0:02Hi, everyone. I'm Brian Becker, Director of Product at Cloudflare for our Integrity and Trust products. And joining me today is Tiago Sado, Chief Product Officer for Tools for Humanity. Great to see everyone here. And we're here to talk because the age of AI is upon us. As of this year, Cloudflare reported that more than half of the internet traffic is now driven by bots. And that was already before all the new personal agents, whether it's Muse or Instinct, Dots, whatever you like, that have started taking off as of a few weeks ago. And so I personally believe that while that's 51 % right now, we're going to see 99 % pretty quickly. And with that come pretty profound questions about how do we enable these good bots while continuing to deal with the bad bots, right?

0:51How do we enable my grandma, for example, to go and order groceries? And for a website to know that they can safely allow her to do that while keeping out all the bad bots and preventing any fraud and abuse to happen on their platform. And so that's what we're going to focus on today. And let's get started.

1:09So the way people are using these agents is also changing. Even in the last two weeks or so, we saw millions of users adopt and start using Muse, Instinct, or other personal agents. And it's changing so fast. I think it's safe to say it's going to be different again next month. But it's not only good users using these. There's new attacks every day with AI. I'm sure you've heard about it in other sessions. And effectively, there's infinite zero days out there just if you account for the pace and scale that attackers can leverage these new technologies to build code. And something I've been asked a lot by our customers is in various formats, what happens if someone just takes Mythos? super mythos and points it at your site on a loop forever like what do you do in that situation obviously a system that's like built with a set of rules is not going to stand up to that and then finally like muse grotbot these other personal agents like essentially they're just out there like running wild doing whatever their users asked them to do and that's not necessarily bad but it's new and it brings new risks to sites so how do we deal with this Fundamentally, to prevent fraud and abuse, we're trying to answer two questions.

2:24Are you who you say you are, and can we trust you? And that's really still the same two questions we need to ask today in the world of agents. It was true before, and it remains true now. And on the easy path, bots and agents, they can identify themselves. We like it when they use WebAuth, but there's lots of ways you can do that. Cloudflare maintains bot base as the world's largest directory. We're at over 800 now, and we're going up like 50 applications a week now. And customers, such as yourself, can use this tool, like, choose which bots you allow, which agents you allow. And we also offer a status called verified, which is kind of the Cloudflare seal that says, like, we think this thing's safe to allow. So our recommendation to most sites often is, like, start with if verified, then allow.

3:13And to be verified with Cloudflare, essentially, three things need to be true. first you have to say who you are you have to securely identify yourself second you have to do what you say you do so you can't pretend that you're a search bot but then also like help customers log in and buy stuff and third you can't commit abuse and third one sounds like a freebie but like that extends to like selectively identifying yourself when it's to your benefit and hiding when it's not to your benefit but for the bad guys i wouldn't it's not to say that they've gotten smarter but they do have access to more tools and they can adapt faster and build code faster and iterate faster and the primary challenge to site owners is like sophisticated persistent attackers exist that's basically like fancy words to say like they're smart and they don't give up and if the thing that they want is on your website when they get blocked they don't give up they'll grab a red bull and keep going and i like to say in an alternate Like many of us in this room, we want to make like different life, different worse life decisions.

4:17And we would be in their seat, but they love their job. Like for better or worse, for worse for us, they just keep going. And some of them even take it to the next level where they have these like meta automations they've set up. So they have like a service that's just like ping sites to infinity, like changing attributes of itself and then log in what works and what doesn't work. And they're essentially. like building a catalog that then they can go reuse to do an extra uh like the actual attack and so from this perspective i think it's like easy to understand that they will eventually get through like you probably experienced this yourself and you know like the bad guys do get through um and it's even more true today because now that they have access to ai like these loops these adaptation loops are faster it's easier for them and so we like you can describe this scenario as an adversary asymmetric game or in game theory terms anyway and so to win that essentially we need to make sure that the cost for the defender is cheaper than the cost for the attacker to adapt and by adapt i mean like when they go back into that loop of like updating their code and changing how it works and trying to get around the block and today that's not true it's not true for the defenders anyway so when a bad guy gets in and i'm sure many of you have experienced this there's like results in escalations tickets meetings calls like hopefully not but probably sometimes like a war room and it sucks uh that's not the same for the defender the

