On July 13, 2026, Cloudflare launched Precursor. Part of Enterprise Bot Management, it is a client-side behavioral detection system that collects interaction signals across an entire browsing session, distinguishes human activity from automation or agent behavior, and feeds the result into Cloudflare’s existing challenges, Bot Score, and security rules.
The context behind this product matters more than the fact that Cloudflare is collecting a few additional mouse signals. AI agents can now use Playwright to drive a real Chrome browser. The browser a website sees is genuine, JavaScript executes normally, and network requests may even originate from the user’s own device. The old shortcut of assuming that a normal browser environment must have a human behind it is beginning to fail.
We had already seen this shift in May, when we analyzed the shutdown of Project Mariner. At the time, Claude for Chrome, Codex Computer Use, and Chrome auto-browse were all moving agents onto users’ real devices and into their browser sessions, where they could share cookies, IP addresses, and login state. This approach did avoid the most conspicuous bot signatures of standalone VMs, cloud browsers, and headless environments. Precursor addresses the next part of the problem: once the environment looks completely normal, how can a website still tell that an agent is operating it?
Precursor’s answer is to extend the assessment from a static attribute to the entire task: how the browser moves the pointer, enters text, and changes focus, and whether those behaviors make sense together over time. Precursor did not invent Bot Detection from scratch. It reflects a change in what detection systems must identify. Defenders used to focus primarily on whether a client resembled an automation tool. Now they must also determine whether a real browser is being operated by a person or an agent.
The earliest systems for distinguishing humans from machines concentrated the decision at a single checkpoint. A CAPTCHA required a visitor to complete a task that was easy for people but difficult for machines at the time, such as recognizing distorted text. The system did not need to understand the full visit. It only had to see whether the visitor could answer the challenge correctly.
Browser fingerprinting moved that decision one step into the background. A combination of attributes such as screen resolution, fonts, time zone, and browser APIs could characterize a client environment. The EFF’s 2010 Panopticlick study showed that combinations of these attributes were often highly distinctive. Defenders could then check whether an environment was internally consistent and whether it carried common signs of automation.
Risk scoring later began to replace explicit challenges on every visit. Client-side scripts, request frequency, cookies, page sequences, and account history all became part of the assessment. By around 2010, academic researchers were already aggregating web logs by session to analyze visit frequency, page paths, and HTTP errors. Subsequent research combined web logs with mouse behavior to detect advanced bots.
Cloudflare itself has also long used multiple layers of signals. JavaScript
Detections examines the browser environment and script execution,
__cf_bm helps smooth the request pattern of an individual
visitor, Anomaly Detection learns a site’s normal traffic baseline, and
Sequence Rules checks the order of API calls. All of these inputs can
ultimately affect the Bot
Score assigned to each request.
The history of Bot Detection, then, is not a story of CAPTCHA, fingerprinting, request scoring, and session analysis replacing one another. New signals have accumulated on top of old ones, while the observation window has expanded from a single click to multiple requests, account history, and the complete visit. Precursor enters an evolutionary path that has existed for years.
The diagram shows signals accumulating, not old technologies exiting as new ones take over. Fingerprinting and request scoring remain useful in the agent era, but on their own they are increasingly unable to answer who is operating the browser.
Traditional web bots usually execute scripts written in advance. Browser agents add a layer of LLM reasoning: they can read a page, plan the next step, invoke browser tools, and try a different path after encountering an error. They also perform tasks that people do, such as booking flights, shopping, or posting on forums.
These agents bring four changes to detection systems. First, they run in real browsers, so environmental attributes no longer reveal their identity automatically. Second, they can handle dynamic pages and unexpected branches instead of repeating a fixed URL sequence. Third, local agents can generate traffic from a user’s device and residential network, making the IP address and network path appear entirely normal. Fourth, robots.txt, User-Agent, and Web Bot Auth all depend on an agent declaring itself voluntarily; automation that does not want to declare itself can still impersonate a human.
The problem is harder because an agent is not inherently malicious. It may be authorized by a user to purchase a ticket, or it may scrape content without permission. A legitimate agent may also be affected by prompt injection and begin taking actions outside its authority. What websites actually need to distinguish is legitimate delegation, unauthorized automation, and dangerous behavior in progress. A single human/bot label cannot capture those differences.
