The age of agents: cryptographically recognizing agent traffic
Aug 28, 2025Jin-Hee Lee
Summary
Introduces 'signed agents' as a new classification for AI agents directed by end-users, distinct from company-directed bots. This classification leverages Web Bot Auth for cryptographic verification of HTTP requests, allowing for more granular security controls and improved visibility. The Cloudflare bots and agents directory has been updated to include signed agents, and a submission form is available in the dashboard. Enterprise customers will soon be able to configure security rules based on this new classification. Partners like ChatGPT agent, Goose, Browserbase, and Anchor Browser are the first to be classified as signed agents.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack