AI agents are beginning to book, pay, call businesses and operate accounts without their users ever seeing the websites involved. That shift is forcing the web to add a second layer beneath its human-facing pages: machine-readable actions, identity, permissions and payment rules for software acting on our behalf.
An AI agent trying to get a dinner reservation recently sent roughly 200 requests an hour to Resy while monitoring for an opening at one of New York’s hardest-to-book restaurants. Resy did not see a tireless digital concierge working for a customer, but an automated activity severe enough to suspend the customer’s account. That small clash captures a much larger problem emerging across the internet.
The web was built around people moving at human speed. A person searches, opens a page, scrolls, clicks, fills a form and eventually buys something. An AI agent may perform the same task hundreds of times faster, revisit a service continuously and interact with several sites at once, while still acting for a real person with a legitimate goal.
This change is arriving rapidly enough to alter who, or what, the internet is built for. Personal agents including Meta’s Muse and Instinct can already browse websites, handle accounts, call businesses and complete transactions, while browser-control systems are making the mechanical act of navigating the web faster and cheaper.
The old distinction between humans and bots is becoming less useful
Cloudflare has already seen the traffic balance change on its own network. During the company’s second-quarter earnings call, CEO Matthew Prince said non-human traffic had overtaken human traffic in May 2026, much earlier than Cloudflare itself had expected. He added that, if current trends continued, non-human traffic could become as much as 1,000 times larger than human traffic within five years.
The figure is striking, but the category matters more than the headline number. “Non-human” traffic includes conventional crawlers, security tools, automated scripts, malicious bots, AI training crawlers and real-time agents acting for users. An indexing bot that helps a page appear in search is economically very different from a scraper that copies content for model training, and both are different again from an agent trying to renew a customer’s subscription or buy a product on that customer’s behalf.
Cloudflare’s AI traffic controls classify automated activity separately as Search, Training or Agent traffic. Since September 15, new domains can allow search while blocking training and agents on advertising-supported pages, and site owners can change those rules independently. The web is therefore moving away from a simple question (is this visitor human?) toward a more operational one: what is this software trying to do, and should the site permit it?
Websites are beginning to expose actions rather than just pages
Today’s browser agents often work by imitating people. They read the page structure, identify a button, decide what it probably does and then click it. That approach is powerful but brittle. A redesigned page, a modal window or an ambiguous form field can break the sequence because the agent must repeatedly infer meaning from an interface intended for human eyes.
Chrome’s experimental WebMCP work proposes a different model. A website can explicitly register tools describing what an agent is allowed to do. A booking service, for example, could expose a structured booking action instead of forcing the agent to inspect the page, locate a button and recreate the same workflow visually. For the person, nothing necessarily change, there can still be a normal website. For the agent, the same service becomes closer to a programmable interface.
That distinction could gradually create two versions of the web within the same infrastructure: a visual layer optimized for people and an operational layer optimized for software.
The financial plumbing evolves in parallel
Stripe launched the Machine Payments Protocol in March as an open standard for agents and online services to coordinate payments programmatically. It supports use cases including microtransactions and recurring payments, allowing agents to pay without navigating a checkout designed around a person entering card details.
The same idea is now being applied directly to access on the web. In June, Stripe and AWS announced a system in which an AI agent requesting protected content can receive an HTTP 402 “Payment Required” response containing machine-readable prices, payment options and licensing terms. Instead of reaching a paywall intended for a reader, the agent can negotiate and pay for access itself.
Meta says Muse can browse sites, fill forms and request approval before purchases, while Stripe’s Link can generate controlled payment credentials for the agent. Instinct has meanwhile added its own email addresses for account management and a concierge feature capable of calling businesses.
That creates a conflict with the economics of the human web
Much of the commercial web was built around attention. Publishers display advertising because a person is expected to land on the page. Retailers design storefronts because browsing can influence what a customer ultimately buys. Travel, comparison and marketplace businesses often depend on being the interface through which the user experiences the transaction.
An agent can separate the transaction from that interface. If it finds a flight, compares a dozen insurance products or retrieves information from a publisher without presenting those pages to its user, the underlying service may still incur the cost of serving the request while losing the impressions, upsells or advertising that previously paid for it.
Cloudflare’s September defaults make that conflict unusually explicit. On pages containing advertising, it recommends allowing Search but blocking Training and Agent traffic unless the owner chooses otherwise. Its reasoning is straightforward. An ad-supported page was economically designed for someone to arrive and see the advertisement. Now, a website may want AI agents because they can bring customers, but not if those same agents consume the valuable part of the service while bypassing the mechanism that pays for it.
The next problem is proving which agent should be trusted
Once automated visitors can act for customers, blocking them indiscriminately becomes increasingly difficult. Cloudflare has been developing cryptographic mechanisms such as Web Bot Auth and signed-agent classifications to help sites identify automated clients more precisely. It is also working with browser makers and Shopify on Private Access Control Tokens, a privacy-oriented approach intended to distinguish legitimate humans and authorized agents from abusive traffic without forcing every visitor through invasive identity checks.
Identity alone will not solve the problem. A trusted agent still needs limits. The fact that software is legitimately acting for a customer does not mean it should be able to send unlimited requests, make an irreversible purchase or access every part of an account.
The web is not disappearing. It is gaining another audience
The framing of an internet increasingly dominated by agents captures the scale of the shift, but it can easily be taken too literally. Humans are not leaving the web, and webpages are unlikely to vanish. Images, editorial presentation, branding and navigation still matter when people are the audience.
What is changing is that websites have to serve someone else as well. An agent does not necessarily need a homepage. It needs to know what actions exist, which ones it is authorized to perform, what they cost and how it can prove that it represents a legitimate user.
The web spent three decades optimizing what people can see and click. Its next layer is being built around what their software is allowed to do.