Loading story…
Cloudflare has introduced Precursor, a client-side bot-detection system that identifies automated and agentic traffic by continuously analyzing behavior across an entire browsing session instead of relying on one-time challenges such as CAPTCHAs. Running in the browser through Cloudflare’s edge network, the system evaluates signals including mouse movement, scrolling patterns, typing cadence, clipboard use, page dwell time, and the consistency between pointer movement and page rendering to maintain an evolving bot-probability score.
Cloudflare said Precursor preserves behavioral history across page reloads and can be enabled with one click without application code changes because the company automatically injects a lightweight script. The company also said the system does not capture the actual content users type, using aggregated timing and rhythm data instead, and positioned the launch as a response to increasingly sophisticated automated traffic that it estimates now represents about 57% of all web requests.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
Cloudflare introduced Precursor, a client-side system for detecting agentic or automated behavior by continuously analyzing browser-session signals instead of relying on one-time checks like CAPTCHAs. The company said the system can be enabled without application code changes via a lightweight script injected through Cloudflare’s edge network.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cloudflare's 2025 review highlights a dramatic increase in global internet traffic, with a 19% year-over-year surge largely attributed to the proliferation of bots and AI crawlers. These non-human actors, including search crawlers, AI agents, and malicious automation, now account for approximately 30% of all web traffic, placing unprecedented strain on network infrastructure and security defenses. The surge in AI-driven bot activity has led to data request spikes that can rival Distributed Denial of Service (DDoS) attacks, forcing website owners and service providers to adapt rapidly. Cloudflare's CEO described this trend as a fundamental rewiring of the internet, with AI not only driving traffic but also reshaping the threat landscape. Akamai's analysis corroborates these findings, noting that while AI bot traffic is significant, the larger and more persistent threat comes from evasive scrapers, which generate nearly three times more traffic than AI bots. These scrapers adapt quickly to new controls and continue to probe for valuable content, especially when AI bots are blocked. The rapid expansion of AI use, combined with the growing volume of automated traffic, is creating new challenges for security, resilience, and equitable access to online resources. As AI becomes embedded in everyday applications, the need for robust mitigation strategies and infrastructure upgrades becomes critical to maintaining internet stability and security.
Jun 29, 2026
Cloudflare said it is working with **Google Chrome, Microsoft Edge, and Mozilla Firefox** on **Private Access Control Tokens (PACTs)**, a proposed web standard designed to help sites distinguish legitimate users and authorized automated agents from abusive traffic. Under the model, a site or service with strong confidence in a user or agent could issue an anonymous token that another site can accept as proof of legitimacy, with the stated goal of reducing dependence on **CAPTCHAs**, cookies, and other high-friction anti-bot checks while preserving privacy. The companies are positioning PACTs as a way to prepare the web for rising volumes of AI-driven traffic without forcing more invasive identity verification, and as an interoperability effort for the open web. However, the proposal remains under development, and open questions remain around how "strong knowledge of personhood" would be established, whether the system could become a gatekeeping mechanism for access, and how much it would actually mitigate broader tracking techniques such as browser fingerprinting.
Jul 12, 2026
DataDome reported that malicious automated traffic increased **124%** between July 2025 and June 2026, compared with 13.2% growth in human traffic. Analysis spanning more than one trillion requests across over 75,000 customer sites found that bots and AI agents accounted for roughly 26.5% of traffic. Web scraping represented 70.9% of malicious bot activity and rose 185.2%, driven in part by collection of data for AI-model training; scalping, fake-account creation, and DDoS activity also grew. AI-agent and LLM-crawler traffic rose 82.3%, while monthly AI-bot activity against login pages increased more than eightfold during the first half of 2026, increasing exposure to credential testing and account abuse. In testing of 21,491 popular websites, 65.3% failed to detect any of 10 simulated bot types and only 2.4% stopped or challenged all of them; telecommunications organizations performed worst. DataDome advised organizations to distinguish authorized AI assistants from malicious automation through behavioral context rather than relying only on individual-request or browser-side indicators.
Sep 24, 2026