5:48defender like this is their life it's sorry for the attacker for the attacker this is their life like they're they're drinking red bulls again they love it they're probably not gonna like get around the attack in a day sorry get around the block in a day but on average they get around it in around 30 days and there's a lot of variance to that but they still always get around it. And so I would posit to the room that all last -gen solutions, including even Cloudflare's product of last year, are flawed. They're all built with this same inherent flawed idea that if you build the wall tall enough, if you accumulate enough logic and enough rules and enough expressions, nothing will ever get in. And again, that's just not true. The bots, the bad guys, will always get in. If they're coming for the thing you have, they will find a way. And so at Cloudflare, what we built is a new detection engine that we call adaptive intelligence.

6:38It's the first detection engine in the world that's built with the assumption that bad guys will always get in. And so the system's actually built to adapt to this and recognize when something got through and change itself. So in this way, we didn't kind of change this scenario where the attacker can like do their regular job and the defender is always in escalations and meetings and trying to deal with it and put the cost back on the attacker and make them have to constantly update while the defender's just letting a machine defend against this and later this year this quarter we're updating it to use callflare's network in ways that we've never used it before so rather than accumulating a set of rules and logic and fingerprints that we use to detect when something's bad we're building a system that understands and reacts when things don't look right it's essentially like the ability to fingerprint cloudflare's global traffic and also fingerprint the local traffic at each individual metal and say things like to programmatically understand that this browser and this device is weird to see at this volume or understanding that this device and this language setting or resolutions not common in this part of the world and do that all programmatically so that the system can understand that something's going on and then react to it as opposed to just developing a set of rules so essentially we're breaking the economics that

8:12attacker the economic advantage that attackers inherently have over defenders

8:18and now this is not your problem right we have bots way before advanced ai that people have been doing all sorts of things for many, many years. And the thing is, many of the things that we used to use now don't work anymore, right? Many of the tools that served us really well for many years, they've broken, right? Because fundamentally, the way things have worked before is use a website, say, ask the requested user to provide you something that cannot be faked. And either you as a side or a third party helps check that that is indeed not fake. the problem is that as it has been for many years, attackers start this arms race to start faking those things. And now with AI, the odds are on their side, right? Because you can use whether it's deepfakes or bots, different kinds of attack vectors where all of these different things have broken, right? So let's talk about some of them.

9:11IDs were faked before you and I were born, right? And they're great for some things, but not. to know whether something's a human or a bot. We used selfies for a little bit a few years ago, but then those were very quickly broken. And especially nowadays with really advanced deep fakes, you can pretend to be an existing person or just create a completely artificial and synthetic identity. Proof of liveness, right, where you start getting more sophisticated. It may work for some low assurance use cases or some low risk use cases, but the reality is like, again, that can also be broken, right? And so when you continue... going down the list of all of these kinds of signals, they sooner or later get broken by AI. Usually in the industry, we see many of these within 12 years, right, and within 12 months.

10:01And the reason for that is that just fundamentally any signal that starts in the digital world can and will be fake with AI. We just cannot trust what is generated or what starts in the digital world anymore. And so what do we do, right? The problem is bigger than ever. or tools that have served us for a while, they don't really work anymore. And so, well, there's a couple of things we can do. First, we can come up with new kinds of signals. And this is one of the things that we think a lot about at TFH. So for example, we've come up with something called Proof of Human. And that is very simply a privacy-preserving AI proof that proves that you are a real and unique person. And it works because it starts not in the digital world, but in the physical one. And it's kind of- counterintuitive, but what we ended up doing after trying all sorts of things for seven years is we built a secure standard for a camera where you can go use it once, just like you would get a driver's license, and that gives you a credential that you can then use on websites to prove that you're a real and unique human.

11:00Now, it sounds very complex, but we're already rolling this out around the world, right? More than 40 million users have a world ID, and 20 million, almost 20 million of those have a... verified with our device. And so, for example, today, actually in LA, the team is in LA at Zoom's conference, launching our integration with Zoom. And so this is what it looks like. When you go on a Zoom call going forward, and there's all sorts of financial companies that are our pilot customers, you will now be able to have a blue bash that proves, yes, it's indeed a real and unique person, and it's not a deepfake trying to be someone else. You can imagine. something similar happening all over the internet. We have an integration with Tinder and all sorts of partners.

