Product Security Engineer

Klaviyo: 85% of Klaviyo code is AI-generated. Here's what changes. Published on 10/16/2026 at 11:33 am EDT On September 23, I joined Stephanie Cohen, Cloudflare's chief strategy officer, and Owen Jennings, Block's head of business, on a panel at The Information's AI Agenda Live in San Francisco. [...] Attachments * Original document * Permalink Disclaimer Klaviyo Inc. published this content on October 16, 2026, and is solely responsible for the information contained herein. Distributed via Public Technologies (PUBT), unedited and unaltered, on October 16, 2026 at 15:32 UTC. (C) Publicnow - 2026

Cloudflare introduces evaluation system to hold verified bots accountable for website preferences. 4 hrs ago - 16 October 2026 Lina Irawan OvFile Reporter Just as possessing a valid driver's license proves a person's identity and confirms they have passed a driving test, it does not guarantee they will operate a vehicle responsibly in the future. The same principle increasingly applies to the millions of automated software agents and bots navigating the modern internet. While verifying who operates a bot establishes fundamental accountability, true trust depends entirely on how that automated agent behaves once it gains access to digital infrastructure. A known, authenticated bot can still ignore explicitly stated website preferences, overwhelm origin servers, or attempt to evade traffic controls. Often, these infractions are not driven by malicious intent, but rather stem from misconfigurations, coding bugs, or poorly managed scraping parameters. To address these challenges, internet infrastructure and security giant Cloudflare has rolled out a new evaluation framework designed to measure and report when verified bot behavior deviates from acceptable operational standards. The initiative is intended to ensure that the fundamental question of whether an automated crawler can be trusted continues to receive a definitive affirmative answer. In the evolving landscape of web traffic, Cloudflare has long emphasized the importance of verifying two critical questions regarding automated agents: identity and trustworthiness. Through tools such as Web Bot Auth, bots sign requests to establish their verifiable identity, allowing systems like BotBase to catalogue them in an open, transparent format. However, once identification is firmly established, the security paradigm shifts toward a core operational rule for verified bots - the mandate to cause no harm to the digital properties they visit. The introduction of this evaluation system highlights the crucial distinction between baseline risk and earned trust. A prominent example of this distinction occurred when Cloudflare de-listed Perplexity's bot from its Verified Bot Directory after the crawler attempted to access resources on websites that had explicitly opted out of data scraping. Furthermore, when those initial requests were blocked, the bot attempted to circumvent the established website controls, prompting immediate administrative action. Do not engage in abusive behavior. While the requirement for automated crawlers to avoid abusive behavior may sound straightforward, managing it in practice involves a high degree of nuance. When automated agents fail to respect site preferences, they undermine the foundation of trust between content publishers and platform operators. If a website explicitly requests that a crawler refrain from indexing its content or demands that it reduce its request frequency, ignoring those directives erodes confidence in the automated system. To combat this, Cloudflare has developed a specialized measurement system designed to quantify how consistently a crawler respects publishing preferences. Rather than issuing a permanent judgment about a specific bot or its operator, these observations translate into an explainable trust band. This designated range demonstrates how consistently a bot complies with site preferences over time, highlighting the specific observed behaviors that informed the assessment. The initial signals evaluated by the system focus on common-sense rules and digital courtesies extended toward the website operators who provide the valuable information bots seek. Cloudflare plans to make these trust scores publicly available on its Radar platform while expanding the metrics used for evaluation. This