Cloudflare Sits in Front of the Agents. That Does Not yet Make It a Paid Gatekeeper
More than half of the request traffic on Cloudflare's network is no longer from people, and the company has shipped controls and payment rails meant to charge the callers. First revenue from those Act 4 products arrived in the third quarter without a disclosed dollar amount.
Spreadsheet & IC Deliverables: NET 1-sheet Income Statement (.xlsx) exports are free on /model; Full Access unlocks all software stock ratings, full financial models, and the Master Ratings Workbook (.xlsx).
- Hold off, conviction 3 of 5 - -$243.4M Owner cash after all capex and stock pay (trailing twelve months to Sep 30, 2026, our calculation) - 82.9% Stock pay as a share of operating cash flow (same period, our calculation) - 122% Dollar-based net retention (three months ended Sep 30, 2026)
1. Verdict and the question this piece answers
Verdict: Hold off, conviction 3 of 5. The question is not whether machines now generate a large share of requests on Cloudflare's network. Management says they do.
The question is whether that traffic makes Cloudflare a paid gatekeeper: a company that can identify an agent, decide whether to let it in, charge it, and turn that position into cash for outside owners.
The third-quarter print answered the growth half of that question and left the cash half open. Revenue was $782.5M, up 39%, the fastest growth in nearly four years [1][2].
Dollar-based net retention rose to 122% [3][9]. Management said it recorded the first revenue from Act 4 products, the internal name for tools that charge for agent traffic and content access, and it did not disclose the dollar amount [9].
Over the same twelve months, stock pay of $565.4M absorbed 82.9% of $681.7M of operating cash flow, and owner cash, meaning operating cash flow less purchases of property and equipment and capitalized software, less stock pay, was -$243.4M, our calculation [1][7][8]. It was negative in each of the last three full years and widened again on a trailing basis
2. What Cloudflare said, and what the counters actually count
The original forecast lives on Cloudflare's second-quarter 2026 earnings call, held Aug 6, 2026. Matthew Prince, the co-founder and chief executive, said a team told him in May that "non-human traffic is now passed human traffic online," after earlier internal work had pointed to the second half of 2027 and then the first half of 2027 [17]. He then gave the projection that later traveled into the conference clip, with his own caveat attached: "with the big caveat that I have called it wrong at every point along the way, if the current trends continue, we think in five years, non-human traffic will be as much as 1,000 times as much as human traffic" [17].
He added that human traffic need not fall for that to happen, because non-human traffic is growing so fast that "humans will be a rounding error on the Internet" [17]. On the same call he said that, for the first time, more than 50% of the traffic flowing across Cloudflare's network in the second quarter was not human [17].
That wording matters. The observed crossover was described as non-human traffic on Cloudflare's network, not as a census of every packet on the public internet, and not specifically as agentic traffic.
Non-human traffic includes malicious scanners, price scrapers, classic search crawlers, training crawlers, feed fetchers, and agents acting for a person [10][15][17]. Agents are one slice of that mix.
3. The control layer: who may enter
The first product job is not charging. It is telling a site owner what arrived and letting that owner set terms.
Cloudflare now sells that job as AI Crawl Control, with a taxonomy that splits automated visitors by what they came to do rather than by a single model-crawler label [15].
On Jul 1, 2026, the company replaced a single "Block AI Bots" switch with separate Search, Agent, and Training controls, available on every plan, including Free [15]. Search means a visitor that indexes content so it can answer questions later.
Agent means automated behavior acting, usually in real time, on a person's behalf. Training means a crawler taking content to train or fine-tune a model [15].
Many well-known crawlers do more than one of those jobs. Cloudflare's stated preference is that operators split those jobs into separate crawlers so a site can allow one and refuse another [15].
On Sep 15, 2026, new domains began to see recommended defaults that block Training and Agent on pages that display ads and leave Search allowed, on the logic that an advertisement pays when a person sees it [10][15]. The same week, the company shipped Disallow AI Training, a control meant to keep a site indexed for search while instructing the operator not to use the data for training.