11:48And I'm sure you have a lot of questions about this. ProofHuman is its own rabbit hole, but we won't spend a lot of time on it today. In fact, we'll have a session dedicated to it tomorrow. And so if you have questions, which I'm sure there's like lots of questions, I invite you to come. I'll be around at 3.50 p.m. tomorrow. But what I want you to take away of this is that in this new era, we need new signals, right? Those new signals, they are not the endgame. They are the beginning of a new paradigm and a new way of approaching fraud. And they enable things like starting to figure out reputation for users in a way that is lasting. And Tiago talked about any signal that starts in the digital world can eventually be faked.

12:34But there's one thing that can't be faked, and that's your history. or your reputation. You could argue with me, Brian, what if I go and pretend to be a good guy for three years? And I would say, well, I don't know, if you pretend to be a good guy for three years, maybe you're just a good guy.

12:51But we are building a system that allows us to understand and see this reputation across our customers so that we can allow Tiago's grandma to go to your website using an agent. Like statistically, all of our grandmases are, like, probably running, like, infected all over the place with malware and running, like, at least one residential proxy. And we need to be able to know, like, despite this looking like automation, we've seen her device, we've seen her IP millions of times before across thousands of sites. And maybe she even had to upload her passport or do a KYC or something before. And, you know, potentially we even see her account if the site decides to share it with us. So essentially we're... accumulating trust to tell us, you know, Tiago's grandma is good.

13:38And related, you know, Tiago, he is running 40 accounts. And we think programmatically that all of these accounts are controlled by the same person. So maybe we want to block them or restrict them or just otherwise prevent Tiago from opening new accounts. Essentially, Tiago in this scenario, like all bad actors, trying to avoid reputation. He's rotating proxies. changing features about his browser or server to look like he's coming at the site over and over as a new entity. And that's not to say lack of reputation is bad. Privacy conscious users on the internet also don't have a reputation. Children don't have a reputation. Which brings me to an important point that fundamentally risk and trust are different things and need to be measured differently. An analogy I like to give is like you're walking down the street, you see a stranger.

14:28The zero risk. or trust happens all the time your brain doesn't even register it you look one more time and they're holding a weapon like that's high risk i hope you run call the police and get to safety and you look one more time as like your spouse or your best friend so it's still weird that they're in the middle of the street with a weapon so it's high risk but it's somebody you trusted your whole life so it's also high trust so what you do in this moment like it's up to you personally but like i know i would and i think most of you would probably walk over to your spouse for your best friend and try to figure out what's going on and so the result of this like silly hypothetical you may not trust that person in the future but also you still may trust them and so that's a lot of words to say risk is a point in time assessment while trust is something you accumulate over time and if you want to accumulate trust over time you have to have some sort of stable identifier today that stable identifiers expressed in many ways.

15:27It can be an IP, a device ID. It can also be really cool things like the hash of this thing and the hash of this thing and the reputation of that over the last hour or the last seven days on Cloudflare's network. But all of this gets a lot more complicated with personal agents.

15:46Previously, the relationship between a user and a site was direct. So having these persistent identifiers that we can accumulate trust on or to report bad behavior on was straightforward, like the device, the IP, the browser, they all belong to the user. Agents act as an intermediary. So now multiple users can egress through the same place and they all look the same. We can't differentiate between user A and user B. We can just see mutes or dots. And while you may trust Meta or you may trust OpenAI, you don't necessarily trust every... user of Muse or every user of Dots, and so the site has been intermediated from the user. And it gets even more complex with multi -agents, which is a real thing today, like Instinct works with browser base.

