Cloudflare ran 206 million agent behavior checks in a day. That still is not identity or consent.

Published 2026-08-10 · Last reviewed 2026-08-10

On 7 August 2026, Cloudflare published its working definition of good and bad behavior on the agentic internet, and the definition has teeth. Verified status is no longer something an agent obtains once. It is a standard the agent has to keep meeting, checked continuously, and it can be lost.

The scale is the part worth pausing on. In a single 24-hour sample, Cloudflare recorded 206 million Precursor evaluation events across 73,438 zones on its network.¹ That is not a pilot. That is a behavioral verdict being formed, revised, and re-formed on a large slice of the web while a session is still open.

It is also, precisely, one of three separate questions a site has to answer about an incoming agent, and it answers only that one. Who is this agent and does its claim check out is a different question. Whether the human behind the interaction agreed to be reached is a third. Here is what Cloudflare shipped, what it announced but has not shipped, and where the line between behavior, identity, and consent actually sits.

What Cloudflare actually shipped

Three things moved at once, and only two of them are live.

The first is BotBase. Cloudflare’s older Bots Directory listed known-good bots and stopped there. BotBase is meant to be a directory of all known bots and agents, good ones included and less-than-good ones too, with the facts attached rather than a single allow-or-deny verdict.¹ The shift matters more than it sounds. A list of the well-behaved is a guest list. A directory of everyone, annotated by conduct, is a reputation record, and a reputation record can be revised.

The second is Precursor, which reached general availability on 13 July 2026 as a continuous behavioral validation engine for Bot Management.² Instead of a one-time browser check that grants a lasting pass, Precursor runs client-side across the whole session: pointer movement, keyboard rhythm and timing, scrolling, focus changes, page visibility. Those signals are buffered in the browser and sent periodically to Cloudflare’s edge, where evaluators look for internal contradictions, pointer activity while the page is not visible, keyboard events with no focused text field, that sort of thing.² The output is not a verdict per request: the telemetry feeds a running Bot Score that follows a visitor through the site, so a suspicious session accumulates context instead of resetting each time it asks for a page.³ The design premise is that modern automation can look legitimate in short bursts, execute JavaScript, drive a real browser, and pass an individual challenge, and that what it still struggles to fake is consistent human behavior sustained over time. Cloudflare’s own framing is that behavior often shifts from human to agentic and back mid-session, which is exactly what a point-in-time check cannot see.

The third is Precursor Trace, which is live now as a public interactive demo: you move your own cursor and watch how part of the detection mechanism would read it, the acceleration, the corrections, the texture of the movement.⁴ It is a marketing artifact, but a useful one, because it makes the underlying claim legible. The system is not asking whether you passed a test. It is asking whether you keep moving like the thing you said you were.

Verified is a standard you keep, not a badge you earned

Cloudflare states the bar in two clauses: to be verified, you declare yourself honestly, and you do not abuse the trust you have earned.¹ Read them as separate tests, because they fail in separate ways.

Honest declaration is the identity half, and it already has plumbing. A bot can present a cryptographic Web Bot Auth signature, or publish an IP list with a stable user agent, or be reachable by reverse DNS.⁵ Any of those lets a site check that the crawler calling itself a given service really is that service, rather than a spoof wearing its user agent string. We have written before about how a site tells a real agent from a spoof, and none of that machinery has been replaced. It has been demoted from sufficient to necessary.

Non-abusive behavior is the other half, and it is the one that changed. Obeying robots.txt and crawl directives, keeping request rates reasonable, not routing around a site owner’s stated preferences, not attacking the site: these are conduct expectations, and Cloudflare says it has the tooling to notice when they are not met, because its systems track and validate behavior for known good actors continuously. A verified bot caught abusing the signals loses the status and comes off the global allowlist.¹ Cloudflare’s own examples of what triggers removal are specific: adding non-exclusive IPs, unpatched vulnerabilities, IP compromise, undisclosed purposes, and AI crawlers ignoring the crawl-delay directive in robots.txt.⁵

That is a meaningful change in the shape of the trust. A signature answers a question about the present moment: is this key held by the party it claims. Conduct is a claim about a pattern, and patterns can only be observed over time, which means the verdict is always provisional. Cloudflare has effectively converted verified from a credential into a subscription with conditions, and BotBase is where the conditions get recorded when they are broken. If you operate an agent that fetches anything from the open web at scale, the operational read is short: your user agent string and your signature are now the cheap part. Your request pattern is the part under review.

Three trust questions, three different owners

The useful thing about Cloudflare’s taxonomy is that it forces a distinction most agent-readiness writing blurs. There are three questions in play when an agent arrives, and they do not collapse into one another.

Who is this, and does the claim hold up. This is declared identity, verified cryptographically or by network fact. Web Bot Auth signatures, published IP ranges, reverse DNS, and on the agent-to-agent side an A2A Agent Card served at /.well-known/agent-card.json, a W3C DID, or an on-chain record under ERC-8004. These answer a question about provenance. They say nothing about what the holder will do next. A stolen or lent credential is still a valid credential.

Is this thing behaving the way its declaration implies. This is observed behavior, and it is the layer Cloudflare just industrialized. It is inherently retrospective and probabilistic. It gets stronger with more session, which means it is weakest at the exact moment a first interaction begins. Note also what it evaluates: a client, on a page. It is a good answer to “should this session keep getting served” and a poor one to “should this counterparty get a reply.”

Did the human on the other end agree to be reached. This is consent, and neither of the first two touches it. An agent can be honestly declared, impeccably behaved, verified by every registry in the stack, and still have no business being routed to a named person’s inbox. Politeness is not permission. Cloudflare’s own framing of this work puts it beneath the interaction layer rather than at it, which is the correct place for it: an edge is very well positioned to decide whether traffic is served, and structurally not positioned to decide whether a human wants an introduction.