The company said Apple, Google, and Microsoft have committed to honor it
4. The payment layer: three products, three ways money is supposed to move
Cloudflare is not shipping one toll. It is shipping three products that settle in different ways, sit at different stages of availability, and answer different questions about who pays and who collects.
None of the three discloses a take rate.
Pay per crawl, launched in private beta on Jul 1, 2025 and still described as a closed beta in Cloudflare's developer documentation as of the Jul 28, 2026 documentation update, is a feature of AI Crawl Control [12][13]. A site owner sets a price per zone and then allows, charges, or blocks each crawler [12].
The minimum price is $0.001 per successful content retrieval, meaning an HTTP 200 response [14]. Cloudflare acts as the merchant of record and provides the technical infrastructure [12][13].
The crawler pays. Cloudflare aggregates the charges and pays publishers monthly through a dedicated Stripe Connect account created in the Cloudflare dashboard; existing Stripe accounts are not compatible [19].
If a crawler has no billing relationship with Cloudflare, a publisher can still mark it "charge," which then functions like a network-level block, returning an HTTP 402 or the practical equivalent of a 403, with a signal that a paid relationship could exist later
5. Traffic is not revenue, and revenue is not owner cash
The third quarter is the right place to test whether the traffic story is already showing up in the accounts. It shows up clearly in growth.
It shows up as a cost. It does not yet show up as a disclosed toll.
Revenue of $782.5M was 39% above the year-ago quarter and well above the $736M to $737M guide [1][2]. Nine-month revenue reached $2,118.3M, up 36.4% [1].
Large customers paying more than $100,000 a year reached 5,006, up from 4,009, with 308 added in the quarter [3][9]. They contributed 75% of revenue, up from 73% a year earlier [9].
Remaining performance obligations were $2,876.8M, up 34%, and current remaining performance obligations grew 37% [1][2][9]. The fourth-quarter guide of $845.0M to $846.0M implies about 38% growth, and the full-year raise to $2,963.0M to $2,964.0M implies about 37% [2]
6. The toll-gate test
A paid gatekeeper should own the record that decides entry, own the connection the visitor must use, price close to the outcome the visitor came for, and spend its research budget on the gate rather than on extra features around it.
Owns the record: partial. Cloudflare holds the routing, the security policy, the traffic logs, and the identity checks on bots and agents for sites on its network [3][12][15].
Pay Per Use adds a second kind of record: usage reports and the billing file that turns those reports into monthly settlement [11]. Monetization Gateway is thinner on this test, because the payment itself is authorized to the seller's wallet and settled through Coinbase [6][20].
Cloudflare sees the handshake and enforces the rule. It does not, on the public description, hold the customer's business record.
Orders, accounts, and the underlying content stay with the origin [5][6].
Owns the connection: pass, inside the installed base. Every request to a protected site passes through Cloudflare before it reaches the origin, and both pay per crawl and Monetization Gateway can answer with HTTP 402 before the origin does any paid work
7. What would change the call
Hold off, conviction 3 of 5, unchanged. The Baron conference clip does not add an independent measurement, and it does not change the accounts.
Prince's own third-quarter remark that he would take the under on a five-year, 1,000-to-1 agent count raises the chance that machine traffic grows even faster than last quarter's already aggressive projection [9]. Faster traffic without a disclosed payment stream is not a reason to become more constructive.
It is a reason to track unit cost more closely.
The case for standing aside is the same case as after the print, now with a clearer map of the products. Owner cash has been negative every year we measured and widened to -$243.4M on a trailing basis [8].
Gross margin is 71.2% as network and third-party technology costs outgrow revenue [1][2]. Stock pay rose in dollars in the first quarter after a workforce reduction of about 20% [3].
Act 4 revenue is real enough to mention on the call and still too small, or too sensitive, to disclose [9]. The three charging products are in beta or closed beta [6][11]
A Nov 6, 2026 clip from the 33rd Annual Baron Investment Conference in New York put the traffic claim in front of a wider audience [16]. Elon Musk said, "my understanding is that actually agentic, uh, internet traffic already exceeds, uh, human traffic. If I read that correctly from Cloudflare," and, "I believe Cloudflare ... predicted ... that in five years, agentic AI traffic will be a thousand times more than human traffic," and, "if anything, I think that is underestimating" [16].
