Cloudflare is partnering with Mozilla, Google, Microsoft and Shopify to develop a standard that helps websites distinguish between legitimate human users and authorized AI agents from malicious traffic.
Called Private Access Control Tokens (PACT), the standard enables browsers to prove that a user or authorized agent is legitimate – without invasively tracking users, forcing logins or CAPTCHA tests. The companies plan to develop the protocol as an open web standard.
The announcement comes as bots have officially overtaken human traffic on the web. According to Cloudflare data released this month, bots now account for 57.8% of global web traffic, surpassing the 42.2% generated by humans.
Cloudflare operates one of the world’s largest internet infrastructure networks, routing and securing traffic for millions of websites and applications, giving it a unique vantage point into global web activity and emerging online threats.
The company said PACT lets services trusted by users issue anonymous cryptographic tokens. Browsers can then present those tokens to other websites as proof that a human – or an authorized agent – is involved, without revealing the user’s personal identity or browsing history.
Cloudflare CTO Dane Knecht said the internet is undergoing a “fundamental shift” as autonomous agents begin handling tasks that previously required people to navigate websites themselves.