Cloudflare introduced a bot management offering to combat CAPTCHA-circumvention.

Named Precursor, the solution analyzes interactions across an entire user session on the client side to snare bots in real time. A blog from Cloudflare claimed Precursor can differentiate between human and automated actions down to the mouse click, noting “irregular paths, small corrections, and overshoots, and variations in speed, timing, and direction” associated with the former compared to the seamless patterns of the latter.

It added the tool is privacy-led in design, with such behavioral signals not exposed to customer dashboards or linked to user accounts, login identities, or persistent profiles.

Precursor in practice

The session-based verification system uses JavaScript to continuously collect behavioral signals and process them through Cloudflare’s bot protection.

A dispatcher then runs a roster of evaluators on the input data, while each evaluator reads relevant Precursor streams to cross-reference data. The tool then raises any signals into the shared detection registry.

The web giant stressed the importance of session scoping with Precursor, which keeps a bot from resetting its behavioral signature by refreshing the page or starting over with a new CAPTCHA (completely automated public Turing test to tell computers and humans apart) challenge.

Cloudflare CTO Dane Knecht claimed “modern bots have gotten smart enough to fake their way through the front door,” with Cloudflare claiming automated bot traffic generates roughly 57% of all web requests today.

"Instead of just checking an ID at the gate, we are looking at behavior over the entire visit. This makes life seamless for real users, while making it incredibly difficult and expensive for bad actors to fake human behavior. Cloudflare already protects users billions of times a day at critical moments like login and checkout, but until now, the space between those moments was a black box. With Precursor, we’re now eliminating that blindspot," Knecht noted.

Cloudflare's CAPTCHA gambit follows a recent attempt to replace the cookie with tokens, specifically private access control tokens (PACT) said to distinguish human users from AI agents.

Backed by Mozilla, Google, and Microsoft, the venture was said to spell an end for cookie tracking and tests via CAPTCHA, preparing the internet for when AI agents are likely to outnumber human users online. According to the likes of Cisco, bandwidth capacity will soon be stretched to the limit by the equivalent of “80 billion” humans.