Those are his qualifications, not an independent measurement, and not Cloudflare's own wording in every respect. The caption on the post that circulated the clip compressed the remark and dropped the hedges [16].
Our view: Cloudflare is well placed to sit between superintelligence agents and the open web, and the third quarter strengthened that position. Sitting there is not the same as collecting a disclosed toll.
Traffic growth is evidence. A payment product in beta is evidence that the company is trying to charge.
First Act 4 revenue is evidence that someone paid something. None of that is evidence that the toll is large, that Cloudflare keeps a meaningful share, or that owners have been paid after stock pay.
On the third-quarter call, held Nov 5, 2026, Prince restated the year-ahead claim more narrowly, saying he had predicted last quarter that "within five years, agents would outnumber humans online 1,000 to 1," and that a quarter later he would "take the under on the timing of that bet" [9]. "Outnumber" can be read as a count of agents rather than a multiple of request volume.
The second-quarter wording was about traffic volume. The two statements point in the same direction.
They are not the same measurement.
Cloudflare's later product writing is more careful about the slices, and it is still not a public, audited traffic study. A Sep 30, 2026 company blog said average HTTP requests on the network had risen from 63 million a second at the end of 2024 to 115 million, with peaks above 150 million; that daily requests from agents grew more than 1,700% over the prior year; and that, for the first time this year, more than half of internet traffic was not human [10].
It also said the fastest-growing part of automated traffic is no longer crawlers but agents, software fetching pages on a person's behalf, often after someone asked a chatbot a question [10]. Training, by the crawlers' stated purpose, rose from 22% of the crawler requests Cloudflare saw in spring 2025 to 52% by June 2026 [10].
In some heavily crawled categories, including retail, computer software, IT and services, and financial services, the same post said human traffic had declined as much as 40% in less than a year [10]. Those figures are Cloudflare's observations on Cloudflare's network.
Management has said more than 20% of the web sits behind that network [10][17]. The other side of the market is concentrated too: the same writing said nearly 80% of leading model companies sit there as well [10].
The public Radar charts that often get quoted as "bots have passed humans" are narrower still. Cloudflare's Radar glossary, updated Oct 12, 2026, says a request with a bot score from 1 to 29 is classified as likely automated, and a score of 30 or above as likely human [18].
By default, Radar shows that split for requests to HTML content, "to represent traditional web traffic by excluding API calls, asset requests (images, scripts, fonts), and other machine-to-machine requests" [18]. A chart of HTML page requests is not a chart of all HTTP requests, and a request is not a byte of bandwidth.
An agent that asks for a stripped markdown page and an agent that downloads a video do not impose the same cost, even if both count as one request. Prince himself has said the underlying data can be messy [17].
On the second-quarter call he also offered a directional, "not audited" figure of about 0.5 billion requests a second when sketching how large a payment rail might need to be [17]. That illustration does not match the 115 million average in the later official blog [10].
We use the written blog figure for observed request volume and treat the larger call figure as an unaudited illustration, not a measured run rate.
The economic point of the distinctions is simple. If all bots have already passed humans on one HTML counter, that does not prove agents have passed humans, and it does not prove Cloudflare gets paid either way.
If agents later become 1,000 times human traffic, the cost of carrying them arrives whether or not anyone pays. Prince said as much: 1,000 times the traffic means more bandwidth and more servers, "and someone has to pay for it" [9][17].
He also said Cloudflare blocks malicious traffic, and traffic that is unwanted given a customer's business model, without charging the customer extra for the blocking [17][9]. More machine traffic can therefore show up as a security feature the company gives away, as a compute load on Workers, or as a billable event.
Identity is the weak joint in any paid gate. A price is worthless if the caller can pretend to be someone else, or refuse to say who it is.
Web Bot Auth uses HTTP Message Signatures so an operator can cryptographically sign requests [12]. Cloudflare says operators including OpenAI, Google, and AWS sign agent requests this way, and that it sees more than 500 billion verified bot requests each week [10].