16:36So in that case, the user is intermediated twice by Instinct and then by browser base. And this creates a lot of new problems for sites. First, the obvious one is that agents just allow a... user to scale themselves like beyond what most sites and businesses expect a user to be able to do so business that gives free cookies to every visitor is like suddenly finding itself broken when visitors can come every 10 minutes to get a new free cookie and in the case of like 100 users on your site using an agent of which two are bad you don't really have a strong mechanism to differentiate those two users from the other 98 good now in this scenario even if the agent operator says hey you can trust me like i will make sure i take care of those two users that even if that was true you still have a set of other problems that remain so one example is friendly fraud if you're not familiar with that term it's like i go buy an iphone then i do a chargeback saying i didn't buy the iphone and then i try to keep the money on the iphone the way sites deal with this today is via a dispute mechanism with the payment provider so example mastercard or visa will say yeah i know you say that brian but this is your ip and your device so we don't believe you you're not getting your charge back you can't do that if it's proxied through an agent also we have like risk -based authentication and human id verification they just break so if you're not familiar with those terms risk -based authentications this concept you

18:09see a lot in the financial sector that's just like a series of step ups so if you log into bank sometimes they might send you a one -time password if you look really really risky they might need you to call in or like upload some documentation but when users are all proxying through one agent we lose that ability to have this granular level of risk by user and then human id verification i guess technically it still works but that's a testing to control of the account this is brian really brian but that's not really like the thing we need to attest to in the age world. And for all of these problems I'm mentioning, the site bears all of the costs of this today.

18:50And so then what do sites do? They're phased with two options. The first one is to just lock everything down. Try to restrict all bots, don't have the downsides of it, and then hope that that's not a huge problem. And we've seen, for example, Amazon just did this. A bunch of banks starting with like JPMorgan Chase. started locking down their platforms because they haven't figured out how to deal with all these agents, right? Whether it's from a security perspective, a business model perspective, a lot of things are breaking down. The problem is that then that leaves all of us consumers that want our dot or our muse to just come buy something on Amazon or bank for us, not being able to do that, right? What is the alternative? Well, the alternative is for the website to ask for the user for more information, right? Whether it is explicitly, hey, give me all of this data about you.

19:39or behind the scenes in a way that may ultimately compromise privacy, there's this trade-off between data. And the problem is that when you are also requesting information, with that usually comes friction, which is also bad for the business. So it feels like a lose-lose. And at the end of the day, what we think about is just an optimization function. There is the more information you can request, you will be safer, but there will be more friction and you may lose users along the way. can request very little information and have a ton of growth but also a lot of fraud. And of course we think there is a sort of optimal point and there's an optimal point that yes you can do the math today but hopefully you can also start leveraging some new things right whether it is starting to think about new signals or a new mechanism and so this is where we propose something we call the Intermediation Principle.

20:35and this is like very simple like what we believe is that uh we the relationship between a site and a user should be restored rather than can be completely uh obscured by the uh by the agents we think that is in the best interest of everyone and so this way sites can allow the maximum access to consumers by making the more the most informed decisions uh wherever they end up falling in that curve and depending what your site is you will find a different place and that's sounds really nice, but it's actually a really hard thing to do. How do you enable such an intermediation? How do you keep that relationship between the users and the site? Well, we think there's three things that are missing. The first one is some sense of user identity, like understanding the website should be able to understand who is acting beyond just the agent ID. The second one is reputation.

21:22There should be a way to communicate trust. So my grandma can use her agent to do whatever. she wants, even if her home is full of infected devices. And then lastly, accountability, right? When someone does act wrong or you have a bad actor, how do you enforce policies on And now this is really not, this is not a new question or not even a new paradigm, right? Different parts of the internet have you similar principles to address a problem. So when you think about something like email, right? When I send you an email, you don't. receive an email from gmail you can email from tiago gmail.com right you know which specific user it is and maybe everyone's maybe in some cases that actually comes with some metadata right maybe you want to know my username or my photo depending on whether the user is willing to disclose it or the site needs it there is a sense of reputation right people can mark my emails as spam and as i do that um the the email providers start learning well what kind of a user i am right am i a trustworthy or not user and then ultimately if i am just like such a bad user well maybe my emails will start landing on spam or whatever policy the email provider has right and so this is something that in different corners of the internet um you can imagine cycles like this now when it comes to agents uh you again start thinking like well how can you solve this right how can you actually make this a reality and the first instinct is to use the tools of the past

22:54right or tools that we having different verticals and the problem with these are some of them break with AI others don't break with AI but they're just not the right tool for the problem so let's take captcha for example right like captcha very simple captchas they're obviously broken by AI more sophisticated captchas maybe they still work but at the end of the day what they prove is that a human was there once and that is not the problem because what hap the problem is what happens after the human was there time. Selfies we've talked about, they break. It's just really, really hard today to have a selfie that you can truly trust that is not AI or hasn't been modified in a way. And even things like identity verification or KYC, they're great tools, but for different problems. When you try to use them for this specific problem of knowing what is a real human and what is not, who is a person behind a bot, in that specific use case, it can break with AI.

