Loading story…
Cloudflare said it is working with Google Chrome, Microsoft Edge, and Mozilla Firefox on Private Access Control Tokens (PACTs), a proposed web standard designed to help sites distinguish legitimate users and authorized automated agents from abusive traffic. Under the model, a site or service with strong confidence in a user or agent could issue an anonymous token that another site can accept as proof of legitimacy, with the stated goal of reducing dependence on CAPTCHAs, cookies, and other high-friction anti-bot checks while preserving privacy.
The companies are positioning PACTs as a way to prepare the web for rising volumes of AI-driven traffic without forcing more invasive identity verification, and as an interoperability effort for the open web. However, the proposal remains under development, and open questions remain around how "strong knowledge of personhood" would be established, whether the system could become a gatekeeping mechanism for access, and how much it would actually mitigate broader tracking techniques such as browser fingerprinting.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
Cloudflare announced a collaboration with Mozilla, Google, and Microsoft to develop Private Access Control Tokens (PACT), a proposed privacy-focused standard for distinguishing legitimate human or authorized-agent traffic from abusive requests. The initiative is intended to reduce reliance on CAPTCHAs, cookies, and other friction-heavy anti-bot checks while preserving user privacy.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
8 references tracked. Mallory keeps watching after this page renders.
zdnet.fr
Open sourceblog.mozilla.org
Open sourceghacks.net
Open sourcecloudflare.net
Open sourcetheregister.com
Open sourcetheregister.com
Open sourcegithub.com
Open sourcesdxcentral.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cloudflare has introduced **Precursor**, a client-side bot-detection system that identifies automated and agentic traffic by continuously analyzing behavior across an entire browsing session instead of relying on one-time challenges such as CAPTCHAs. Running in the browser through Cloudflare’s edge network, the system evaluates signals including mouse movement, scrolling patterns, typing cadence, clipboard use, page dwell time, and the consistency between pointer movement and page rendering to maintain an evolving bot-probability score. Cloudflare said Precursor preserves behavioral history across page reloads and can be enabled with one click without application code changes because the company automatically injects a lightweight script. The company also said the system does not capture the actual content users type, using aggregated timing and rhythm data instead, and positioned the launch as a response to increasingly sophisticated automated traffic that it estimates now represents about **57% of all web requests**.
Jul 21, 2026
Cloudflare has launched a developer preview that lets websites expose **WebMCP** interfaces through a single dashboard setting, extending Google Chrome’s emerging proposal for structured AI-agent access to web features. WebMCP is designed to let browser-based agents discover and invoke site-defined tools with **JSON Schema** inputs and outputs and shared page state, avoiding brittle HTML scraping and simulated clicks. Google has been testing the proposed standard in a Chrome origin trial beginning with Chrome 149, while Cloudflare said its preview currently works in Chrome 145 and later. Cloudflare’s implementation injects a `bridge.js` module into pages it serves, where tools can be registered statically or discovered dynamically and execution is proxied back to the site on the same origin. The preview includes two initial tool packs: **Content Credentials** for reading `C2PA` image provenance metadata and a **Site MCP Server** pack that exposes a site’s existing MCP server tools to in-browser agents. The rollout comes with security constraints already outlined in Chrome’s proposal, including requirements for origin-isolated documents, a `tools` Permissions Policy, and `allow="tools"` for cross-origin iframe use, while both the standard and Cloudflare’s implementation remain subject to change.
Aug 11, 2026
Cloudflare has introduced **Kitesurf**, an experimental lightweight browser engine built for automated workflows and AI agents, designed to run browser components inside isolated **WebAssembly** and **Rust** environments on **Cloudflare Workers**. The platform supports the **Chrome DevTools Protocol** and is aimed at tasks such as page rendering, screenshot capture, and HTML extraction while using fewer resources than a full **Chromium** deployment. Kitesurf draws on components from the Rust-based **Blitz** rendering engine and Firefox’s **Stylo** CSS parser, but Cloudflare says it is not yet a full replacement for Chromium. Current limitations include missing support for video, **WebGL**, realistic **TLS**-based bot challenges, and long-lived authenticated sessions. The announcement has also prompted discussion about Cloudflare’s position as both a provider of browser automation tooling and a vendor of anti-bot and cybersecurity services, while the company has said it plans to open source the project in the future.
Aug 22, 2026