Against an average of 115 million HTTP requests a second, that verified slice is a small share of total requests, our calculation from the company's own figures [10]. Most machine traffic is still something other than a named, signed visitor.
Enterprise Bot Management customers also get BotBase, a directory of known bots and agents with behavior labels that now include search, agent, training, and transaction, among others [15]. For pay per crawl, existing WAF and Bot Management blocks override the "charge" setting: a blocked crawler does not reach the paid door [13].
This layer passes the connection test for sites that already sit behind Cloudflare. A request to a protected site still has to pass the company's network in more than 335 cities [3].
It does not pass that test for the rest of the web, and it does not stop a customer from leaving. On the third-quarter call, Prince said that, based on third-party data, Cloudflare added about 5% of the entire web to its network between Jul 1 and the earnings date [9].
That is a management claim about share of sites or traffic, not a line in the financial statements. It supports the idea that more publishers can, in principle, flip these switches.
It does not tell us how many of them charge, or what they collect.
Cloudflare has not disclosed what share of each charged crawl it keeps.
Pay Per Use, put into beta on Sep 30, 2026, does not charge for the fetch. It pays when a buyer later reports that it used the content [11].
A model company defines the use it will pay for, such as returning an excerpt in an answer or letting a review shape a shopping recommendation, and it offers a price [11]. Publishers accept or decline each offer in the dashboard.
The buyer then self-reports each use through one API, and Cloudflare bills the buyer and pays publishers monthly through a connected payment account [11]. Cloudflare says program terms require complete reporting and that it checks whether each reported use maps to an enrolled publisher [11].
The economic design is closer to an outcome than a raw request: a page might be crawled once and used many times, or crawled often and used never. The integrity of the rail depends on the buyer's reports.
Cloudflare has not disclosed a take rate, named the participating buyers in the documentation we reviewed, or published transaction volume.
Monetization Gateway is the product closest to a paywall for any caller, not only a named crawler. It was announced on Jul 1, 2026 and opened as a closed beta on Sep 30, 2026 to eligible buyers and sellers based in the United States [5][6][20].
A seller writes a rule that matches a URL, header, query string, or other request attribute, chooses an audience of everyone or verified bots, and sets a fixed or variable price [6][21]. The minimum settlement is $0.001 and the maximum price is $100 per request [21].
When a request matches, the gateway returns HTTP 402 Payment Required using the open x402 protocol. The buyer signs a payment authorization and retries; the gateway verifies the authorization, the origin produces the response, and settlement runs through Coinbase's x402 Facilitator on the Base blockchain in USDC [6][20].
The receiving wallet is the seller's. In the July announcement, Cloudflare said settlement happens peer to peer, so funds a buyer sends are deposited directly to the seller's wallet [5].
The company has not disclosed a Cloudflare fee or take rate on those transfers, and it has not said whether Coinbase's facilitator fee, if any, is passed through. Production examples named on the beta blog include Cloudflare's own AI Gateway, which can accept an x402 payment header for inference; Ceramic.ai, which sells web search to agents at a fixed price without an API key; Stocktwits, which sells individual market-signal requests; and API2PDF, which uses variable pricing for document generation [6].
Those are proof that the handshake works for someone. They are not a disclosed volume figure.
Two supporting names appeared on the second-quarter call and are easy to confuse with live products. Prince said the company had announced Wallets, "which will offer a way for buyers to pay autonomously through their agents," and cloudflare.pay, "which will provide merchants and buyers an agent-friendly means to identify themselves and establish trust" [17].
We did not find current public documentation that confirms general availability or pricing for those two names as of Nov 6, 2026. They remain announced building blocks, not measured cash lines.
Workers sits beside the toll, not inside it. It is the usage-billed developer platform on which agents themselves can run.
Management said active developers passed 10 million in the third quarter, more than double the start of 2026, and that paying customers added more than 158,000 in the quarter, up 110% year over year [9]. Workers charges when code runs [9][17].