scoring mechanism provides responsible bot operators with a tangible way to demonstrate that trust is being continuously upheld, reinforcing the security philosophy of verifying identity while continuously re-verifying behavior. When in rome, do as the romans do. For decades, the standard method for website owners to communicate their crawling preferences has been the robots.txt file. Cloudflare's new system carefully evaluates whether a bot's observed traffic patterns remain consistent with these published preferences over an extended period. A standard robots.txt file instructs all or specific bots on which sections of a website they are permitted to crawl. Because isolated violations or rare one-off anomalies might not reflect systemic issues, Cloudflare's system looks instead for repeated patterns of behavior that systematically disregard site preferences. The fundamental expectation is straightforward: responsible bots must consult and honor the preferences published by websites, aligning with established internet standards such as RFC 9309. Cloudflare notes that a robots.txt file establishes the baseline minimum rules for what automated agents should avoid, but it does not imply that any unmentioned activity is automatically permitted. For instance, a robots.txt file is not required to state explicitly that a bot must halt operations when a website communicates through other technical signals that continued access is unwelcome. What you do not wish for yourself, do not impose on others. Even when bots remain strictly within allowed URL paths, they can still place substantial computational loads on the websites they visit. One of the most common ways website operators push back against excessive traffic is by returning an HTTP 429 status code, which signals "Too Many Requests." This response serves as a direct instruction for the visitor to reduce its request rate, occasionally accompanied by guidance on how long to wait before attempting another connection. Cloudflare's evaluation system actively monitors whether a bot's traffic adapts appropriately after receiving this signal. The system assesses whether the crawler slows down or pauses its requests, or if it continues transmitting data at the same aggressive pace. This adaptive behavior is systematically incorporated into the bot's trust band over time. Consistently slowing down or pausing operations in response to rate-limiting signals increases the bot's trust score, whereas repeatedly ignoring the warnings lowers it. Building trust over time. Observing these behavioral signals represents an essential first step toward making automated traffic genuinely accountable. By pairing bot identity with verifiable evidence of ongoing behavior, Cloudflare aims to provide website owners with greater confidence that permitted bots are respecting their preferences. At the same time, it offers bot operators a reliable method to prove they deserve trust while supplying broader context regarding the automated traffic reaching digital properties. This evaluation infrastructure operates alongside existing tools such as Bot Preference Sync and Bot Management to form a comprehensive accountability loop for automated traffic. Bot Preference Sync assists website owners in publishing their preferences clearly, while traffic observation mechanisms verify whether trusted bots consistently honor those guidelines. Meanwhile, Bot Management empowers website administrators to decide how incoming automated traffic should be handled based on these evaluations. Cloudflare is already utilizing this system internally to assess how consistently verified bots honor website preferences. Because true trust is built gradually, the system evaluates sustained behavioral patterns rather than reacting to isolated incidents. This initial operational phase is being used to build historical data and refine how raw observations are translated into actionable guidance. Building upon this technological foundation, Cloudflare plans to extend the system to all customers, enabling them to customize the trust thresholds used to determine how verified bot traffic is handled on their networks. The overarching goal remains clear: to preserve the integrity of website preferences and ensure that trust is continuously earned through transparent and responsible behavior online. Related topics.

