A blog post Cloudflare published on 5 November looks at what websites lose when an AI agent, not a person, is the one using them. The author, Bryan Becker, focuses on agents that operators run in their cloud and that drive a browser on the user’s instructions. Becker cites Meta’s Muse and OpenAI’s dots as examples.

The site then sees the agent rather than the user, and one agent can act for many users. In almost every problem the company lists, the site bears the largest cost, Cloudflare said. If a user approves a purchase by the agent and later disputes it, the shop cannot show that the purchase came from the same device or IP address as earlier ones. If one user tries leaked credentials through the agent, the site can only block the whole agent, and with it the agent’s other users.

The site needs three pieces of information, the company said: who is acting, how trustworthy that actor is and who is responsible for the action.

Why CAPTCHA is not enough

Two common proposals fall short, Cloudflare said. A CAPTCHA that the agent passes on to the user proves only that some human is present at that moment. Operators also have a reason to bypass such friction. Narrowly scoped permissions do not help, because in practice agents ask for permission to do everything. Nor does scoping show who is responsible for a mistake.

The company proposes existing and emerging standards as the solution. With Web Bot Auth, an agent signs its requests cryptographically, so the site can identify the agent and its operator. What is still missing is a way to express that an agent is using another agent or a browser service as an intermediary.

Sites would learn only what they need about the user: nothing, a session, an account or, for example, a unique identifier based on identity verification. MOLE, a protocol in development, aims to limit request rates without user-specific identifiers. Sites would also need a machine-readable way to state what agents may do. Agents that run on the user’s own device, such as OpenClaw, are not the primary focus of the work.

The coalition and the tools now available

The Trusted Agent Delegation (TAD) coalition is not a new standard. It brings together industry players to examine the problems and review existing protocols. Where needed, it will take more narrowly defined problems to the IETF, the internet standards body. Cloudflare plans to hold separate meetings alongside IETF meetings.

Cloudflare customers can already see which agents visit their site in the Security Analytics view, the company said. Customers can allow each agent across the whole site, block it only on pages with ads, or block it entirely. Users of Account Abuse Protection, which is in early access, can see whether a login or sign-up came from an agent, and which one. They can restrict an abused account with a web application firewall (WAF) rule based on a hashed user identifier, so the agent keeps working for other users.