Playwright is an automation framework commonly used by browser agents. Through the Chrome DevTools Protocol, or CDP, it can control a real browser to open pages, click controls, and fill out forms. The browser itself is not fake; the automation happens in the layer that controls it.
This weakens a set of signals that were previously inexpensive to
inspect. navigator.webdriver can return false, a headless
browser’s User-Agent can be rewritten, and missing multimedia APIs or
crude fingerprints can be filled in. DataDome’s Galileo
research documented how specific Playwright versions and execution
paths conceal navigator.webdriver. These signals have not
disappeared completely, but they are no longer reliable on their
own.
A real browser still leaves operational traces. An agent may move the pointer to a target in 0 milliseconds, scroll through a long page instantly, enter text at a fixed cadence, or entirely skip the pauses people need to read and locate controls. CDP may also produce observable side effects. Over a longer time window, focus, page visibility, input events, request paths, access rates, account state, and final business outcomes can still be checked against one another.
Playwright therefore changes not whether websites can detect automation, but how much detection costs. The era of reaching a conclusion from a single attribute is ending. Defenders must collect longer, denser behavioral sequences and accept that their conclusions can only be probabilistic.
In 2026, researchers at the University of California, Davis published a preprint called FP-Agent, specifically measuring whether browser agents could be distinguished from humans and from one another. The experiment matters not just because it found several peculiar agent behaviors, but because it formulated the problem as a trainable, comparable multiclass classification task.
The team built a test website with monitoring scripts and had seven browser agents complete three types of tasks: booking flights, shopping, and interacting on a forum. Each agent ran 1,000 times. The researchers also recruited 56 students and collected 546 samples of human activity. They extracted 418 browser fingerprinting features and 50 behavioral features, then used XGBoost to train separate classifiers on browser fingerprints, behavioral fingerprints, and a combination of the two.
The results showed a substantial difference in the discriminative power of the two signal types. With browser fingerprints alone, the classifier achieved an F1 score of about 0.8. When several agents shared similar browser configurations, the model frequently confused them. After typing, scrolling, and mouse behavior were added, the behavioral and combined classifiers achieved nearly perfect F1 scores on this controlled dataset. The researchers’ FP-Agent identified all seven agents, while Cloudflare’s protection in the same study blocked only one.
This does not prove that an XGBoost model has solved Agent Detection. The experiment included only seven agents, three task types, and one group of student participants, with fixed software versions and operating environments. The model may have learned the implementation habits of a particular agent version, and its performance could decline when the next version adds more human-like trajectories. What the paper genuinely changes is our assessment of the problem: when browser attributes are insufficient, agents still expose consistent behavioral differences. Defenders can use machine learning to classify those differences, but they must continuously collect new samples, update features, and retrain their models.
This will create a long-running contest. Detection models learn how agents type and move; agent developers then make those actions more human-like. FP-Agent measured stable differences in this set of samples. It did not prove that those differences will persist forever, nor did it provide a general detection rate for production environments.
Cloudflare defines Precursor as a client-side, session-level behavioral verification system. It is part of Enterprise Bot Management and serves as an optional complement to Turnstile. Turnstile is designed to perform a one-time verification at critical moments such as login, registration, and checkout. Precursor covers the activity between those checkpoints.
It first dynamically injects a script into HTML responses passing through Cloudflare. The script continuously records pointer movement, the timing and cadence of keyboard activity, focus changes, and page visibility, then sends compressed events back to an edge node. Cloudflare’s evaluator does more than check whether an individual action is too fast. It cross-checks signals: why is the pointer moving while the page is not visible, why are keyboard events appearing when the text field lacks focus, and is the entire trajectory internally consistent?
Precursor also changes when decisions are made. Passing one challenge does not give a user a permanent pass for the rest of the session. Cloudflare’s changelog states that the system revalidates challenge clearance as behavior changes and updates Bot Score with session context. Cloudflare processes the raw behavioral stream internally; customers use the session context, scores, and rule outcomes derived from it. Subsequent requests may be allowed through, handled by Security Rules, or challenged again.
The core of this design is not a search for a single definitive agent fingerprint. Cloudflare continuously collects many incomplete pieces of evidence, cross-checks them, and revises trust as the session unfolds. For an attacker, changing one attribute is no longer enough; the entire visit must maintain plausible behavior. A website, meanwhile, does not need to deploy its own collection service, real-time classifier, and enforcement interface. The results can feed directly into its existing Cloudflare rules.
