Cloudflare Precursor scores mouse physics and typing rhythm across entire sessions. Why AI bot detection vs blocking now decides which AI agents reach your site.
Quick answer
Cloudflare's new Precursor system watches mouse physics, typing rhythm, and attention patterns across an entire session to catch automation that single checkpoints miss. It is clever work, and it treats all agentic traffic as one category to catch. Nothing in the launch distinguishes a scalper bot from a shopping agent buying on behalf of a real customer, and false positives are never mentioned. Detection and blocking are separate decisions. Before adopting a catch-and-block posture, measure which AI bots and agents actually reach your site, then set policy per category: serve the crawlers that cite you, welcome the agents that buy from you, block the rest.
On July 13, Cloudflare introduced Precursor, a client-side detection system that watches how every visitor moves, types, hesitates, and scrolls for the entire life of a session, then folds that behavioral record into its bot scores. It reads the wrist-pivot arc in a mouse path. It measures the pause between seeing a button and clicking it, and the tremor a human hand can't suppress. Automation gives itself away with pointer motion that follows "linear interpolations or mathematically ideal Bézier curves," and because the data is session-scoped, a bot can't wipe its record by refreshing the page and starting over.
As engineering, it's impressive. If your site bleeds money to credential stuffing, scalping, or carding, it's good news.
Read the announcement twice, though, and notice what isn't there. It never distinguishes hostile automation from an AI agent doing exactly what a real customer asked it to do. "Automated or agentic traffic" appears as a single category of thing to catch. False positives never come up. Shopping agents, research assistants, and the crawlers that decide whether your brand exists in ChatGPT's answers are absent from the story.
If you run a website in 2026, that omission is the story.
Precursor collects behavioral signals continuously as a visitor interacts with a page: pointer movement, keyboard activity, focus changes, and page visibility. Cloudflare handled the privacy question carefully. Keyboard input is captured "as timing and rhythm, not as the actual keys pressed." The system doesn't read what you type; it profiles how you type it.
The detection logic rests on physics. A human hand pivots at the wrist and produces curved, slightly irregular pointer paths. A human brain needs a beat to process what it sees before clicking. Automation produces none of that noise, and faking noise convincingly, at scale, for a whole session, is genuinely hard.
Three details matter for site owners:
Which automation?
AI traffic stopped being a rounding error a while ago. By Cloudflare's own reporting, automated traffic crossed half of all internet traffic in 2026, and the AI slice of it isn't one thing. Search crawlers like OAI-SearchBot and PerplexityBot decide whether you get cited in AI answers. Live fetchers like ChatGPT-User fire the moment a person pastes your link into a chat. Training crawlers like GPTBot ingest your content for future models. And a fast-growing class of browser-driving agents, from Perplexity's Comet to ChatGPT's agent mode, fills carts and compares prices on behalf of a person holding a credit card.
Behavioral detection lands hardest on that last class. A browsing agent drives a real page. It moves a pointer in clean arcs or not at all, fills forms at machine speed, and never hesitates before a click, because there's no cognition delay to hide. By Precursor's physics test it is precisely a bot. The customer behind it is precisely human.
Play the scenario forward. A shopper tells their assistant to find waterproof trail runners under $150 and buy the best-reviewed pair. The agent visits six retailers. Five load. The sixth, behind aggressive behavioral enforcement, serves a challenge it can't pass. That retailer never sees the lost sale in any report; the order just lands somewhere else. We've written before about how agent traffic fails silently, and behavioral blocking makes the silence deeper: the agent was indistinguishable from an attacker on purpose, so the block looks like a win.
Worth being precise here, because the panic version of this take is wrong. GPTBot, ClaudeBot, and PerplexityBot are HTTP crawlers. They fetch pages without rendering them in a browser. No pointer, no typing rhythm, nothing for a mouse-physics detector to see. Precursor isn't aimed at them.
The posture around it is. Cloudflare already offers one-click AI-crawler blocking, blocks AI crawlers by default on new zones, and on September 15 its new AI bot rules take effect, splitting crawlers into Search, Agent, and Training categories with policy controls for each. Precursor adds another wall segment to the same fortification. The direction of travel is consistent: undeclared automation is presumed hostile until proven otherwise.
