The news
Bot traffic has overtaken human traffic, Cloudflare (NET) said in a founders' letter dated September 27, and Shopify (SHOP) opened checkout to browser-based AI agents, TechCrunch reported on September 28. Every online business now needs a policy for machine visitors.
In the letter, co-founders Matthew Prince and Michelle Zatlyn wrote that Cloudflare had originally expected automated traffic to overtake human traffic in the second half of 2027, but that the milestone came in May 2026, hastened by the spread of AI agents and crawlers. They went further, projecting that if current trends continue, "automated traffic will be 1,000 times human traffic in just five years." The letter did not detail how the milestone was measured.
The founders framed the cost as a tragedy of the commons, in which people who benefit from agents do not bear the costs agents impose on the sites they visit. Citing Cloudflare data, they said more than half of the content retrieved by well-behaved bots is identical to what those bots collected on an earlier visit. The company said it is working on ways for crawlers to skip content they already have, and for site owners and app builders to be compensated when agents use their work.
Cloudflare is also building for agents. On September 28 it updated Kitesurf, a web browser designed for AI agents rather than people that runs on its Workers platform and was introduced in August. The update adds support for WebMCP, a proposed web standard that lets a website offer functions agents can call directly instead of simulating clicks. Kitesurf is free during its beta, with per-account limits, Cloudflare said.
Shopify is working the selling side. According to TechCrunch, the company expanded its WebMCP support so browser-based agents can review a checkout, change details such as the address and delivery option, and submit the order after the buyer approves it. Previously, agents could only search products and add items to carts. TechCrunch said the feature is rolling out to all eligible merchants and cited Meta's (META) Muse among partner agents.
Shopify's developer documentation says it provides WebMCP tools on every storefront built on its Liquid theme system, and that agent support is currently limited to Chromium-based browsers.
The numbers
- Month automated traffic passed human traffic (Cloudflare)
- May 2026
- Cloudflare's original forecast for the crossover
- Second half of 2027
- Cloudflare projection for automated vs human traffic in five years, if current trends continue
- 1,000 times
- Share of good-bot fetches unchanged since last visit (Cloudflare data)
- More than half
- Web Platform Tests subtests Kitesurf now passes
- More than 730,000
Why CEOs should care
For digital and e-commerce leaders, the question is no longer whether to allow bots but which ones, and on what terms. The options range from blocking crawlers that take content without sending customers, to metering or charging for access, to building structured tools, as Shopify has, so agents can buy efficiently. Start by measuring what share of your traffic is automated, which agents account for it, and whether any of it produces revenue.
For CFOs and CTOs, automated traffic is a cost line. If Cloudflare is right that more than half of the content well-behaved bots retrieve is unchanged, companies are paying to serve repeat requests to machines. Review hosting and content delivery network (CDN) bills for the bot share, and ask providers what controls they offer to cache, rate-limit or charge crawlers.
For CISOs and risk teams, agents that can complete checkout raise new questions about fraud, chargebacks and liability. Before enabling agent purchases, confirm how the platform records buyer approval, how agents are identified, and who bears the loss if an agent orders the wrong item or an attacker poses as an agent. Update terms of service to state which kinds of automated access are permitted.
The bigger picture
The two announcements show the web serving two audiences at once. Publishers and infrastructure providers want agents to pay for what they take, while merchants want agents to buy with as little friction as possible. Cloudflare's founders warned that agents could favor established businesses over new entrants, which puts smaller sites under pressure to decide early. Standards such as WebMCP, now supported by both Cloudflare's agent browser and Shopify's storefronts, may become the way sites tell agents what they can do.
What’s next
Watch for Cloudflare to detail the payment and efficient-crawling tools its founders described, and for Shopify's agent checkout to reach more merchants and browsers beyond Chromium-based ones. Companies should write an agent access policy, covering which bots to block, meter or serve, before the year-end shopping season.
What “Fact-checked” means
Fact-checking means testing a story’s facts against the evidence before it is published. This story went through at least two separate checks before this version was published.
- What we checked
- Its names, figures, dates, job titles, quotes and who said what were checked against the story’s sources, including its main source where it could be opened. The headline was checked for accuracy and overstatement.
- How
- A first check reviewed the whole story. If it passed, a second, skeptical check went back to the sources to look for mistakes in the most important facts. If a check flagged the story, it was edited to fix the problems found, and a separate re-check then reviewed the whole story again.
- Who
- The checks are made by our newsroom, as steps kept separate from the writing, under rules set by our editor, Hussein Mukhtar. A story the checks still flag is held for the editor, who decides whether it is fixed, published or dropped.
- If something is wrong
- “Fact-checked” does not mean error-free. If a material error is found after publication, we correct the story and add a note saying what changed. Report an error
Companies in this story
