, and user-level mitigation through Account Abuse Protection, which is in early access.

When: The post was published on November 5, 2026; the companion post on November 4. The controls were available "as of this week," according to Cloudflare. No dates were given for coalition meetings or IETF side sessions.

Where: On the Cloudflare Blog, with the coalition at trustedagentdelegation.org and standards work planned at the IETF and the W3C. The controls apply to websites on Cloudflare's network.

Why: Cloudflare argues that agents cut websites off from the users behind them, removing the identity, reputation and accountability that fraud prevention, compliance, personalisation and advertising revenue depend on, and that blocking agents will stop being an option as agent traffic grows.