Analyzing Legitimate and Malicious Behavior in the Agentic Internet

In the Agentic Internet, it is difficult to simply categorize bots and humans as good or evil. While automated traffic contributes to web navigation and functionality, humans can also commit fraud, and hybrid traffic where a session switches from human to AI agent has emerged.

Accordingly, site operators must analyze behavior rather than visitor identity. They need to assess whether requests or actions pose a risk of being malicious, and how trustworthy a visitor is based on sustained activity. For this, continuous behavioral analysis is required beyond static point-in-time checks.

Cloudflare's Web Integrity & Trust team is building strategies to identify and analyze legitimate and malicious behavior in the areas of bot detection and fraud prevention. The goal is to provide site operators with tools and foundational elements to apply trust-based policies, ranging from blocking malicious activity to encouraging safer internet participation.

Cloudflare views risk and trust not as a single opposing scale, but as independent and complementary values. Risk is the likelihood that a specific request or action is harmful and can be temporary, whereas trust accumulates over time based on reputation.

The article also covers agent traffic analysis results following the launch of Precursor, simulations evaluating user cursor movements as human or bot, and upcoming feature updates.