Agents aren’t humans (but they kinda are)
Cloudflare argues AI agents acting on the web disrupt traditional site-user relationships by obscuring identity and accountability, risking fraud and operational costs as agent traffic grows rapidly.
AI agents now perform web tasks for millions, often indistinguishable from human users or appearing as a single visitor handling multiple tasks. This obscures the user behind the agent, making it impossible for sites to verify identity, assess trustworthiness, or hold anyone accountable when issues arise. Sites previously relied on direct user interaction to manage security and fraud, but agents remove that visibility entirely, shifting costs and risks to operators.
Agents are remotely hosted automations controlled by users through operators like Meta’s Muse or OpenAI’s dots, capable of continuous, parallel actions without human limitations. They act as intermediaries between users and sites, a role once filled by proxies or cloud browsers, but their rapid adoption now threatens to surpass human browsing traffic. Sites can no longer block intermediaries outright, forcing a shift in how they recognize, serve, and manage users through these new intermediaries.
The post introduces the Intermediation Principle, arguing that sites must maintain the same business relationship with users whether they interact directly or through agents. Sites need tools to recognize the human user behind an agent, assess their trustworthiness, and hold them accountable, just as they would with direct visitors. Without these mechanisms, sites face unresolved fraud risks, compliance gaps, and operational inefficiencies that threaten their ability to monetize or protect their services.
The challenges are illustrated through the analogy of Ezra, a personal assistant acting for multiple clients, whose presence disrupts the grocer’s ability to track preferences, verify transactions, or ban bad actors without harming innocent clients. On the web, agents create similar disruptions: they obscure user identity, complicate fraud prevention, and strain site resources by bypassing human limits. Sites must adapt to these changes or risk losing control over security, compliance, and revenue.