Cloudflare: AI agents drain site budgets

The economics of a web page visit have always been a little lopsided, but Cloudflare CEO Matthew Prince thinks AI agents are about to tip the balance hard enough that some site operators want nothing to do with them at all. On the company's third quarter earnings call, Prince described a customer base split between those chasing agentic traffic and those who regard it as a direct cost with no upside. Beneath the optics and the revenue numbers lay a string of warnings about how automated browsing and a steady drumbeat of software flaws are reshaping the assumptions website operators run on.

A thousand menus, one diner

Prince illustrated the complaint with a hypothetical drawn from his own life: an agent dispatched to find him a restaurant after a day of investor relations duties.

In his telling, the agent would scour the internet, examine the sites of 1,000 different restaurants, and pull down 1,000 different menus — after which he might pick just one place to eat. The other 999 establishments, he said, have absorbed a cost that has simply been applied to them, without receiving any benefit in return.

He acknowledged that ordinary web searches have always produced some low-value traffic. What has changed, in his view, is the sheer volume of agentic activity, which Cloudflare has previously predicted will be one thousand times greater than clicks from humans. That shift in scale, he argued, moves the problem into different territory entirely.

“The problem is that 999 of those restaurants have now had a cost that is just been applied to them, but they are not getting any benefit.”

— Matthew Prince, CEO of Cloudflare

Customers who want bots kept out

The restaurant example was not merely rhetorical. Prince said some of Cloudflare's own customers believe AI agents are "a bane to their business and want to keep them away." The company, for its part, sells products that can block agents outright, soften the cost and traffic impact of agentic requests, or let organizations monetize the traffic that AI generates.

Demand for that portfolio, Prince claimed, is climbing quickly. Since July 1st, he said, approximately five percent of the web has opted in to Cloudflare's content protection products. He named Meta as an existing customer, and predicted that the company's new "Muse" agents would end up benefiting Cloudflare, on the logic that more agentic traffic gives third parties more reason to want it tamed.

The commercial picture he painted is one where the same phenomenon that frustrates site owners becomes a recurring revenue line for the intermediary sitting between them and the bots.

Containers declared cooked

Prince also used the call to take aim at Kubernetes devotees, suggesting containers may become another casualty of the agentic age. He conceded that containers represent "a significant improvement over bare metal or even virtual machines," and credited them with fueling the growth of hyperscale clouds and mobile applications.

Even so, he argued the model is already past its useful peak. "The container-based architecture of the hyperscalers and neoclouds just can't keep up in a cost-effective way with the new agentic paradigms of today." He tied that claim back to the same 1000:1 ratio of bot traffic to human traffic that Cloudflare expects to see online.

The pitch that followed was unmistakably Cloudflare-centric: Prince positioned the company's serverless Workers service as the alternative to containers. It is worth reading the container critique with that framing in mind, since the CEO was making the argument on an earnings call where every product mentioned doubles as a sales message.

The PHP2SHELL question

The call's security discussion was pointed. Prince said nation-state actors and criminals likely exploited the PHP2SHELL vulnerability before it was publicly disclosed, describing the class of flaws it belongs to as having been present in the wild for years.

He said Cloudflare is going back through its logs to look for evidence that hackers, nation-state actors, or others had been using the vulnerabilities in the past, and stated plainly that he expects the effort to surface examples.

“These vulnerabilities, like the PHP vulnerabilities that were disclosed the other day, had been in the wild for years.”

— Matthew Prince, CEO of Cloudflare

Prince's claim that exploitation preceded disclosure is an assertion made on an earnings call, not a published incident report, and the details of what Cloudflare's log review turns up have not yet been made public.

No end to the flaw flood

The broader security outlook Prince offered was bleak. He said the volume of newly reported vulnerabilities over the preceding weeks might make it seem as though the sky is falling, and added that he wished he could say the worst was behind the industry.

“It may seem like the sky is falling with the number of new security vulnerabilities that have been reported over the last few weeks. I wish I could tell you we were through the worst, but we're not.”

— Matthew Prince, CEO of Cloudflare

Prince framed that misery as a business opportunity. Because of the breadth of Cloudflare's activities and its client base, he argued the company is among the first to receive quiet disclosure of new vulnerabilities, and remediates them before they are disclosed publicly.

The numbers behind the pitch

The earnings call supplied a set of figures that sit behind Prince's various arguments:

• $782.5 million in quarterly revenue, a record for Cloudflare
• 39 percent year-on-year revenue growth
• Five percent of the web opting in to Cloudflare's content protection products since July 1st, per Prince
• A predicted 1000:1 ratio of bot traffic to human traffic online
• An agent evaluating 1,000 restaurant sites to serve a single diner's choice
• Cloudflare shares up around 15 percent in after-hours trading

Investors evidently found the story coherent. The after-hours gain of roughly 15 percent recovered, and then improved on, losses the stock had taken earlier, after major US indices dropped around four percent on concerns that tech stocks are overvalued.

Where the cost lands

Strip away the product positioning and the call sketched out a practical problem for anyone running a content-heavy website. A single user query can now generate a thousand page fetches, and the sites serving those pages pay for bandwidth, compute, and infrastructure without any guarantee of a visit, a click, or a sale.

Prince's answer is that site operators will increasingly choose between three postures: blocking agents, absorbing their traffic with mitigations in place, or charging for the access. Each of those requires a gatekeeper positioned in front of the site — which is precisely the role Cloudflare is selling. Whether the five percent opt-in figure since July 1st represents a durable shift or an early spike is something the company's future quarters will have to show.

On the infrastructure side, the container argument matters most to organizations that have built their operations around Kubernetes and the hyperscale model. Prince's contention that this architecture cannot keep pace cost-effectively with agentic workloads is a claim from a vendor with a competing serverless product, and the 1000:1 traffic projection underpinning it remains a forecast rather than an observed measurement.

What this means for site operators

The practical takeaway for businesses running public-facing websites is that agentic traffic is being treated by a major infrastructure provider as a permanent cost line rather than a passing nuisance. If Cloudflare's projection of a thousandfold gap between bot and human requests holds, the billing consequences for content sites could arrive well before any commercial upside from being discovered by an AI agent. That suggests operators may need to think about who is allowed to fetch their pages, and on what terms, rather than assuming all traffic is good traffic.

For security teams, Prince's remarks point at a different kind of exposure. His expectation that Cloudflare's log review will find evidence of PHP2SHELL exploitation before disclosure implies that patching on the public timeline may already be too late — a possibility that, if confirmed, would make quiet pre-disclosure remediation arrangements more valuable than ever, and would also concentrate that advantage among organizations large enough to receive early warnings. The claim itself is still just that: an expectation voiced by a CEO, with the log review's findings not yet disclosed.