Cloudflare spent the first full week of August shipping infrastructure for AI agents — its Agents Week, from the welcome post on 2 August to the recap on the 10th. It covered a whole stack: somewhere for agents to run, a way to build and watch them, an identity and a wallet, a route onto the web, and the security around all of it. Across the announcements, Cloudflare keeps saying the person is still in charge.
Where the agents live
@cloudflare/computer, previewed on the Monday, gives each agent its own virtual computer: a SQLite-backed workspace that runs on a lightweight isolate or a full container depending on the task, with cross-language RPC and inbound TCP/gRPC so the agent can actually reach things. Tuesday added the Agent Development Lifecycle — traces and session replay so you can see what an agent did, plus @cloudflare/ci to test agent code the way you’d test anything else. And Kitesurf is a browser engine written from scratch in Rust and compiled to WebAssembly, running inside Workers isolates with no Chromium; Cloudflare’s numbers put it at 3–7× less memory and CPU than headless Chrome. All three are built for scale: if agents become a primary workload, you can’t hand each one a full browser or a container, so the runtime has to get lighter.
An identity and a spending limit
Cloudflare Wallets and cloudflare.pay give an agent a stable identity and the ability to pay for things — APIs, content — over the x402 stablecoin protocol. The limits work like this. Humans get Account Wallets; agents get Virtual Wallets; and each Virtual Wallet carries hard limits the agent cannot override: a weekly allowance, a list of approved merchants, a ceiling on any single charge. Reach the limit and the agent has to come back and ask a person. Cloudflare’s own example is a company handing each employee’s agent a weekly budget. The agent can act on its own, but only inside limits a person has set.
A way onto the web that isn’t scraping
WebMCP, a developer preview, lets any site on Cloudflare expose a set of tools to browser agents with one switch and no code, by injecting a small bridge at the edge. It sits on a new browser standard, shipping experimentally in Chrome 146, that surfaces in the page as document.modelContext. The pitch aims straight at the crawler problem: rather than an agent copying your content back to someone’s server and giving you nothing, the site chooses what to expose, the tools run in the visitor’s own browser and session, and — Cloudflare’s words — the creator keeps their traffic. The switch is opt-in, and the site owner decides what an agent is allowed to touch.
Credentials the agent never holds
Cloudflare OS, used inside Cloudflare first and now open-sourced, is an agent workspace where “Gatekeeper” workers keep the credentials and agents only ever receive scoped capability objects — so no raw API key reaches agent-generated code. Alongside it, Cloudflare is moving bot management from a point-in-time risk score to continuous trust evaluation for bots and agents alike. The assumption underneath both is the same: you contain an agent and keep checking it, rather than handing it the keys.
The thread
Put the week together and the same move repeats. Wallets with limits a person sets. A web protocol the site owner opts into. Credentials an agent never actually holds. A recap that lands on “the humans and communities keeping all of it grounded.” Cloudflare is building the plumbing for autonomous agents and, at nearly every layer, wiring in the assumption that a human stays in the lead.
It’s a term I’ve been toying with this week — human in the lead, as against human in the loop. Being kept in the loop lets you go passive; being in the lead means you set what the thing is for and you answer for what it does. It’s good to see that built into the infrastructure. But the infrastructure only gives you the control. Using it is still your job. A Virtual Wallet limit you never set, a WebMCP switch you flip without reading what you’ve exposed — and you’re passive again, with a setup step added first.
The tools are getting very good at doing what you point them at. Pointing them is still the work: being specific, setting the spec, holding the limit. Cloudflare just spent a week building the infrastructure for exactly that. The infrastructure is there now; whether people use it to stay in the lead, or flip the switches and drift back into the loop, is the open question.