Cloudflare Adds Visibility and Controls for Personal Agents

Cloudflare has added traffic analytics and more detailed access policies for personal agents, software that acts online on a person’s instructions. The company says the new tools help site owners see which agents visit, what they request and whether to allow them.

A personal agent might compare products, find support articles or complete a purchase for a customer. To a website, those actions appear as automated traffic. Cloudflare says identifying the agent behind a request can help operators decide whether that activity supports their business or creates risk.

Personal Agents Appear in Security Analytics

Cloudflare added Personal Assistants as a category in the Bot Analysis chart in Security Analytics. The category appears alongside Verified Bot, Likely Human, Likely Automated and Automated. Security teams can select it to view personal agent traffic over time.

A new Personal Assistants widget in Top statistics lists visiting agents and the number of requests each sends. Filtering by one agent updates the other widgets to show its requested paths, response status codes and network sources. Site operators can see whether an agent is logging in, reading product pages, reaching checkout or encountering errors on pages it cannot use.

Sites using Account Abuse Protection, which Cloudflare says is currently in early access, can also see which user an agent represents. A population overview shows active agents across users and the number of accounts using them. Login and sign-up events indicate whether an agent made the request and identify it.

Each user’s account overview also lists agents acting for that account. Cloudflare says fraud analysts can compare a familiar agent with one that appeared for the first time that day. If an attacker appears to be using an agent on an account, analysts can mitigate the account with a WAF rule on its Hashed User ID, without blocking that agent for other users.

The new views give operators information to decide whether to welcome, limit or block personal agents. Cloudflare has also described concerns about agent traffic in its earlier coverage of AI agent costs.

Personal Agents Get Separate Access Choices

Cloudflare is expanding its existing Agents policy with options for supported personal agents and renaming the setting AI Crawler and Agent access policies. Site owners can set an overall Agents policy, then choose a separate rule for each supported agent: Allow (do not block), Block on pages with ads, or Block. Search and Training policies remain as they are.

For example, an operator can block agents on pages with ads overall while allowing a supported agent it wants to welcome. When a site owner adds a zone, Cloudflare asks whether the site monetizes pages with ads and uses the answer to tailor recommended policies. Owners can revisit the controls in Security Settings.

The policy choice depends on how a site works. Cloudflare says one publisher may allow an agent across its site so readers can find articles, while another may block it on ad-supported pages. The company’s account of its blog migration also describes a different way Cloudflare has adapted its web publishing operations.

Cloudflare Says User Context Is Still Missing

Cloudflare says recognizing an agent does not necessarily tell a site whether the person is an existing customer, what the person authorized or whether a subscription and other protections apply. The company identifies carrying user context through agents, assessing reputation and establishing accountability as work still needed.

Cloudflare says it plans to share more as it works with agent operators and others. For now, it directs site owners to review how personal agents access their sites and choose access terms in Security Settings. Its Zero Wire announcement provides related coverage of Cloudflare’s security tools.