That is a real, disclosed growth engine, and it is a different customer relationship: the builder of the agent pays Cloudflare for compute, storage, and related services. The OpenAI research pilot described on both the second-quarter call and the third-quarter call is closer to this side of the ledger than to a publisher marketplace.
Prince said Cloudflare can tell a crawler when a page has changed so the crawler does not fetch everything again, that this already produces "significant amounts of revenue," and that "OpenAI is paying for that" [9][10][17]. A model company paying Cloudflare for a more efficient crawl is not the same as a crawler paying a publisher through pay per crawl, and it is not the same as Cloudflare taking a cut of that publisher payment.
.
Channel partners grew faster than the company as a whole, to $247.4M, or 32% of third-quarter revenue, up 65% [3]. Partner mix usually means less direct control of the customer, which matters if the long-term story depends on Cloudflare setting the terms at the door.
The cost of carrying more work also showed up. GAAP gross margin was 71.2%, down from 74.0% a year earlier and from 71.8% in the second quarter [2][23].
Cost of revenue rose 54% in the quarter against 39% revenue growth [1][2]. For the nine months, cost of revenue rose 55%, driven by $104.0M of higher third-party technology services costs, $55.9M of colocation, network, and bandwidth costs, and $31.8M of depreciation from more servers [3].
Purchases of property and equipment plus capitalized software were $133.3M in the third quarter, or about 17% of revenue, and the company's own free cash flow was $82.1M, or 10% of revenue, down from a 13% free-cash-flow margin a year earlier [2]. Network capital spending was 15% of revenue in the quarter, against a full-year expectation of 14% to 15% [9].
Seifert, the chief financial officer, said on the second-quarter call that the important metric is total unit economics across products, because gross margin behavior differs by product, and that Workers carries a lower gross margin but a much lower cost to book [17]. On the third-quarter call he pointed to that mix as a reason operating margin expanded even as gross margin declined [9].
GAAP profitability, which management now expects in the fourth quarter, and owner cash are different tests [9]. The first can clear while the second stays negative.
Owner cash is the test we use. Operating cash flow for the twelve months to Sep 30, 2026 was $681.7M.
Purchases of property and equipment plus capitalized software were $359.7M. Stock pay was $565.4M.
Owner cash was -$243.4M, our calculation from the fiscal 2025 Form 10-K and the 2025 and 2026 Forms 10-Q [1][7][8]. The same measure was -$154.5M in 2023, -$171.6M in 2024, and -$190.9M in 2025 [7][8].
In the third quarter alone, owners lost about $85.5M after capex and stock pay, our calculation from $215.4M of operating cash flow less $133.3M of capex and capitalized software less $167.6M of stock-based compensation expense [1][2]. The nine-month figure has distortions that partly offset.
Restructuring cash payments of $123.0M lowered operating cash flow [3]. Interest income on corporate cash and securities was $125.5M, and deferred revenue from customer prepayments rose $190.9M [1].
Strip the interest and the prepayment build, as our standard requires, and the nine-month figure is deeper in the red.
Act 4 does not yet change that math, because there is no disclosed dollar figure to put in it. Prince said the company recorded its first Act 4 revenue in the third quarter and that he expects to talk more about it in coming quarters [9].
Asked when those products become "real dollar amounts," he described two paths: the crawl-efficiency work that he said is already producing significant revenue from companies such as OpenAI, and micropayments that he does not expect to become a major source on a known timetable [9]. "If you look 10 years out, I would imagine that this becomes the largest part of Cloudflare's business" is a long-dated hypothesis from the chief executive, not a disclosed run rate [9].
A European media contract cited on the call, a five-year, $8.1M agreement for application services and Workers, was framed as an on-ramp to pay per crawl and pay-per-use monetization [9]. That is color about a possible path, not a marketplace number.
The cash split inside the traffic boom is therefore uneven, and it is mostly inferred rather than reported. Model companies that build agents already pay Cloudflare for Workers, for security, and, in at least one named case, for help crawling more efficiently [9][17].
Site owners already pay for the network, Bot Management, and related application services, and they are not billed extra when Cloudflare blocks traffic they do not want [9][17]. The new idea is that the agent, or the company that sent it, would pay the site, with Cloudflare in the middle as merchant, billers, or payment gateway.
