Original announcement: Cloudflare · 2026-11-04. Read the official announcement.
Summary of the Update
On November 4, 2026, Cloudflare announced new features to help website owners monitor and manage personal AI agents that access their sites. These enhancements provide more detailed analytics about the agents’ activity and allow customized access policies to regulate their interaction with site content. The update targets businesses and security teams concerned with differentiating legitimate agent-driven traffic from potential risks or abuse.
What Happened?
Cloudflare introduced upgraded analytics within its Security Analytics dashboard that identify personal AI agents distinctly from other traffic types such as verified bots and human users. A new Personal Assistants category and widget show which agents are visiting, the volume of their requests, and behavioral details like page paths accessed and response codes received.
For sites using Cloudflare’s Account Abuse Protection, these analytics extend to mapping agents to specific users, enabling fraud teams to detect anomalies or suspicious activity per account. This visibility aids in making informed decisions about how to treat personal agent traffic.
Complementing the analytics, Cloudflare expanded its access policy controls (formerly AI Bot policies) to include granular settings for supported personal agents. Site owners can now choose to allow agents fully, block them entirely, or restrict them only on specific pages like those with ads. Policies can be refined per agent type, enabling tailored management aligned with business needs.
Who Should Care?
- Website owners and administrators who see automated traffic that could come from personal AI agents.
- Security and fraud prevention teams aiming to understand and mitigate risks associated with agent-driven requests.
- Businesses leveraging AI personal agents to improve customer interactions or automate tasks without sacrificing fraud monitoring or user experience.
What Should Developers and Site Owners Do Next?
To leverage the new features and secure their websites effectively, developers and site owners should:
- Review the new Personal Assistants analytics within Cloudflare’s Security Analytics to identify agent traffic patterns and volume on their sites.
- Assess how personal agents are accessing key areas such as login, product pages, and checkout processes.
- Use the updated AI Crawler and Agent access policies to configure site-specific rules — allowing, blocking, or limiting agents based on business objectives (e.g., allow agents on informational pages but restrict where ads are shown).
- For those using Account Abuse Protection, monitor agent-user mappings to detect suspicious activities and apply targeted mitigations without disrupting legitimate users relying on personal agents.
- Stay informed about future developments from Cloudflare concerning user context preservation through agents to maintain secure and user-friendly experiences.
Practical Checklist
- Access Cloudflare Security Analytics and navigate to the Bot Analysis section to enable the Personal Assistants category view.
- Review the newly added Personal Assistants widget to identify the types and volumes of agents visiting.
- Check Account Abuse Protection integration to view agent-user associations if applicable.
- Adjust AI Crawler and Agent access policies via Security Settings to customize agent permissions on your site.
- Monitor the impact of these policies on site traffic, user experience, and potential fraud cases.
Editorial Checks
Further confirmation is needed on specific agent types supported and the exact granularity of user-agent mapping functionality. Details about rollout scope, limitations, and integration with other Cloudflare features were not fully specified. Also, operational guidance for non-Cloudflare users or those without Account Abuse Protection remains unclear.
