Cloudflare’s cure for bots is watching everyone, all the time

The new bot detector Cloudflare switched on this week doesn’t ask you to click on motorcycles. It doesn’t ask you anything. Precursor, announced July 13, is a small piece of JavaScript that Cloudflare injects into the pages it serves, and for as long as you stay on a site it watches, per the company’s press release: how your mouse moves, how you scroll, the cadence of your typing, whether your clipboard fires, whether the tab is even visible. A site owner enables it with a single toggle in the dashboard, no code changes. There is no checkpoint to pass, because the whole visit is the checkpoint.

Dane Knecht, Cloudflare’s CTO, framed it as a door problem.

“Traditional security checks look at a single moment in time, but modern bots have gotten smart enough to fake their way through the front door. Instead of just checking an ID at the gate, we are looking at behavior over the entire visit.”

The problem is real. Cloudflare puts automated traffic at roughly 57% of all web requests, and the modern bot runs a full browser. It executes JavaScript and clears the puzzles designed to stop its ancestors. Faking one click is trivial. Faking twelve minutes of plausible human fidgeting is, in the press release’s words, “a massive engineering hurdle.”

How the checkpoint dissolved

In 2021, Cloudflare calculated that humanity wastes about 500 years per day solving CAPTCHAs and declared it “time to end this madness.” In 2022 it shipped Turnstile, a free, “privacy-preserving” replacement that verified visitors with invisible browser probes instead of fire-hydrant grids. Each generation of this technology has made the same trade: less friction for the user, more observation of the user. The CAPTCHA was insulting, but it was honest. You knew you were being tested, and when you passed, the test ended.

Turnstile moved the inspection into the browser’s internals. Precursor moves it into your hands, and it doesn’t end: Cloudflare’s own documentation says the injected script “continuously collects signals and performs verification” for the life of the session.

The engineering is genuinely clever. Tech Monitor reports that the script buffers behavioral data locally and ships it periodically to Cloudflare’s edge, where it feeds a running bot score; SiliconANGLE notes that reloading the page doesn’t reset it. The system checks congruence, not just presence: is the typing landing in a focused text field, is the pointer moving while the page is actually visible. A bot that scripts perfect keystrokes into a hidden tab betrays itself. The dashboard offers two modes, “Minimize Friction” and “Maximize Security.” There is no third mode.

What Cloudflare says it keeps

The privacy case in the launch materials runs about a paragraph. Keyboard activity is logged “exclusively as timing rhythm and cadence,” never actual keystrokes, and the signals are aggregated rather than tied to identities or persistent profiles. Take that seriously: if the data really is ephemeral timing math, Precursor is closer to a smoke detector than a camera, and the scariest version of this story isn’t the true one.

But the load-bearing details are unpublished. The docs page states no retention period. It doesn’t say whether behavioral models are trained across customers’ sites or scoped to each zone. And the signals demonstrably don’t stay put: the launch changelog says Precursor updates bot scores “with session context,” which means your scroll rhythm flows into the scoring layer that Cloudflare’s security rules and its whole Bot Management product act on. A published retention window and an explicit per-zone scope would defang most of the surveillance critique. Cloudflare has offered neither, so “trust us, it’s just rhythm” is doing all the work.

And rhythm is not neutral. Within hours of launch, Slashdot commenters were asking what a “human” cadence means for someone using a screen reader, or a joystick or eye-tracking software that moves the pointer in machine-straight lines; one warned the system “seems calculated to discriminate against handicapped folks that need mechanized assistance.” That question is ours too. The old regime gave you a puzzle you could fail and retry. The new one gives you a score you never see and can’t appeal.

The tollbooth needed an enforcer

Precursor makes more sense once you notice what Cloudflare spent the last year building around it. On July 1, 2025, the company launched pay-per-crawl, which lets sites answer an AI crawler with an HTTP 402 Payment Required and a price, with Cloudflare as merchant of record. This July 1 brought the second annual “Content Independence Day”: a taxonomy splitting crawlers into search, agent, and training categories, plus a default that will block training and agent bots on new domains’ ad-supported pages starting September 15.

None of that works if an agent can dress as a person. You cannot charge what you cannot catch. The Precursor announcement’s actual title says the quiet part: “detecting agentic behavior with continuous client-side signals.” The target isn’t the scraper of 2019. It’s the agent pretending to be you.

Both sides of the wall

Meanwhile, in Cloudflare’s other product line. In April the company announced an expanded “Agent Cloud”: Dynamic Workers for running AI-generated code, persistent Sandboxes, a framework for long-running agent tasks. “We are entering a world where agents are the ones writing and executing code,” CEO Matthew Prince said in that release. Cloudflare publishes an Agents SDK and pitches itself as the best platform for building them. And since August 2025 it has run a signed agents program: agents from ChatGPT, Block’s Goose, Browserbase, and Anchor Browser carry Web Bot Auth cryptographic signatures and get waved through the same walls Precursor patrols.

Tally the positions. Cloudflare sells the compute that runs agents, issues the credentials that admit registered ones, operates the tollbooth that charges crawlers, and now deploys the sensor net that catches everyone else. Each layer makes the others more valuable. If you build agents, the rational move is to register with Cloudflare; if you publish, the rational move is the toggle. Either way, the definition of legitimate traffic ends up living in one company’s dashboard.

Our read: Precursor is less a security feature than a claim on that definition. That isn’t an accusation of bad faith. Somebody was going to end up adjudicating what counts as human on the web, and Cloudflare has the vantage point and, evidently, the appetite. But a private company standing on both sides of a wall it built, collecting rent at the gate and selling ladders around the back, deserves harder questions than the launch coverage has asked so far.

Knecht, in the launch materials, described what came before: “Cloudflare already protects users billions of times a day at critical moments like login and checkout, but until now, the space between those moments was a black box.”

The space between those moments is you, reading this, letting the cursor wander while you think. As of Monday, it’s lit.