That third stream is the one that would make Cloudflare a paid gatekeeper rather than a well-placed vendor to both sides. It is also the stream with no disclosed dollars and no disclosed take rate.
The pass is bounded. It applies to the share of the web that sits behind Cloudflare, not to the whole web.
A publisher that leaves, or an agent that fetches the same content from a copy that is not behind Cloudflare, steps around the gate. The company is trying to make leaving less attractive by sending publishers money rather than only charging them, which Prince has described as making Cloudflare "less than free" [17].
That is a strategy, not a disclosed payout.
Prices close to outcomes: partial. Workers bills when code runs [9].
Monetization Gateway bills per matching request, and it can vary the price by route, header, or origin-reported consumption, down to $0.001 and up to $100 [6][21]. The July announcement used outcome-shaped examples, including a charge paid only when a support escalation is resolved [5].
Those examples are planned capabilities, not disclosed transaction mix. Pay per crawl bills for access, a successful fetch, not for whether the crawl later produced an answer or a sale [12][14].
Pay Per Use is the closest of the three to an outcome, because it bills when the buyer says the content was used, and it is the one that depends on self-reporting [11]. Until Cloudflare discloses volume, price realization, and its own take, outcome pricing remains a product design, not a proven cash engine.
Research and development on the gate: pass. Spending goes to the network and to the developer platform that runs on it: Workers, bot identity, crawl controls, and the payment rails [3][9][10].
Research and development expense was $478.7M, or 22.6% of revenue, in the first nine months of 2026, our calculation [1]. Recent acquisitions extend the same surface.
Replicate, bought Dec 1, 2025 for $57.4M of cash consideration, added model hosting. VoidZero, bought Jun 1, 2026 for $164.2M of total consideration, added toolchain software.
Deno Land, bought Oct 8, 2026 for about $26.5M of cash, added an open-source JavaScript and TypeScript runtime [3]. None of the three deals was material to the financial statements on its own [3].
Two passes and two partials is the same score the third-quarter piece reached, with more product detail underneath it. The connection is real.
The record is shared with publishers, origins, and, on Monetization Gateway, a facilitator. The price can be attached to a request or to a reported use.
The take that would tell an owner whether the gate is a business is still not disclosed.
Cloudflare's take rate on each of them is not disclosed.
The case against turning more negative is also unchanged. Retention is at 122% [3].
Large-customer adds hit a record [9]. Developers and paying-customer adds accelerated [9].
The company sits in front of both the people building agents and a large share of the sites those agents want to read [10][17]. That is a genuine strategic seat.
It is not yet a disclosed cash engine for outside owners.
The next proofs are specific. First, a disclosed dollar figure for Act 4, pay per crawl, Pay Per Use, or Monetization Gateway, including whether the dollars are marketplace take, merchant-of-record margin, payment-gateway fees, or ordinary subscription and usage revenue from the same customers.
Second, a disclosed take rate, or enough price and payout detail to calculate one. Third, a durable public split of agent traffic from the rest of non-human traffic, with a stated unit of measure (requests, HTML page views, or bandwidth) and a stated scope (Cloudflare's network or something broader).
Fourth, two straight quarters of positive owner cash after interest income and prepayment builds are stripped out. The first three would tell us whether the gate collects.
The fourth would tell us whether owners are paid.
Predictions to register: fourth-quarter 2026 revenue lands at or above $845.0M, the low end of the guide (75%); dollar-based net retention at Dec 31, 2026 stays at or above 120% (65%); trailing twelve-month owner cash to Dec 31, 2026 remains negative (70%); GAAP gross margin for the fourth quarter stays below 73% (60%); Cloudflare discloses a dollar revenue figure for Act 4, pay per crawl, Pay Per Use, or Monetization Gateway by the February 2027 earnings release (45%).
Cerence Looks Fixed but a Samsung Patent Check Did Most of the Work
An in-car voice software supplier whose nine month growth falls to about 4% without one settlement, with no activist, a slipping pay vote and an ex-Intel board tie.
