Cloudflare Introduces Precursor to Detect Agentic Behavior Across Full Sessions

Cool product launch, though it feels a little weird to me that Cloudflare sells agentic products alongside this new service that seems designed to block agentic usage of the web?

I expect there's much more going on than just mouse path detection but I can imagine that this is already tricky for touchscreens and for people using non-traditional mouse inputs (the thinkpad nub comes to mind - but it would also be bad optics to accidentally block people using accessibility mouse tools as bot users, though then this becomes a loophole for agentic browsing!)

In general though I think this is almost definitely a good thing to reduce agentic bot abuse & spam.

I implemented all of this in hCaptcha 6 years ago, not just to distinguish bot from human but also to recognize the keyboard/mouse behavior of the same person signing up for many accounts or testing multiple credit cards. This kind of abuse detection was a part of Cloudflare when they switched to hCaptcha in 2020 and I had thought they already implemented all this themselves four years ago when they transitioned away from hCaptcha in 2022.

control+F accessibility no results

Yeah so this mouse movement astrology is going to completely lock non-sighted/keyboard only users out of large swaths of the Internet isn't it.

This (agent detection) is now a kind of emerging space. Obviously it'll get much more important, too.

Other products in the space:

- Foil (https://usefoil.com/), I'm biased, a friend is building this

- Kasada https://www.kasada.io/

- DataDome (https://datadome.co/)

- Castle (https://castle.io/)

- Fingerprint (https://fingerprint.com/)

- HUMAN (http://humansecurity.com/)

- Google Cloud Fraud Defense, which is basically the updated reCaptcha (https://cloud.google.com/security/products/fraud-defense?hl=...)

- this, Cloudflare Precursor

It seems like some of the main reasons people care so far are:

- Preventing automated credential stuffing

- Preventing bots from creating a bunch of fake accounts (eg free trial abuse, which can also lead to high twilio SMS bills!)

- Reducing payment fraud

- Blocking LLM scraping

- Blocking automated scalpers (!) eg for tickers or sneakers

I'm curious to see which use cases end up dominating as the reason companies care about this. And I'm hopeful that my agents will still have good ways for me to browse and do things on the web on my behalf - eg detect agents and route them to an agent path, rather than blocking them.

(I'm interested in tools for detecting AI agents and seeing how this shifts as bot traffic goes way up.)

What prevents bots/agents from just adding "jitter" to their movements that mimics how humans move their cursor?

I know there are other signals being used but this one in particular seems like it wouldn't be hard to beat with a small amount of sophistication from the bot.

One interesting aspect is of course that the movement from the same user can be different depending on what type of mouse they use. I use a mouse at work on my PC, touchpad on my private laptop, and thinkpad nipple on work laptop. Three different profiles for one user.

Obviously different movements from a AI, but if we come to the day where mouse movement fingerprinting becomes another gatekeeper, there could be some interesting outliers.

I can’t wait for cloudflare to sell data on how well my wrist is working to my insurance company. What a wonderful hell we’ve created for ourselves.