Cloudflare has begun rolling out Precursor, a new bot-detection system that watches how visitors behave across an entire browsing session rather than testing them once at the door, the company announced on its blog on July 13.
Why a new detection layer
Cloudflare’s existing challenge system, Turnstile, already runs roughly 3 billion checks a day on sensitive pages such as logins and checkouts. But according to Cloudflare, modern automated traffic — including AI agents built to browse, fill forms and complete tasks — has gotten good at appearing human for the short burst needed to pass a single checkpoint, then reverting to scripted behavior afterward. The company says automated and agentic traffic now accounts for a majority of all web requests it sees, out of the more than 1 trillion requests it processes daily across roughly a fifth of the web.
How Precursor works
Precursor injects a lightweight, obfuscated script into a page that continuously collects behavioral signals as someone interacts with a site: pointer movement, keyboard timing, and whether the browser window is in focus. Cloudflare’s edge servers then cross-check those signals for consistency — for instance, whether cursor movement lines up with what is actually visible on screen — and carry that profile across the whole session, so refreshing the page doesn’t reset the score.
The system looks for physical traits that are hard for automation to fake, such as the slight arc a human wrist produces when moving a mouse, small delays between seeing an element and clicking it, and natural tremor in cursor motion. Bots, by contrast, tend to produce mathematically smooth paths and unnaturally precise timing. Cloudflare says the script is designed to collect the minimum data needed for this analysis — for example, typing rhythm rather than the actual keys pressed.
Rollout
Precursor is rolling out now as a free beta and is aimed at enterprise customers as an optional addition to Cloudflare’s existing Bot Management tools, with general availability planned later in 2026. It requires no code changes: administrators can turn it on from the Cloudflare dashboard and choose how much friction to apply, from silent observation to challenging unverified sessions.
The launch adds to a broader push across the industry to tell human, malicious-bot and AI-agent traffic apart, as more everyday web activity — from customer service to shopping — is handled by autonomous AI agents rather than people typing directly into a browser.