Cloudflare Adds Visibility and Granular Access Controls for Personal AI Agent Traffic
Cloudflare has launched new analytics and access control features to help site owners distinguish and manage traffic from personal AI agents (e.g., shopping or support assistants acting on behalf of end users) versus other bot traffic. The update adds a Personal Assistants category to Security Analytics' Bot Analysis chart and a new Top Statistics widget that lists which agents are visiting a site and their request volumes, paths, status codes, and source networks. For sites using the early-access Account Abuse Protection, fraud teams can now see which user an agent represents, filter accounts by AI assistant activity, and mitigate suspicious agent-driven logins at the account level via Hashed User ID WAF rules without blocking the agent site-wide. Cloudflare also expanded its AI Crawler and Agent access policies (renamed from AI bot policies) to allow granular per-agent control—Allow, Block on pages with ads, or Block—separate from existing Search and Training bot policies.
Detalhes técnicos
The features rely on Cloudflare's verified bot directory to identify specific personal agents in traffic logs and account activity. Site owners can set an overall Agents policy and override it per supported personal agent in Security Settings, with onboarding flows tailoring default recommendations based on whether a site monetizes via ads.
Remediação
Site owners are advised to review personal agent traffic via Security Analytics and the Account Overview pages, then configure policies under Security Settings → AI Crawler and Agent access policies to allow, restrict on ad-supported pages, or block specific agents according to business needs. Fraud teams should leverage per-account agent visibility to distinguish legitimate recurring agent use from suspicious new agent activity before mitigating via targeted WAF rules.
Linha do tempo
-
Cloudflare Adds Visibility and Granular Access Controls for Personal AI Agent Traffic
ler a análise desta fonte ocultar
Cloudflare has launched new analytics and access control features to help site owners distinguish and manage traffic from personal AI agents (e.g., shopping or support assistants acting on behalf of end users) versus other bot traffic. The update adds a Personal Assistants category to Security Analytics' Bot Analysis chart and a new Top Statistics widget that lists which agents are visiting a site and their request volumes, paths, status codes, and source networks. For sites using the early-access Account Abuse Protection, fraud teams can now see which user an agent represents, filter accounts by AI assistant activity, and mitigate suspicious agent-driven logins at the account level via Hashed User ID WAF rules without blocking the agent site-wide. Cloudflare also expanded its AI Crawler and Agent access policies (renamed from AI bot policies) to allow granular per-agent control—Allow, Block on pages with ads, or Block—separate from existing Search and Training bot policies.
Technical Details
The features rely on Cloudflare's verified bot directory to identify specific personal agents in traffic logs and account activity. Site owners can set an overall Agents policy and override it per supported personal agent in Security Settings, with onboarding flows tailoring default recommendations based on whether a site monetizes via ads.
Remediation
Site owners are advised to review personal agent traffic via Security Analytics and the Account Overview pages, then configure policies under Security Settings → AI Crawler and Agent access policies to allow, restrict on ad-supported pages, or block specific agents according to business needs. Fraud teams should leverage per-account agent visibility to distinguish legitimate recurring agent use from suspicious new agent activity before mitigating via targeted WAF rules.