Cloudflare watches your clicks and keystrokes to catch AI bots
What's the story
Cloudflare has launched a new behavioral bot detection system called Precursor. The tool, which is available for Cloudflare Enterprise Bot Management customers, aims to replace traditional CAPTCHA puzzles with a more seamless user experience. Instead of checking individual actions like logins or checkouts, Precursor continuously monitors browser activity throughout an entire session to determine if a visitor is human.
User behavior analysis
How does Precursor identify human behavior?
Precursor analyzes various user interactions to identify human behavior.
These include mouse movement patterns, scrolling rhythm, typing rhythm, clipboard usage, page visibility and keyboard activity in relation to text field focus.
However, Cloudflare clarifies that the system doesn't capture actual keystrokes but rather studies their timing and rhythm.
This approach gives a more holistic view of how users interact with websites compared to traditional bot protection methods which focus on specific moments like logging in or creating an account.
Bot detection
Precursor is designed to counter modern bots
Precursor is particularly effective against modern AI agents that can run JavaScript, operate in real browsers, and sometimes bypass regular CAPTCHAs.
Cloudflare believes it's much harder for automated software to mimic realistic human behavior over several minutes.
This is because humans don't move a mouse with mathematical precision; we hesitate, overshoot buttons, change direction and move at inconsistent speeds.
Bots, on the other hand, tend to behave differently with their movements being too straight or smooth or precise.
Operational details
How to enable Precursor on your website?
Website operators can enable Precursor from the Cloudflare dashboard.
Once activated, a small JavaScript bundle is injected into HTML responses as they pass through its network.
The script attaches event listeners that collect interaction signals and temporarily store them in memory before sending them to Cloudflare for analysis.
These findings can influence Cloudflare's bot score, challenge decisions, and security rules.
Privacy concerns
Is the user monitoring aspect invasive?
Precursor continuously evaluates whether a visitor continues to behave like a human.
Cloudflare emphasizes that it collects only the minimum data necessary to detect automated activity and doesn't log actual keystrokes.
The company also says behavioral information is analyzed as aggregate patterns and isn't linked to login identities, customer accounts or persistent user profiles.