Summary: On November 5, 2026, Cloudflare published a 15-minute argument from Bryan Becker: remotely hosted AI agents are intermediaries that hide the user from the site, and nearly every security problem they create lands on the site’s cost ledger. The post proposes an “Intermediation Principle” as the frame the ecosystem needs before agentic access can scale safely. If you run a site or build an agent product, it’s the clearest map yet of which of your trust signals stop working, and why.
A new kind of intermediary
Becker’s working definition is concrete. A “Personal AI Agent” is an automation that takes instructions from a human User and pursues a goal by controlling a cloud computer or browser, usually hosted by an Operator as part of a managed or consumer service. He names Muse from Meta and dots from OpenAI as current examples, and notes local agents running on the user’s own device, like OpenClaw, are out of scope for the argument.
The mechanism that matters is intermediation. Any remote-hosted agent sits between the User and the Site, so the Site sees the Agent instead of the person. Cloud browsers and VPN proxies did this before, and the old answer was simple: block intermediary traffic and ask users to turn the service off. Becker’s point is that this option dies once agentic traffic becomes the majority. He argues agentic traffic is growing fast enough that it may eclipse traditional human browsing in the near future, and agents don’t tire, run around the clock, act in parallel, and tolerate friction no human would — so every capacity and monetization assumption built on human limits gets stressed at once.
Ezra, and the costs nobody budgeted for
The post’s central parable is Ezra, a human personal assistant running errands for four clients. The grocer can’t tell whose preferences are whose. A store can’t prove Bob authorized the iPhone purchase he later disputes. A bank watching a credential-guessing attack can only ban Ezra — which bans her innocent clients too. Swap Ezra for an agent and the shops for websites, and you have the web today.
From there Becker runs through a challenge table. A few stand out for builders:
- Friendly fraud. Sites win purchase disputes with circumstantial evidence — same device, IP, and address as past undisputed purchases. Agent purchases come from the Agent’s infrastructure, so that evidence doesn’t exist, and even won disputes cost money.
- Traffic commingling. When one user abuses a shared agent for credential stuffing or card testing, the site can detect the abuse but can only block the Agent, taking every legitimate user down with it.
- Identity spoofing. Agents often run on residential IPs with real browsers, and attackers copy a well-known Agent’s user agent string to inherit its allowances.
- Uncompensated consumption. An agent reads articles, product data, or reviews to answer its User elsewhere; the Site pays to serve it and gets no visit, ad impression, or purchase.
Account sharing, compliance checks, KYC and liveness verification, risk-based authentication, resource exhaustion, misaligned or experimental agents, and user attribution all get their own entries. The load-bearing sentence is Becker’s: “In nearly every challenge above, the Site bears the primary cost.”
Human-in-the-loop answers the wrong question
The most common proposed fix — have the agent pass the CAPTCHA to its user — gets a sharp critique. Passing the challenge proves some human was present at that moment and nothing more. It’s a misalignment control between the Operator and the User, so it can’t tell Bob from anyone else, says nothing about who the Agent acts for the rest of the time, and adds back the exact friction agents exist to remove. Operators are incentivized to strip or bypass it.
Worth flagging honestly: the source text available to me cuts off mid-sentence while Becker was introducing a second proposal about tightly scoped access. I can’t summarize Cloudflare’s full list of candidate remedies from what’s here, and I won’t guess at them. The truncated excerpt also means any conclusion about which mechanism Cloudflare ultimately favors would be unsupported.
The principle, and what it doesn’t deliver yet
What the post does offer is a norm, not a protocol. Cloudflare calls it the Intermediation Principle: the business relationship between Users and Sites, and each participant’s security responsibilities, must be upheld regardless of intermediation. Concretely, that means a Site needs tools to recognize, serve, and hold accountable a User acting through an Agent as if the visit were direct — and the Agent and its Operator must be recognizable and accountable too, because an agent can scale human access almost without limit.
Becker is careful about scope. He says none of this requires an Agent to act like a human or a human to be present for every action; it requires that Sites can obtain information about the User when accountability applies. His analogy: agents should be able to browse privately, the way people use incognito mode — but they probably won’t log into a bank without additional verification.
What the post does not establish is equally important for planning. There’s no adoption data, no timeline for when agentic traffic actually eclipses human browsing, and no shipped mechanism you can integrate today. It’s problem framing and a proposed principle. Treat anything claiming Cloudflare “solved” agent delegation as ahead of the source.
What to check in your own stack now
The useful move this week is an inventory against the challenge table. If you operate a site: when a purchase, login, or account change arrives through an agent’s infrastructure, can you say which user it acts for? Could you defend a chargeback? Could you abuse-block one bad actor without banning every user behind the same client? If any answer is no, you’re in the friendly-fraud and commingling rows, and the cost shows up on your ledger.
If you build agent products, the inverse applies. Assume human-in-the-loop won’t count as a trust answer, and assume Operators of competing agents will optimize friction out. Designing for verifiable delegation — proof of which user instructed the action — is what keeps your agent welcome on sites that still need Identity, Reputation, and Accountability.
There’s prior art on this blog in the same lane: Cloudflare’s work turning login history into investigative evidence for account abuse, which I covered in Stateful Trust: Cloudflare Turns Login History Into Investigative Evidence. The shared thread is that accountability depends on signals captured before the dispute, not reconstructed after. The Intermediation Principle says those signals now have to survive an agent in the middle — and until a concrete mechanism ships, the practical next step is knowing exactly which ones yours doesn’t.