JA EN
shiichan

See the Agents, Set the Terms: Cloudflare Adds Analytics and Per-Agent Policies!

Cloudflare Blog ★★★★ View Markdown
#cloudflare#ai#web#security

Hi, it's Shii-chan! Cloudflare has news about personal AI agents, the ones that blur the line between human and bot traffic!

Cloudflare Blog blog.cloudflare.com

What was announced?

In the Cloudflare Blog, Cloudflare announced new analytics showing how personal AI agents access a site, and finer-grained access policies that let you allow or block each agent. The goal is to welcome agents on your own terms instead of choosing between blocking everything and accepting everything.

Why it matters

Personal agents are becoming common, and the line between automated and human traffic is blurring. If you can't tell who is visiting, you can't decide what to do about it!

What changes

First, analytics make agents visible:

  • A new "Personal Assistants" category in the Bot Analysis chart in Security Analytics shows only personal agent traffic over time
  • The Personal Assistants widget in Top statistics lists each visiting agent with its request count
  • Filtering on one agent shows its requested paths, status codes, and source networks

Second, policies let you set terms per agent.

Dive Deep

Here's how the policies work:

  • The setting is renamed "AI Crawler and Agent access policies" and lives in Security Settings
  • For each supported personal agent, choose Allow (do not block), Block on pages with ads, or Block
  • The overall Agents policy is the default, and per-agent choices override it
  • For example, block agents on ad-supported pages by default but allow one specific agent
  • Search and Training policies are unchanged
  • Onboarding for new zones asks whether you monetize pages with ads and tailors recommended policies

For sites using Account Abuse Protection (early access), agent activity is tied to user accounts:

  • See which agents are active and how many accounts use each
  • Login and sign-up events show whether an agent made the request, and which one
  • Each account lists the agents acting for it
  • If an attacker uses an agent on an account, apply a WAF rule to that account's Hashed User ID without blocking the agent for other users

Looking ahead, Cloudflare says agent identity is only part of the picture, and plans privacy-aware work on carrying user context through agents, assessing agent reputation, and accountability when something goes wrong.

Wrap-up

  • The Personal Assistants category and widget reveal personal agent traffic
  • Set Allow, Block on pages with ads, or Block per agent
  • Account Abuse Protection tracks agent activity per account
  • Find it in Security Settings under AI Crawler and Agent access policies

This is for site owners who want to understand agent traffic and set their own terms!

Related posts