People can now search and shop and send messages with AI agents. It generates actual work for the websites visited. So who pays for it?
The Short Answer
- According to Cloudflare, the majority of the expenses of agents are borne by websites.
- In its Nov. 5 paper, it details 14 problems that are associated with AI agents.
- The company is looking for sites to be aware of the agent's representation and what the company can do.
- In the same week, agents got voice and new tools added to Muse, courtesy of Meta.
This guide provides background information on the paper and on the proposed rules and on the extent of the evidence. It also covers what Meta announced for Muse and which questions are still open.
Why Cloudflare Says Websites Carry the Cost
The Core Argument
Cloudflare is a security company that operates on the internet. In its paper it says that agents can be a problem to websites even if they operate for real people. It also cautions that the flow of agents is increasing rapidly, and may surpass the amount of regular human browsing at some point.
The Cloudflare paper states that "The Site bears the primary cost".
Problems the Paper Describes
- An agent's purchase can occur without explaining to a person if they approved the purchase.
- An agent can attempt to log in to a bank with genuine account information.
- An agent can access a news story, but without opening it or viewing its ads.
The latter example is important for publishers as ads may compensate for content. A site can lose revenues without the agent ever being able to see it.
The Intermediation Principle and the Proposed Rules
The Main Idea
The Intermediation Principle is Cloudflare's main concept. The relationship between a person and a web site should not end with software in between. This includes security features already available on the site.
Tools and Standards at a Glance
| Item | Purpose | Status in the paper |
|---|---|---|
| Identity levels | Range from no identity information to a confirmed account | Suggested approach |
| Web Bot Auth | Helps identify agents | Supported by Cloudflare |
| OAuth | Lets people give agents permission to use their accounts | Supported by Cloudflare |
| robots.txt | Existing way to give crawlers instructions | Not designed for agents |
| Agent traffic reports and block rules | See personal assistant agents and block certain agents on pages with ads | Available to customers |
| Account abuse protection tool | Helps protect accounts from abuse | Early access |
A New Way to Explain Permissions
Websites require a new means of explaining to visitors what agents can do, says Cloudflare. The robots.txt system was designed for a different purpose. No specific pricing model is discussed in the reporting, so the notion of 'charging agents' must be understood in the context of the broader drive to identity and permission.
What the Evidence Shows and What It Lacks
Supporting Numbers
- Arkose Labs determined that 97.7% of the legitimate AI agent sessions lacked an identified identity.
- Research house HUMAN reported that 72% of the AI agent requests it saw were for Meta's Muse.
Limits to Keep in Mind
Meta's Muse Gains a Voice and New Tools
What Muse Is
Muse is an Artificial Intelligence (AI) assistant by Meta. It is used in conversation to ask questions, receive explanations and complete day-to-day tasks. Newer tools link it to Meta services like Instagram and Market place.
Voice and Avatars
On November 5, Meta started introducing spoken conversations and animated avatars in the U.S. No info yet about this feature in Canada. Users have access to hundreds of voices and can interrupt Muse and let it continue to work on tasks and resume their speech.
Spaces
On the subsequent day, Meta added spaces. They are developed by the user, who states the function simply in text. A space may monitor prices or gather stored Instagram items or aid in planning a wedding. Examples include a tool that aggregates saved products and Marketplace listings and buyer messages, for shopping and selling. The spaces are private for now, and Meta hasn't announced when it will be enabled for sharing.
| Muse feature | What it does | Availability |
|---|---|---|
| Voice conversations | Spoken chat with interruptions and background task work | Rolling out in the United States and not yet in Canada |
| Animated avatars | Visual presence during voice chats | Rolling out in the United States |
| Spaces | Custom tools made from plain language descriptions | Private for now |
Open Questions
- What is voice recording stored on?
- Will information from the space be utilized for advertising.
- Will transactions made through Muse include fees.
Who Is Responsible When Agents Act
Practical Steps for Site Owners
- Take a look at the amount of traffic that comes from robot visits.
- Choose the ads and/or accounts to let agents onto the page.
- Review identity checks and select those appropriate for your level of risk.
What Users Should Know
Even if you have an agent visit you, the site might not recognize it as a risk. Verify the items your assistant can purchase or login to or share. Clear approval steps will help keep you and the sites you visit safe.
Cloudflare's message is clear. People, technology companies and websites need clear rules about identity/permissions and responsibility as agents assume more responsibilities. The expenses are frequently borne by the websites that agents visit currently.
