AI agents can compare products, read reviews and complete tasks without sending a person to the websites they use. Cloudflare’s November 5 position paper argues that this creates a new cost and accountability problem for site owners: the business may serve the agent, absorb the risk and still lose the visit, ad impression or sale. For marketers, the implication is not to block every bot. It is to decide which automated activity creates value, what it costs, and what conditions should govern access.

AI agents can consume value without creating a visit

Cloudflare’s paper, “Agents aren’t humans (but they kinda are),” lists 14 challenges that arise when a remotely hosted agent sits between a person and a website. The company’s central claim is blunt: “In nearly every challenge above, the Site bears the primary cost.” An agent can extract an article, product specifications or reviews and relay them to a user elsewhere, leaving the original site with the infrastructure expense but no human session or advertising opportunity. That is a business-model problem, not merely a traffic-reporting anomaly.

Cloudflare CEO Matthew Prince offered a concrete example on the company’s earnings call: an agent might inspect 1,000 restaurant menus for someone who ultimately chooses one restaurant, leaving the other 999 businesses with the cost of serving a request and no customer. The Register’s report presents this as Prince’s illustration, not a measured estimate of losses across the web. Cloudflare’s paper likewise does not quantify lost ad revenue, support costs or disputed purchases.

The exposure goes beyond publisher revenue

For marketing teams, the same intermediary problem can affect lead generation, ecommerce and customer experience. Agents may repeatedly query inventory or support endpoints, consume free trials, trigger duplicate orders or arrive at checkout without the identity and device signals a fraud system expects. Analytics can also mistake a machine request for audience engagement, while a legitimate agent-assisted purchase may be hard to connect to the person who authorized it.

Cloudflare’s proposed response is to preserve the relationship and security responsibilities between a user and a site even when an agent is involved. It calls for clearer agent identity, reputation and accountability, and announced the Trusted Agent Delegation coalition to develop the discussion with the ecosystem and standards bodies. These are emerging approaches, not a settled industry standard. Cloudflare is also a vendor with products in bot management and agent monetization; PPC Land notes that the paper supplies no site-level impact data and that Cloudflare’s diagnosis aligns with its product line.

Set access rules around page economics

A blanket “allow” or “block” policy is unlikely to fit every business. A product comparison page, an ad-supported article, a logged-in customer portal and a payment flow have different economics and risks. Start by mapping those page types, then classify agent activity by purpose and business outcome, not just by the user-agent string.

  • Measure costs and outcomes. Track agent request volume, repeated calls to expensive endpoints, error rates, infrastructure load and any attributable leads or completed sales. Treat mentions and machine requests as diagnostics, not proof of audience or revenue.
  • Protect sensitive workflows. Review login, account recovery, checkout, booking and free-trial paths for identity, consent, fraud and rate-limit gaps. A task-completing agent may be useful, but it should not automatically inherit a human’s permissions.
  • Make page-level decisions. Allow useful discovery or shopping activity where it can produce qualified demand; restrict or rate-limit activity that drains resources or republishes monetized content without a return. Preserve a path for trusted, disclosed agents rather than treating all automation as hostile.
  • Test before monetizing access. Compare the cost of serving agent traffic with measurable downstream value before adopting a pay-per-use model. Verify who is paying, what counts as usage, how attribution works and whether the policy affects human visitors.

Build a measured policy, not a bot panic

Cloudflare says its customers can already view personal-assistant traffic and set agent access policies, including blocking agents only on pages with ads; it describes Account Abuse Protection as early access in the same position paper. Those are vendor-specific controls, and availability or fit will depend on a site’s stack. The broader lesson is portable: create an inventory of high-value pages, establish a baseline for automated requests, and review access rules against both cost and conversion data. Revisit the policy as agent identity and payment standards mature rather than assuming today’s analytics or robots.txt alone settles the issue.

Real Internet Sales helps businesses turn emerging AI and search changes into practical digital marketing decisions. Call 803-708-5514 or visit realinternetsales.com to discuss how to protect your site’s value while preparing for AI-driven discovery.