TL;DR
- Cloudflare’s Agents Week, running from 2 to 10 August, shipped a full stack for AI agents: somewhere to run, tooling to build and observe, an identity and a wallet, a route onto the web, and security around all of it.
- Across the announcements the same design choice repeats, with limits set by a person: wallet ceilings, an opt-in site switch, and credentials the agent never actually holds.
- “Human in the lead” rather than human in the loop describes that arrangement, meaning you set what the thing is for and answer for what it does.
- The control only exists once you use it: a wallet limit you never set or a WebMCP switch flipped unread leaves you passive again, and whether people configure any of it is the open question.
In plain English
Several pieces of Cloudflare jargon carry the week. @cloudflare/computer gives each agent its own small workspace, running either on a lightweight isolate, a cheap sandbox that starts almost instantly, or a full container when the job needs one. Kitesurf is a browser engine written in Rust and compiled to WebAssembly, so an agent can browse without a full copy of headless Chrome behind it; Cloudflare’s own figures put it at three to seven times less memory and CPU. Cloudflare Wallets give an agent a payment identity through x402, a protocol for paying with stablecoins, and a Virtual Wallet carries hard limits the agent cannot override: a weekly allowance, approved merchants, and a cap on any single charge.
WebMCP lets a website expose a defined set of tools to a visiting agent, using a new browser feature that appears in the page as document.modelContext and ships experimentally in Chrome 146. The tools run in the visitor’s own browser and session, so the site owner picks what an agent may touch rather than having content scraped back to someone else’s server. Cloudflare OS handles credentials with a pattern called scoped capability objects: “Gatekeeper” workers hold the real API keys and pass the agent only a limited permission to act, so no raw key ever reaches agent-generated code.
Cloudflare spent the first full week of August shipping infrastructure for AI agents — its Agents Week, from the welcome post on 2 August to the recap on the 10th. It covered a whole stack: somewhere for agents to run, a way to build and watch them, an identity and a wallet, a route onto the web, and the security around all of it. Across the announcements, Cloudflare keeps saying the person is still in charge.
Where the agents live
@cloudflare/computer, previewed on the Monday, gives each agent its own virtual computer: a SQLite-backed workspace that runs on a lightweight isolate or a full container depending on the task, with cross-language RPC and inbound TCP/gRPC so the agent can actually reach things. Tuesday added the Agent Development Lifecycle — traces and session replay so you can see what an agent did, plus @cloudflare/ci to test agent code the way you’d test anything else. And Kitesurf is a browser engine written from scratch in Rust and compiled to WebAssembly, running inside Workers isolates with no Chromium; Cloudflare’s numbers put it at 3–7× less memory and CPU than headless Chrome. All three are built for scale: if agents become a primary workload, you can’t hand each one a full browser or a container, so the runtime has to get lighter.
An identity and a spending limit
Cloudflare Wallets and cloudflare.pay give an agent a stable identity and the ability to pay for things — APIs, content — over the x402 stablecoin protocol. The limits work like this. Humans get Account Wallets; agents get Virtual Wallets; and each Virtual Wallet carries hard limits the agent cannot override: a weekly allowance, a list of approved merchants, a ceiling on any single charge. Reach the limit and the agent has to come back and ask a person. Cloudflare’s own example is a company handing each employee’s agent a weekly budget. The agent can act on its own, but only inside limits a person has set.
A way onto the web that isn’t scraping
WebMCP, a developer preview, lets any site on Cloudflare expose a set of tools to browser agents with one switch and no code, by injecting a small bridge at the edge. It sits on a new browser standard, shipping experimentally in Chrome 146, that surfaces in the page as document.modelContext. The pitch aims straight at the crawler problem: rather than an agent copying your content back to someone’s server and giving you nothing, the site chooses what to expose, the tools run in the visitor’s own browser and session, and — Cloudflare’s words — the creator keeps their traffic. The switch is opt-in, and the site owner decides what an agent is allowed to touch.
Credentials the agent never holds
Cloudflare OS, used inside Cloudflare first and now open-sourced, is an agent workspace where “Gatekeeper” workers keep the credentials and agents only ever receive scoped capability objects — so no raw API key reaches agent-generated code. Alongside it, Cloudflare is moving bot management from a point-in-time risk score to continuous trust evaluation for bots and agents alike. The assumption underneath both is the same: you contain an agent and keep checking it, rather than handing it the keys.
The thread
Put the week together and the same move repeats. Wallets with limits a person sets. A web protocol the site owner opts into. Credentials an agent never actually holds. A recap that lands on “the humans and communities keeping all of it grounded.” Cloudflare is building the plumbing for autonomous agents and, at nearly every layer, wiring in the assumption that a human stays in the lead.
It’s a term I’ve been toying with this week — human in the lead, as against human in the loop. Being kept in the loop lets you go passive; being in the lead means you set what the thing is for and you answer for what it does. It’s good to see that built into the infrastructure. But the infrastructure only gives you the control. Using it is still your job. A Virtual Wallet limit you never set, a WebMCP switch you flip without reading what you’ve exposed — and you’re passive again, with a setup step added first.
The tools are getting very good at doing what you point them at. Pointing them is still the work: being specific, setting the spec, holding the limit. Cloudflare just spent a week building the infrastructure for exactly that. The infrastructure is there now; whether people use it to stay in the lead, or flip the switches and drift back into the loop, is the open question.