See which AI assistants act on behalf of users in Account Abuse Protection
Hi, it's Shiichan! This one is very much about the era of AI assistants logging in for people.
Cloudflare Changelog
developers.cloudflare.com
What was announced?
According to Cloudflare's Changelog, Account Abuse Protection now shows when a recognized AI assistant makes a login or sign-up request, and which account it was acting for.
Why it matters
As AI assistants act on behalf of people, you want to tell suspicious bots apart from legitimate delegated actions that users asked for.
Blocking everything would hurt people who rely on those assistants.
What changes
You can see this in three places:
- Population overview: which AI assistants are active across your users and how many accounts use them
- Account activity: for every login and sign-up event, whether an AI assistant made the request and which one
- AI assistant filters: filter accounts by the number of AI assistant events or the number of AI assistants
This lets you investigate and mitigate a single account without blocking an assistant for everyone else who relies on it. It also helps you tune your agent settings in AI Crawler and Agent access policies.
Dive Deep
The post is clear about the limits:
- Visibility covers login and sign-up events only
- Requests from assistants that Cloudflare doesn't recognize appear as ordinary traffic
So this works for recognized assistants. See the AI assistants docs for details.
Wrap-up
- For recognized AI assistants, you can see their logins and sign-ups and the account they acted for
- You can filter accounts by assistant-related event counts
- You can handle one account at a time instead of blocking an assistant outright
- Only login and sign-up events are covered, and unrecognized assistants look like normal traffic
This is for anyone protecting authentication in the age of AI agents!