The most natural users are website operators that already put a website or single-page application behind Cloudflare and need Enterprise Bot Management to monitor page activity continuously. Its most typical use cases involve long stretches of a visit that must still be observed outside login, registration, and checkout, or teams that want to present fewer CAPTCHAs while continuing to detect advanced automation. Cloudflare’s materials published that day describe actual availability inconsistently, so the product’s place in the portfolio does not reveal which accounts can already use it. Precursor also does not authenticate account identity or decide what a particular user or agent is authorized to do within an application.
Cloudflare says Precursor records only the timing and cadence of keyboard activity, not the actual characters, and does not associate behavioral signals with an account, login identity, or persistent personal profile. This defines the basis of its judgment: it observes behavioral consistency within the current session rather than establishing a long-term behavioral identity for a specific person.
Continuous behavioral monitoring is not unique to Cloudflare. HUMAN and DataDome likewise emphasize the session or the complete visit path, putting them in direct competition with Precursor in this area. The two companies also offer AgenticTrust and Agentic Trust, respectively, placing declared agent identity and access policy in an adjacent control layer. Behavioral detection and identity governance sit close together in these product portfolios, but they still address two different problems.
Kasada has chosen a different cost model. It places greater emphasis on client integrity, proof of code execution, and dynamic code, forcing attackers to bear recurring reverse-engineering and maintenance costs. Akamai Bot Manager and Imperva Advanced Bot Protection, meanwhile, combine request, device, behavior, and threat-intelligence signals within enterprise WAAP suites.
Arkose Labs primarily imposes adaptive challenges at high-value points such as registration, login, and payment, with the goal of directly disrupting an attacker’s economics. Fingerprint and reCAPTCHA Enterprise operate more like signal or step-up verification components, requiring customers to connect their assessments to business-level enforcement.
Precursor’s clearest distinction is not any particular mouse feature, but Cloudflare’s simultaneous control over script distribution, edge evaluation, Bot Score, challenges, and WAF rules. Existing Cloudflare customers can integrate fewer system layers and let session signals affect subsequent requests immediately. That is a distribution and integration advantage, but it is not enough to prove that Precursor’s algorithms are more accurate than its competitors’.
Precursor’s first limitation is that every behavior can be imitated. Attackers can slow down, add pauses, generate mouse trajectories, and maintain cookies and account state. An entire session is harder to forge than a single fingerprint, but it does not produce unforgeable proof of a human operator. Detection raises the cost; it does not create certainty.
The second limitation is more fundamental: behavior that does not look human is not necessarily illegitimate. An authorized agent may have no mouse trajectory at all and may fill out a form in seconds. Conversely, an agent with a signed identity may still be compromised by prompt injection or exceed the user’s authorization. Agent identity, user delegation, business permission, and current behavior are four separate questions. No one layer can replace the others.
Invisible detection also hides false positives inside a background score. People who use keyboards exclusively, screen readers, voice control, switch access, or remote desktops may produce entirely different trajectories. The W3C’s review of CAPTCHA accessibility problems did not evaluate Precursor, but it exposes the same design obligation: products need accessible step-up verification, appeals, and human-assisted recovery. Cloudflare has not published false-positive rates broken down by user group, and independent accuracy and performance testing of Precursor is also unavailable.
Privacy concerns do not disappear automatically because actual keystrokes are not recorded. Interaction timing, session identifiers, retention periods, collection opt-outs, reuse for model training, and the auditability of decisions all require explicit rules. At a minimum, website operators need to know how long the data is retained, who can access it, and how incorrect decisions can be reviewed.
There is also an official contradiction in the product’s status. In its July 13, 2026 press release, Cloudflare announced that Precursor was already GA. Its technical blog published the same day still described the product as rolling out and said it would remain free until a GA release later that year. Actual availability and pricing therefore still depend on the account and contract.
Browser agents have pushed Bot Detection into a more difficult but more realistic stage. Websites can no longer infer human intent from the attributes of a real browser, nor can they treat all automation as an attack. Precursor adds the runtime behavioral layer, but it does not solve identity and authorization for websites. Only by connecting these assessments can legitimate agents gain access without impersonating humans, while malicious automation can no longer slip through simply by changing its browser shell.