Cloudflare adds a Personal Assistants bot category and per-account agent views
Serguey Asael Shinder2 min readCloudflare on 4 November launched analytics and access controls aimed at personal agents, the AI assistants that turn a person's instructions into requests on websites. The company's argument is that comparing products, reading support articles or completing a purchase on someone's behalf all look like automated traffic to a site owner, and that blocking agents outright can mean blocking customers.
In Security Analytics, the Bot Analysis chart now shows Personal Assistants as its own category, next to Verified Bot, Likely Human, Likely Automated and Automated. A new Personal Assistants widget in Top statistics lists which agents visit a site and how many requests each sends; filtering on one agent updates the other widgets to show only its paths, status codes and source networks. Cloudflare says this lets an owner see whether an agent is logging in, reading product pages, reaching checkout or failing on pages it cannot use.
For sites using Account Abuse Protection, which is in early access, the view goes down to the user. A population overview shows which agents are active across accounts and how many accounts use them, every login and sign-up event records whether an agent made it and which one, and each account page lists the agents acting for that account. Cloudflare's example is a fraud analyst telling apart an agent a customer has used for weeks from one that appeared today; if an attacker is using an agent, the account can be mitigated with a WAF rule on its hashed user ID without blocking the agent for everyone else.
The release also adds more granular access policies, so the decisions made from these views can be enforced per agent.
What it means
The unit of trust is moving from the client to the pairing of an agent and an account. A rule that blocks an agent everywhere is now the blunt option, not the only one.