Cloudflare just got much better at spotting AI agents — right before it starts blocking them by default

What Cloudflare announced

The primary source is Cloudflare's own engineering post, “Introducing Precursor”, published July 13, 2026. Precursor injects JavaScript that collects behavioral signals continuously while a visitor uses the page, and looks for contradictions across the session rather than asking for one challenge and moving on. The signals Cloudflare lists are pointer movement, keyboard event timing (explicitly not which keys are pressed), focus changes, page visibility, and the correlation between them — for example, pointer activity recorded while the tab was hidden.

The reason for the change is stated plainly in the post: “Modern automation is increasingly capable of appearing legitimate in short bursts. Bots can execute JavaScript, use real browser environments, and pass individual CAPTCHAs without raising suspicion.” In other words, a browser-driving AI agent looks exactly like a person for the length of one request. Cloudflare's answer is to stop looking at requests and start looking at sessions. Precursor is free during beta and generally available later in 2026. For scale, Cloudflare says it analyzes over a trillion requests a day and sits in front of more than 20% of the web — so its defaults are not one vendor's opinion, they are a large share of the internet's behavior.

The date that actually matters: September 15

Detection is only half the story. In “Your site, your rules: new AI traffic options for all customers” (July 1, 2026), Cloudflare split AI traffic into three categories that site owners can allow or block separately:

• Search — “any behavior that collects or indexes your content, so it can answer questions about it later.” This is the crawler that makes you findable in an AI answer.
• Agent — “automated behavior that is acting, usually in real time, on a person's behalf, to get something done right now.” This is ChatGPT fetching your page because a customer just asked about you, or Gemini/Claude driving a browser through your booking flow.
• Training — “a crawler taking your content to train or fine-tune a model.”

And the change with a date on it: on September 15, 2026, for all new domains onboarding to Cloudflare, Training and Agent are blocked by default on pages that display ads, while Search remains allowed by default. Existing customers keep their current settings. Read that boundary carefully — Search stays open, so the crawler that indexes you for answers is fine. It is Agent that gets shut off: the fetch that happens the moment a real human is waiting for an answer about your business.

What this means if you run AI visibility for clients

• Bot policy is now part of an AI-visibility audit, and almost nobody audits it. A client can have perfect schema, clean HTML, and a page that ranks — and still be unreachable to the agent that a buyer sent. If the site is new to Cloudflare after September 15 and monetizes with ads, that is the default state, chosen by nobody. Check the client's Cloudflare bot settings and their `robots.txt` before you write another word of content for them.
• “Block the AI bots” is no longer one decision. For a publisher, blocking Training and keeping Search is coherent. For a dentist, a law firm, or an e-commerce brand, blocking Agent means turning away the highest-intent visit on the internet — a machine sent by a customer who is trying to buy something right now. The three-way split exists precisely because those calls are different; a blanket block gets it wrong for most businesses.
• You cannot see this failure in analytics. A blocked agent fetch does not appear in Google Analytics as a lost customer; it appears as nothing at all. It looks identical to “the model never recommended us.” The only way to separate the two is to ask the engines directly and see whether your client is named — and then check whether the engine could actually reach the page it would have cited.

The takeaway

Cloudflare is making agentic traffic much easier to identify at exactly the moment it starts blocking it by default. That combination turns an infrastructure toggle into a revenue setting. This is also the second story in a week pointing the same direction: OpenAI is folding its browsing agent into ChatGPT itself, which means more agent traffic, not less, arriving at pages that may be configured to refuse it.

Start with the measurement, because it is the half you cannot guess: a free 60-second check samples ChatGPT and Perplexity (the $79 audit adds Gemini and Claude, 25 questions sampled three times each) and reports how often each one actually names a business. If you do this work for clients, the agency 5-pack runs the same audit across five of them, white-labeled — a defensible “here is where each of your clients stands” before the September 15 defaults quietly change the answer.