23:45And so they're great. not for that specific problem. 3D Secure, that serves a similar purpose as MFA, but today, really, it's more about just a mechanism to transfer liability, which is, again, not what we're trying to solve here. MFA is still useful, but not the right problems. And then access controls, which is something that's proposed quite a bit. Come on, nobody's going to do that. If Agent A has a set of tight restrictions... restrictions, and can only do certain actions, and agent B is just YOLO mode all the time, like, guess which one consumers are going to use? They're going to use the YOLO agent. So you didn't really achieve anything except, like, cause one business to have a harder time when they're building their agent.

24:35So our solution must be a solution that gives maximum control to agents. And so we have a proposal. We call this trusted agent delegation. or TAD. And it's a framework to think about this. And we're bringing together different players in the ecosystem, agent builders, KYC providers, payment providers, specifically to help find the right mechanism to give agents more access without having the site unfairly bear all of the costs of that risk. And so TAD really tackles the three things that we talked about, right? Your identity, reputation. and accountability starting with identity well today we have web .off and all sorts of mechanisms to give an agent an identity right but what we believe is ultimately behind that you need that user specific whether it's application specific or session id that is provided by the operator by the agent right a muse or a dot or whatever your agent is it should provision any given user an identity that can be passed along the site to do that.

25:44Now, in some cases, sites may want an identifier that's actually provided by a third party, whether it's an enterprise use case, or it's just something like a world ID. And the cool thing, and what we imagine, is that with those identities can also come certain attributes, certain claims about the user when the user wants to share them and when the website needs them in privacy -preserving ways. And so if a website is really high risk and you need the security of something like the old. or Proof of Human that we were talking about today, that should be able to get passed along as part of that framework, right? If it is an age check, a country check, or any kind of signal that the site may need to make the decisions, that should be able to travel with that. And so, for example, and so at the end of the day, what you want is a certain level of scarcity, right?

26:32And that can be either guaranteed by the operator or by a third party like TFH. And we also still need a mechanism to manage. reputation or one way to do it is with a persistent identifier but like fundamentally we have to solve the problem of when 100 users are using use and two are bad like how at a minimum do we report those two users to muse so we need something persistent there's lots of ways we can do it it can be done in a privacy aware way if we are thoughtful and conscious about it or as talgo mentioned earlier sites will still get this information will just end up in the least private of all possible futures where they're getting it like through third parties or by building like these catalogs of user information that nobody really wants them to have. And finally, we need accountability. So when we report those to bad users, we need to trust that the agent operator will act.

27:22And this gives sites the ability to give maximum access to agents without bearing all of the costs that come from this new risk. So we're really excited to kick off the work on TAS today. We are finishing up a white paper that we'll be putting out shortly and for feedback from all of the ecosystem. And we'll be forming a working group of all sorts of players in this tree, as Brian mentioned, to figure out this new framework and start using it. And so what's next for Cloudflare on this? Well, first, if you're a site owner and you're not doing it already, generally our recommendation is to start allowing VerifyBots and Verified Agents, of course, the decision's up to your business concerns.

28:11Also, we will be updating our policy very shortly to change what it takes to be a Verified Agent and a Verified Operator at Cloudflare so that you have guarantees about the controls these agent operators have in place, and they make guarantees and show evidence that they're able to help you provide accountability to the users of that. agent um because ultimately as i keep repeating we like we need to make sure these agents have more access if we don't another agent will come along that just doesn't follow the rules and end users will use that one anyway and on the world id side of things what we're focused on is on continuing to uh explore these new kinds of signals that can give frameworks like this a lot more resilience and the thing that we're going to do is we're going to update our existing SDK that allows agent delegation to support uh to support TAP and so you can look out for that over the coming weeks and months and in general we're very excited to be working with Cloudflare to solve this really important problem of our times and uh but even more so to start hearing from all of you and all of the ecosystem of how can we solve this together