Cloudflare has unveiled a new security system called ‘Precursor’ to detect fake AI bots on websites. This technology analyzes users’ mouse movements, typing patterns, and scrolling behavior to distinguish between humans and robots. According to the company’s CTO, Dan Nekhet, “Robots move the mouse in a very straight, smooth, and overly precise manner, making them easy to spot quickly.” On June 14 in Kathmandu, Cloudflare launched Precursor to identify fake software or AI bots visiting websites. Currently, this system is available only to those using Cloudflare’s ‘Enterprise Bot Management’ plan. Its primary goal is to reduce the CAPTCHA puzzles users encounter when opening websites, meaning fewer photo-selection or code-entry CAPTCHAs and an easier website experience.
Unlike traditional methods that verify if a user is a robot during login or transactions, Precursor continuously monitors user activity on websites to determine if they are human or bot. How does it differentiate humans? Precursor analyzes web behavior such as mouse movement patterns, scroll speed and method, typing speed, copy-paste styles, whether the page remains open on the screen, and keyboard activity when clicking boxes. Through this comprehensive analysis, Cloudflare asserts that it does not record any personal data. The system observes only the typing speed and style, not the content of keystrokes like messages or passwords.
Previously, robot checks occurred only during CAPTCHA challenges or login; now, behavior is assessed during website use. Cloudflare developed this technology in response to increasingly sophisticated AI bots that can browse normally and sometimes bypass simple CAPTCHA puzzles. Precursor aims to stop such bots. According to Cloudflare, no bot can mimic human behavior continuously for a prolonged period. Humans do not move their mouse strictly straight; they occasionally waver, shift the pointer slightly off buttons, change direction, and exhibit variable speed. Dan Nekhet explained, “People sometimes move the mouse erratically or at varying speeds, whereas bots operate the mouse in a perfectly straight, smooth, and precise manner, making them instantly recognizable.” Website owners can easily enable this feature from their Cloudflare dashboards. Once activated, a small code is automatically added to website pages without further action from the operator. This code collects signals from user activities and temporarily stores them securely before sending data to Cloudflare’s main servers. Based on this information, Cloudflare performs security assessments and takes appropriate actions.
