HYPE OR FACT? · CHECKED 4 NOVEMBER 2026
Can Cloudflare sites now see and control personal AI agents one by one?
OUR VERDICT
FactOur original verdict: “Yes. Cloudflare's blog, changelog and docs all describe the launch as live. Security Analytics adds a "Personal Assistants" traffic category and a per-agent widget, and the renamed "AI Crawler and Agent access policies" setting lets you allow or block each supported agent, or block it only on pages with ads. It only covers agents Cloudflare can recognise. Per-user agent views need Account Abuse Protection, which is still in early access. We haven't tested it hands-on.”
THE CLAIM
“Cloudflare says it is launching "new analytics to help you understand how personal agents access your site on behalf of humans" plus "more granular access policies".”
What’s actually true
- Security Analytics now has a 'Personal Assistants' category in its Bot Analysis chart, next to Verified Bot, Likely Human, Likely Automated and Automated (Cloudflare blog, 4 Nov 2026).
- A new Personal Assistants widget in Top statistics shows each agent's request count. Filtering on one agent shows the paths it hits, the status codes it gets and its networks.
- The 'Configure AI bot policies' setting is renamed 'AI Crawler and Agent access policies' (Security > Settings). Each supported personal agent can be set to Allow, Block, or Block on pages with ads. They inherit the overall Agents policy by default.
- Cloudflare recommends Allow for personal agents. New domains default to Allow for Search, Agents and Training.
- Seeing which user an agent acts for, and blocking one account's agent with a WAF rule, needs Account Abuse Protection, which is in early access.
- Limits: this covers the 'top' or 'supported' agents in Cloudflare's verified bot directory, and the launch posts don't list them. Agents that pass as normal browsers may not be labelled. robots.txt rules remain voluntary, as the docs themselves note.
Sources
Cost
Part of the Cloudflare dashboard. The launch posts don't spell out plan limits, and Account Abuse Protection is early access.
USE IT IF
Site owners on Cloudflare (shops, publishers, SaaS) who want to know whether AI agents are buying, reading or failing on their pages.
SKIP IT IF
Sites not on Cloudflare, or anyone hoping this catches every agent; it only names the ones Cloudflare recognises.
How we knowChecked on 4 November 2026. Verdicts: Fact = the claim holds up; Partly fact = real, but with caveats or overstated parts; Hype = the headline claim isn't supported. Products change quickly, so check the maker's site before you buy. Our methods & sources ↗