Cloudflare launches Precursor to detect agentic bots across full web sessions

Cloudflare has launched Precursor, a new Enterprise Bot Management feature designed to spot automated and agentic traffic by looking beyond one-off challenges and evaluating behavior across an entire web session.

The company says the product is meant to close a visibility gap left by checkpoint-style defenses. Turnstile and other managed challenges can verify users at high-risk moments such as login, signup, and checkout, but Cloudflare argues that modern automation can sometimes pass isolated checks by running JavaScript, using real browser environments, or mimicking short bursts of human activity. Precursor instead watches the broader journey through a site, looking for patterns that are harder to fake consistently over time.

How the system works

According to Cloudflare, Precursor uses dynamically injected JavaScript to collect lightweight interaction signals while a visitor moves through an application. The company says the script records signals such as pointer movement, keyboard timing, focus changes, and page visibility, then sends compact buffered data back for edge-side evaluation. Cloudflare says keyboard activity is captured as timing and rhythm rather than actual keys pressed.

The detection layer evaluates whether a session behaves like a coherent human visit. Cloudflare gives examples such as whether pointer activity lines up with page visibility and whether keyboard events occur only when a text field is focused. The session-level model matters because a bot cannot erase its broader behavioral signature simply by refreshing a page or starting a new challenge.

The launch reflects a wider shift in bot defense as AI agents and browser automation tools become more capable. Simple signals such as a completed CAPTCHA, a valid browser, or a plausible mouse path are less decisive when automation frameworks can simulate them. Cloudflare says Precursor raises the cost of operating bots by requiring attackers to imitate an entire session rather than a single interaction.

Precursor also adds session-based views to Security Analytics, giving customers a way to examine visitor journeys instead of only individual requests. The company says the new feature feeds into existing systems such as bot score, challenge decisions, and security rules.

Precursor is rolling out now from the Cloudflare dashboard for customers using Bot Management or Turnstile. Cloudflare says it will be free to use until general availability later in 2026, with modes ranging from background observation to stricter verification that can enforce challenges when a verified session does not already exist.

Sources

• blog.cloudflare.com

Cover photo by panumas nikhomkhai on Pexels, used under the Pexels License.