Cloudflare sits in front of a large share of the public internet, which makes its traffic logs one of the few places you can see the shape of the web without asking anyone’s opinion about it. On Thursday’s earnings call the company reported that automated requests from AI agents passed half of everything crossing its network — the first time bots have outnumbered humans on that network, and a more than 1,700% increase in daily agent requests over the past year.
The quarter itself was strong enough to move the stock 16%. Revenue of $696.1 million beat the $664.67 million consensus and grew 36% year over year. Adjusted EPS came in at $0.29 against $0.27 expected. Full-year revenue guidance went from $2.805–$2.813 billion to $2.864–$2.870 billion, and adjusted EPS guidance from $1.19–$1.20 to $1.25–$1.26. Customers spending more than $100,000 a year grew 27% to 4,698 accounts.
But a beat-and-raise is a quarter. The traffic mix is a regime. Every assumption baked into how the web was built — that a page view means a person saw it, that rate limits are tuned to human patience, that an ad impression has eyes attached — was calibrated for a network where humans were the majority. As of this quarter, on this network, they aren’t.
Our take: The number to argue about isn’t 50%, it’s 1,700%. A majority is a threshold you cross once; a 17x annual growth rate is a curve that keeps going. If agent traffic grows even a fraction as fast next year, “half” will look like a quaint waypoint, and every business whose economics assume a human on the other end — publishers paid per impression, SaaS priced per seat, anyone running a free tier — is repricing a product whose customer changed species. Cloudflare has an obvious interest in telling this story. That doesn’t make the packet counts wrong.
Picks and shovels, or toll booth
Wall Street’s read after the print was that Cloudflare is a picks-and-shovels play on AI, and the traffic milestone is the argument for it. The company’s pitch is that the next decade belongs to autonomous software talking directly to APIs, databases, models, payment rails and each other — and that somebody has to sit in the middle of that, verifying identity, metering usage and deciding who gets through.
That middle position is worth more in an agent world than a human one, for an unglamorous reason: agents are far easier to charge for. A human visitor is anonymous, cheap to serve and hard to bill. An agent arrives with credentials, a purpose and a budget behind it. Infrastructure that can identify which agent is knocking, on whose behalf, and whether that party has paid, turns a cost center into a metered product.
The unresolved question is legal rather than technical, and it moved recently: the Ninth Circuit decided who is responsible when an AI agent acts on a website, and the answer was not the AI company. When more than half the traffic is automated, that allocation of liability stops being an edge case and starts being the operating rule for the whole network.
What to watch
- Whether the 50% line is disclosed again. Milestones get announced once and quietly dropped if they reverse. A quarterly cadence means Cloudflare is confident in the trend.
- Pricing. Watch for agent-specific SKUs and per-request metering. That is how the traffic story converts into the revenue story.
- Publisher economics. If half of inbound traffic can’t see an ad, the pay-per-impression model is being taxed by a customer that doesn’t buy anything.
- Your own logs. The ratio on your site is knowable today, and it is almost certainly higher than you assume. Check before you plan next year’s traffic targets around it.
- Security surface. More automated traffic means more automated attack surface — the same week a worm was using AI coding configs to persist across hundreds of npm packages.
The web spent thirty years optimizing for attention. It now spends most of its bandwidth serving software that doesn’t have any.