The problem: sites see the agent, not the user
According to Cloudflare's blog post, AI agents now act on the web on behalf of millions of people. To a site, an agent can sometimes be indistinguishable from an ordinary human visitor, and sometimes it looks like a single visitor carrying many users behind it. In that case the site cannot recognize the user, serve them properly, or hold anyone accountable when something goes wrong — while the site bears the cost.
Three core requirements
The post recalls that security and fraud prevention have traditionally required three things:
- Identity: Is the actor being truthful about who they are?
- Reputation: Is this actor trustworthy?
- Accountability: Who answers for the action?
Cloudflare says the same three questions must be answerable for agents.
Why agents are different
The post defines "personal AI agents" as automations that take instructions from a human and pursue a goal by controlling a cloud computer or browser. They are usually offered as a managed service run by an "operator"; examples given include Meta's Muse and OpenAI's dots. Agents don't tire, they run around the clock, they act in parallel, and they tolerate friction no human would. Much of the web — from capacity planning to revenue models — assumes exactly those human limits.
The Intermediation Principle
The post rests on what it calls the Intermediation Principle: the business relationship between users and sites, and each participant's security responsibilities, must be upheld regardless of intermediation. Cloudflare argues that an agent, along with the operator behind it, must be recognizable and accountable, because an agent can do at scale what no user could.
Why now
Agentic traffic is growing rapidly and may eclipse traditional human browsing in the near future, the post says. Sites could historically block intermediary traffic and ask users to disable the intermediary; that stops working when most traffic is agentic. The post leaves local agents running on a user's own device out of scope and focuses on remotely hosted agents.
