THE CRUNCH
Cloudflare has launched Turnstile Spin, a feature that lets AI coding agents set up and fix its Turnstile bot protection on websites. The tool automates the two-step process of adding the widget to the frontend and wiring up the backend verification, aiming to make security accessible to users without deep backend knowledge. Spin can handle fresh installs, fix missing backend validation, and migrate away from older CAPTCHA providers.
Turnstile Spin is designed to fit into existing AI coding workflows, such as those using Claude Code, Cursor, or Codex. The agent finds the relevant frontend and backend code, proposes a plan, and waits for approval before making changes locally. Cloudflare emphasises that the agent does not send application code to its servers, keeping the integration secure and self-contained.
The feature is available from the Cloudflare dashboard, via Wrangler, or by pasting a public skill URL into an agent. It can handle three main scenarios: fresh installs, widget recovery for sites missing backend validation, and migrations from other CAPTCHA providers. Since its July release, the dashboard has recorded over 65,000 successful Spin widget creations.
Cloudflare says Turnstile processes about three billion verifications on a typical weekday. The company argues that AI coding agents lower the barrier to building applications but also increase the risk of automated abuse, making tools like Spin increasingly important for maintaining security without requiring manual effort.