Cloudflare Gives AI Agents Wallets, Raising Identity Questions

Cloudflare announced on August 4 that it will provide AI agents with their own digital wallets and persistent identities, enabling autonomous software to hold stablecoins and conduct online transactions within owner-defined parameters.

The infrastructure company's shift represents a fundamental change in how the web handles bot traffic. Rather than blocking automated systems, Cloudflare now aims to distinguish legitimate agents from malicious ones through identity verification.

The human verification gap

While Cloudflare's cloudflare.pay address identifies which agent is making a transaction, industry observers say the system stops short of solving the core problem: establishing accountability to a real person.

"Agent identity, for the agent themselves, is important," Kenneth Shek, chief executive of Moca Network, an Animoca Brands identity project, told Forbes. "But our point of view is what's even more important is the human behind the agent."

Erika Maslauskaite, chief executive of European digital identity startup AlongID, emphasized the fraud risk. "Behind every agent you would need to verify who's acting," she said. "With AI currently, you can fake everything."

Why it matters

Agent-to-agent transactions may overtake human commerce within six to twelve months, according to Varun Kabra, chief growth officer at blockchain firm Concordium. Without standardized human verification, financial institutions are blocking AI agents entirely—banks cannot confirm whether accountable humans authorize agent transactions, creating fraud exposure. As Animoca Brands co-founder Yat Siu projects up to 100 billion agents operating globally, with individuals managing hundreds each, the authentication infrastructure must scale rapidly or risk fragmenting digital commerce.

The traffic explosion ahead

The volume of agent activity Moca Network is preparing for vastly exceeds current web usage. Shek estimates humans visit 100 to 150 web pages daily, while a single agent could visit thousands. He includes current ChatGPT and Claude users in his count of future agent traffic.

Animoca's Yat Siu reported operating 280 agents personally and predicts individuals will eventually manage at least 500 agents each, with global deployment reaching 50 to 100 billion agents minimum.

Banks have responded by blocking AI agents from customer accounts. Kabra explained the reasoning: "The counterparty on the other side, the airline in this case, or the ticketing platform, whatever it is, they have no way to verify whether a real accountable human is behind the transaction."

Competing standards

Moca Network advocates for W3C verifiable credentials—signed attestations users carry across sites. The approach aims to shift data control from platforms to individuals, letting users actively share information between websites rather than having companies like Google, Meta, and Apple control consumer data centrally.

Europe's eIDAS 2.0 regulation requires member states to issue digital identity wallets by the end of 2026, potentially accelerating adoption. However, standardization remains elusive, with Google and OpenAI pushing rival agent-commerce protocols while Cloudflare builds on its own Web Bot Auth system rather than W3C credentials.

Shek illustrated the practical need with a personal example: after his wife was hit by a car, an agent handling insurance and medical claims would need verified access to her records, insurance eligibility, and medical history—all tied to credential identity. Without that link, the software must repeatedly ask for human verification.

The details were first reported by Forbes contributor Boaz Sobrado.