The AI agent was supposed to use the web for you. Instead, it may force you to audition for the role of human every time you visit it.
That is the real story behind Cloudflare Precursor, a new bot-detection system that watches behavior across an entire browsing session. It tracks signals such as pointer movement, typing rhythm, focus changes, and page visibility. Not what you type, Cloudflare says, but how you type it. Not one CAPTCHA at the door, but a continuous judgment while you are inside.
The security case is real. Modern bots run JavaScript, operate full browsers, create accounts, stuff credentials, scrape content, abuse checkout flows, and increasingly act on behalf of users. A single checkbox is no longer much of a bouncer.
But Precursor marks a deeper shift. As machines learn to behave like people, infrastructure providers will define “human” more aggressively. Humanity is becoming a score.
The CAPTCHA has escaped the box
Cloudflare describes Precursor as a privacy-minded way to reduce friction. Its script is injected into participating sites at the edge, gathers session-level behavioral signals, and feeds them into a bot score. Customers can observe sessions in the background or challenge visitors whose behavior does not look sufficiently human.
That may be less annoying than identifying six motorcycles before breakfast. It is also a much larger claim on the user.
A CAPTCHA asks for a performance at a specific moment. Precursor evaluates the whole visit. The distinction matters because behavior is messy, revealing, and unevenly distributed. A person using only a keyboard does not move like a person using a mouse. A screen-reader user does not navigate like a sighted user. Tremor, injury, age, unfamiliar hardware, remote desktops, privacy tools, and obscure browsers can all produce the sort of oddness that anomaly detection tends to notice first and understand later.
Cloudflare says signals are aggregated, not tied to identities or persistent profiles, and not exposed to customer dashboards. Good. That narrows the privacy risk. It does not answer the product question: what happens when a legitimate person receives a bad score?
The Hacker News reaction captured the tension unusually well. Defenders pointed to credential stuffing, fake accounts, payment fraud, scalping, and industrial-scale scraping. Skeptics asked about blind users, unusual pointing devices, false positives, appeals, and the uncomfortable fact that Cloudflare sells both agentic infrastructure and the gates agents must pass.
Both sides are right. That is what makes this consequential.
The web is splitting into declared machines and suspected humans
Cloudflare is not simply trying to ban automation. It is building ways to distinguish search crawlers, training crawlers, and agents acting in real time. As The Next Web reported, the company is also pushing declared identities and policies for which bots may enter, what they may use, and whether they should pay.
That points toward a two-lane web.
In one lane, approved machines identify themselves, negotiate access, and perhaps arrive with commercial relationships. In the other, everyone else is evaluated by behavior. The trusted bot gets a credential. The untrusted human gets a probability.
This is the non-obvious cost of agent adoption. The agent does not merely add automated traffic. It changes the burden of proof for everybody. Once invisible automation becomes common, ordinary interaction becomes suspicious by default. A fast user may look scripted. A careful user may look synthetic. A disabled user may look anomalous. The web starts demanding not just that you are human, but that you perform humanity in a statistically familiar way.
There is a familiar economic shape here. AI companies automate the browsing. Site owners absorb the abuse and infrastructure cost. Security vendors sell the sorting layer. Humans supply the behavioral telemetry needed to keep the machine traffic under control.
Very efficient. Just not necessarily for the humans.
Watch the appeal path, not the detection demo
Precursor may work well. Continuous signals probably do raise the cost of cheap automation, and fewer CAPTCHA interruptions would be a genuine improvement. The interesting test is not whether Cloudflare can spot a bot drawing suspiciously straight mouse paths in a launch video.
Watch the error budget.
Does Cloudflare publish false-positive rates across browsers, countries, assistive technologies, and input methods? Can site operators see why a session was challenged without receiving sensitive behavioral data? Can users recover when they are misclassified? Are accessibility failures treated as product defects or shrugged off as customer configuration? Does “privacy by design” remain meaningful as the signal set expands?
Most importantly, watch whether the web develops a clean identity layer for user-authorized agents. Blocking every undeclared machine while continuously profiling every human is an arms-race solution. A better end state would let legitimate agents declare who they represent, what they intend to do, and which permissions they carry—while giving sites a clear right to refuse.
Until then, the agentic web will produce a strange inversion. Software will receive identities, contracts, and access policies. People will receive scores.
The machines are learning to look human.
The danger is that the web responds by making humans look normal.