THE CRUNCH
Cloudflare has launched new analytics and access policies aimed at personal agents, the AI assistants that browse and act on websites on a person's behalf. Site owners can now see which agents are visiting, what pages they request and whether they are reaching checkout or hitting errors, then set access rules to match.
In Security Analytics, a new Personal Assistants category sits alongside the existing bot and human classifications, and a Top statistics widget lists which agents are visiting and how many requests each sends. Filtering on one agent updates every other widget to show just its traffic, including requested paths, status codes and source networks.
For sites using Account Abuse Protection, which is currently in early access, the visibility goes further: logins and sign-ups now show whether a personal agent made the request and which one. A fraud analyst can therefore tell whether an unusual login came from an agent a customer has used for weeks or one that appeared for the first time, and can mitigate a single account with a WAF rule on its hashed user ID without blocking the agent for everyone else.
On the control side, the existing Agents policy now supports per-agent choices for supported personal agents: allow, block on pages with ads, or block outright. The setting has been renamed AI Crawler and Agent access policies, while existing Search and Training policies are unchanged. Cloudflare frames the choice as a business decision: blocking agents altogether may feel safest but risks losing the customers they act for.