Cloudflare unveiled PACT, a privacy-preserving protocol to standardize how AI agents interact with websites by proving a human is in the loop, letting legitimate agents through while locking out abusive bots, with Google Chrome, Microsoft Edge, Mozilla Firefox, and Shopify signed on as participants. Shopify’s Ilya Grigorik pitched PACT as a way for merchants to distinguish real shoppers and authorized agents from abusive traffic without subjecting buyers to friction or invasive tracking, arguing every extra challenge or false positive risks turning a purchase into an abandoned cart. Private Access Control Tokens would let sites with strong knowledge of “personhood” issue anonymous tokens a browser can present elsewhere to prove a human is involved, without enabling tracking. The protocol isn’t rolling out yet and has no announced timeline, though it positions Cloudflare’s infrastructure at the center of agentic-web trust.