That's a reasonable default against fraud. It's an expensive default for visibility. Block the crawler that feeds an answer engine and you don't show up where a growing share of buyers ask their questions, and no error message will ever tell you it happened.
Most coverage treats AI bot detection vs blocking as one motion: find it, stop it. They're two decisions, and collapsing them costs money in both directions.
Detection is information. Which bots are here, what they read, how often they return, what they tried to do. Blocking is policy: what you choose to do about each of them.
Cloudflare's model is catch and block, where identity is the verdict. Against attacks, that's correct; nobody needs to deliberate about a carding bot. Against AI-era traffic it fits badly, because the value of a bot varies wildly by type. A training crawler might return nothing. A search crawler returns citations. A fetcher means a human is asking about your page right now. A commerce agent returns revenue. One verdict can't cover four economics.
The alternative is detect, then decide. Know exactly which bots and agents hit which pages, then set policy per category: serve these, block those, charge the rest. Cloudflare sells the wall, and it's a good wall. You still have to decide who walks through the gate, and you can't make that call about traffic you've never measured.
The practical version, in order:
Precursor will get stricter after GA, agents will get better at imitating hands, and the detection bar will rise again. That loop doesn't end. Every turn of it makes undifferentiated automation harder to run, which is fine for scalpers and bad for the legitimate agent economy trying to buy things from you politely.
Site owners don't control the arms race. You control one thing: whether you know what's hitting your own site before you adopt someone else's default posture toward it. The sites that get this right in 2026 aren't the ones with the highest walls. They're the ones that can name every bot at the gate and say which of them made money last month.
If you want to see what that looks like for your own traffic, walk through the live demo. Knowing is cheaper than guessing, and considerably cheaper than blocking a customer you never knew was there.
Written by Crawlytics Team. Crawlytics tracks AI bots, generates llms.txt, and powers WebMCP commerce, all from one snippet on any stack. See how it works →
Precursor is a client-side detection system Cloudflare introduced on July 13, 2026, as part of Enterprise Bot Management. It continuously collects behavioral signals while a visitor uses a page, including pointer movement, keyboard timing and rhythm, focus changes, and page visibility, and feeds them into Cloudflare's bot scores and challenge decisions. The data is session-scoped, so a bot cannot reset its behavioral signature by refreshing the page or requesting a new challenge. It complements Turnstile rather than replacing it, and Cloudflare says it is free to use until general availability later in 2026.
It cannot tell them apart from hostile bots, by design. Precursor detects automation through behavior, and a legitimate shopping agent driving a browser on behalf of a real customer behaves like automation, because it is automation. The launch post draws no line between the two and never discusses false positives. Whether a flagged agent gets challenged or blocked depends on the bot-management policy each site sets on top of the score, which is exactly why site owners should know what agent traffic they receive before tightening that policy.
Not directly. GPTBot, ClaudeBot, and PerplexityBot are HTTP crawlers that fetch pages without rendering them in a browser, so mouse-movement analysis never sees them. They are covered instead by robots.txt directives, Cloudflare's crawler controls, and the AI bot categories that take effect September 15, 2026. The practical risk is posture, not mechanism: sites that adopt an aggressive block-everything stance tend to sweep up the search and answer-engine crawlers that would otherwise cite them in ChatGPT, Perplexity, and AI Overviews.
Decide per category, not globally. Training crawlers consume your content with little direct return, and blocking them is a defensible choice. Search and answer-engine crawlers determine whether you appear in AI answers, and blocking them makes you invisible to a growing share of buyers. Fetchers like ChatGPT-User fire when a real person asks about your page, and commerce agents can complete purchases. Most sites want to serve at least the second and third groups. Thirty days of real traffic data makes the decision concrete instead of theoretical.
You need server-side or edge-level bot analytics, because JavaScript-based tools like Google Analytics never record most AI bots. Crawlytics identifies AI crawlers, fetchers, and agents by User-Agent and behavior, then shows per-bot, per-page, per-day activity in a dashboard, so you can see which content GPTBot reads, whether PerplexityBot is returning, and what an agent tried to reach before you decide on a blocking policy.
This page is part of Crawlytics.app. View all pages: llms.txt · llms-full.txt