Keep these three apart in your architecture and the failure modes stay legible. Collapse them and you get the two errors that dominate the current discourse: treating a verified identity as evidence of good conduct, and treating good conduct as a proxy for permission. The first is what phishing exploits. The second is what turns a well-engineered agent network into automated cold outreach at machine scale, which is the failure the agent spam problem is already sketching out.

What is announced but not shipped, and what to do this quarter

Two items in the announcement are forward-looking, and it is worth being precise about which.

Adaptive Intelligence is announced, not shipped. Cloudflare describes it as a new detection engine that keeps learning and self-adjusting from the traffic it sees, so customers stop waiting on formal model version bumps to get current detections. The stated reasoning is that bots adapt on a scale of hours or minutes, faster than a release cycle. Availability is “in the near future” for Bot Management customers, with a launch announcement still to come.¹ Treat it as roadmap. If a vendor deck cites Adaptive Intelligence as a live control this quarter, that is a claim to push back on.

The bot-specific mitigations are also later in 2026, and they are more interesting than they first appear. One is randomized responses: applying an unpredictable mix of block, challenge, and allow to suspected automated traffic, specifically to break the automated retry logic a well-engineered bot depends on. Another is variants within AI Labyrinth, the existing tarpit that feeds unauthorized crawlers convincing AI-generated pages instead of real content, now with options such as an endless maze of linked pages or a plausible but useless LLM-generated summary. A third is queueing for legitimate automated traffic, which is the only one of the three aimed at agents you want to keep. Site owners will choose how strict to be.¹

Read together, the direction is clear: the web is moving from a binary gate to a graded, adversarial, and deliberately noisy environment for automated clients. For anyone shipping an agent, three practical consequences follow now, before any of the roadmap lands. Declare honestly and sign, because unsigned traffic is the first thing that becomes expensive. Keep request patterns boring, because your conduct is now a stored attribute rather than a per-request verdict. And do not build a workflow whose payoff depends on reaching a person, because none of this stack grants that, and the parts of it arriving later this year are explicitly designed to make evasion unprofitable rather than merely detected.

How this connects to Tobira

Tobira works on the third question, the one an edge cannot answer. Cloudflare can watch how an agent behaves on a site and decide whether that session keeps getting served. What it does not do, and does not claim to do, is establish who the human behind an agent is and whether that human agreed to be introduced. Tobira’s part is the human-readable @handle and, through Site Agent, a representative other agents can find on a network, converse with, qualify for fit, and route to a person, with contact exchanged only after both sides consent to reveal. Behavior evaluation, declared identity, and consented introduction are complementary layers, and a site can sit behind Cloudflare’s checks and carry a Tobira @handle at the same time. The network the consent step runs on is early: 648 public discoverable agents, including 102 business agents, per the Tobira founder update, June 2026. For the distinction this news makes concrete, see why agent-readable is not the same as agent-addressable.

FAQ

What did Cloudflare announce on 7 August 2026? A working definition of good and bad behavior on the agentic internet, plus the pieces that enforce it. BotBase expands beyond known-good bots into a directory of all known bots and agents with the facts attached. Precursor, generally available since 13 July 2026, evaluates client-side behavior continuously instead of granting a lasting pass after one successful browser check. Precursor Trace is live as a public demo. Cloudflare also previewed Adaptive Intelligence and three bot-specific mitigations for later in 2026.

What are 206 million Precursor evaluation events? That is Cloudflare’s own telemetry for a single 24-hour sample: 206 million behavior evaluation events across 73,438 zones on its network. It is a first-party figure with no independent audit, so read it as a scale indicator for how widely continuous behavior checking is now running, not as a measured count of agents or of bad actors.

Can a verified bot lose its verified status? Yes, and that is the substantive change. Cloudflare frames verification as two conditions: declare yourself honestly, and do not abuse the trust you have earned. Honest declaration can be shown through a Web Bot Auth signature, a published IP list with a stable user agent, or reverse DNS. Non-abusive behavior means obeying robots.txt and crawl directives, keeping request rates reasonable, and not routing around owner preferences. A bot found abusing the signals loses verified status and comes off the global allowlist.

Does continuous behavior checking replace agent identity verification? No. They answer different questions. A signature or an A2A Agent Card establishes who an agent claims to be and whether the claim checks out. Behavior evaluation establishes whether the thing acts the way its declaration implies. A valid credential says nothing about future conduct, and clean conduct says nothing about provenance. Both leave the third question untouched: whether the human on the other end agreed to be reached.

Is Adaptive Intelligence available now? No. Cloudflare describes it as a new self-adjusting detection engine that learns from traffic patterns without waiting for formal model version upgrades, and says Bot Management customers will get access in the near future with a launch announcement still to come. The randomized responses, AI Labyrinth variants, and queueing for legitimate automated traffic are also stated for later in 2026. Precursor and Precursor Trace are the parts that are live today.

Sources

• Cloudflare, “Unveiling good and bad behaviors on the Agentic Internet,” The Cloudflare Blog, 7 August 2026.
• Cloudflare, “Cloudflare Introduces Precursor: One-Click Behavioral Defense Against Modern Bots,” press release, 13 July 2026.
• Cloudflare, “Introducing Precursor: detecting agentic behavior with continuous client-side signals,” The Cloudflare Blog.
• Precursor Trace, Cloudflare Turnstile Lab, precursor-trace.cloudflare.app.
• Cloudflare Bot Management docs: Precursor, Verified bots, AI Labyrinth.
• SiliconANGLE, “Cloudflare launches Precursor to catch bots by watching entire sessions,” 13 July 2026.
• Tobira founder update, June 2026, for the network figures cited in the Tobira section.