Cloudflare Adds Analytics and Access Policies for Personal AI Agents Visiting Your Website

On 4 November 2026 Cloudflare announced new visibility and controls for personal AI agents, the assistants that browse the web on behalf of a person. Until now many of these agents blended in with ordinary traffic. Cloudflare's new tools are aimed at separating them out.

In Security Analytics, the Bot Analysis chart has a new Personal Assistants category. A new widget in the top statistics lists which agents are visiting and how many requests each makes. Filtering by one agent updates the other widgets with that agent's paths, status codes and networks.

The access controls are the more consequential change. The existing Agents policy now covers supported personal agents, and the setting is renamed "AI Crawler and Agent access policies". For each supported agent, a site owner can choose Allow, Block on pages with ads, or Block. The Search and Training policies are unchanged.

New zones are now asked whether the site earns money from advertising, and the recommended policies change to match. The "block on pages with ads" option is the interesting one, because it recognises that an agent reading an article without showing the ads is a different thing from one booking a table.

Cloudflare also announced Account Abuse Protection in early access. It can show which user an agent represents, how many accounts use personal agents, and whether a login or sign-up came from one. Fraud teams can act on a single account with a WAF rule rather than blocking the agent for everyone.

The post does not list which personal agents are supported, and only Account Abuse Protection is explicitly labelled early access, so availability of the rest is worth checking in your own dashboard. Cloudflare says it is working on privacy-aware ways to carry user context through agents, with no timeline given.

For the sites we build, the takeaway is that agent traffic is becoming something to plan for, like search engines and mobile were. A brochure site probably wants to be readable by agents. A booking or shop site may want different rules for browsing and for transactions. It is worth deciding that on purpose.