Introducing Domain Connect. JMJoseph Maregn October 16, 2026 Connect a custom domain to AgentMail through Vercel or Cloudflare in a few clicks, with no DNS records to copy by hand. Built on Domain Connect and available through the API. custom-domains domain-connect Your agents deserve their own email address. Setting one up shouldn't be the hard part. Today, AgentMail, Inc. is introducing Automatic Domain Setup, powered by Domain Connect and launched in partnership with Vercel and Cloudflare. Add a custom domain to AgentMail, click Set up with Vercel or Set up with Cloudflare, approve the DNS changes with your provider, and come back to AgentMail for verification. There are no DNS records to copy by hand. The same flow is available through the API, so an agent can start the setup itself and a person only has to approve it. * What it is: AgentMail now connects custom domains through Domain Connect, an open DNS standard. Domains on Vercel and Cloudflare can be set up in a few clicks instead of by copying records. * Why AgentMail, Inc. built it: 42.1% of new customers who added a custom domain in the past month hit at least one verification failure, almost always from a small mistake made while copying records. * How it works: AgentMail generates the records and sends them to your DNS provider through a signed link. The provider shows you the changes, and nothing is applied until you approve them. * For agents: GET /v0/domains/{domain_id}/setup-link returns the signed link, so an agent can create a domain and start the setup without a developer assembling records. One of the things AgentMail, Inc. has always believed at AgentMail is that AI agents should be first-class citizens on the internet. That means having their own identities, their own inboxes, and the ability to communicate with the outside world. Increasingly, developers want those identities to live on their own domains. Until now, getting an agent set up with a custom email domain has been more complicated than it needed to be. Why is setting up a custom email domain so frustrating? Setting up a custom domain meant moving back and forth between AgentMail and your DNS provider, copying records by hand, and waiting for verification. That's five DNS records, verification checks that back off exponentially and stretch out the wait, and many points of failure. In fact, 42.1% of new customers who added a custom domain in the past month encountered at least one verification failure. Sometimes it was a missing character. Other times it was a duplicated domain suffix, or a record entered in the wrong place. These failures come from copying and pasting records manually, and every DNS provider has its own interface for entering them. A small mistake could turn what should have been a quick setup into a frustrating debugging session. AgentMail, Inc. wanted to change that. How does one-click domain setup work? AgentMail, Inc. has partnered with Vercel and Cloudflare to make connecting your custom domain to AgentMail much simpler. Instead of copying DNS records, you connect your domain directly through your DNS provider: * Add your custom domain to AgentMail. * Click Set up with Vercel or Set up with Cloudflare. * Review and approve the DNS changes with your provider. * Return to AgentMail for verification. That's the whole flow. There's no back and forth between tabs and no records to copy and paste. Can an agent set up a custom domain through the API? Yes. AgentMail, Inc. didn't want this to stop at the console, so Automatic Domain Setup is available through the API as well. Your agent can create a domain, request a configuration link, and start the setup process without a developer assembling DNS records: # 1. Create the domain curl -s -X POST "https://api.agentmail.to/v0/domains" \ -H "Authorization: Bearer $AGENTMAIL_API_KEY" \ -H "Content-Type: application/json" \ -d '{"domain": "example.com"}' # 2. Request a setup link for it, using the domain_id from step 1 curl -s "https://api.agentmail.to/v0/domains/$DOMAIN_ID/setup-link" \ -H "Authorization: Bearer $AGENTMAIL_API_KEY" { "supported": true, "provider_name": "Cloudflare", "url": "https://...", "state": "..."} Open url for the domain owner to approve, and store state first so you can check it when the provider redirects back. If the provider isn't supported, supported comes back false and the records can be added manually. The setup link reference covers every field, including the popup size and the warning returned when the domain already has another email provider's MX records. The domain owner still reviews and authorizes the changes with their DNS provider, but the rest of the workflow can be orchestrated programmatically. How does Domain Connect work under the hood? Automatic Domain Setup is powered by Domain Connect, an open standard for simplifying DNS configuration. AgentMail generates the records required for email delivery and authentication, then passes them to your DNS provider through a signed configuration link. The provider presents the proposed changes for approval before applying them. Because the link is signed, the provider knows the records came from AgentMail and weren't edited along the way. What does it not cover yet? Automatic Domain Setup works today for domains whose DNS is hosted on Vercel or Cloudflare. Domains on other providers still use the manual flow in the custom domains guide, and AgentMail, Inc. is adding more providers. It also doesn't remove the approval step. Someone with access to the DNS account has to approve the changes, which keeps a person in control of what gets written to the domain. Custom domains are available on paid plans, as listed on the pricing page. What does this mean for agents? AgentMail, Inc. is working toward a future where developers can give agents everything they need to operate independently: identities, inboxes, authentication, and the ability to communicate with people and services. That future requires making infrastructure that was designed for humans easier for agents to use. Custom domain configuration is one small but important piece of that. If you're running many agents across many domains, how to manage custom domains for thousands of agent inboxes covers which agents should share a domain and which should get their own. With Automatic Domain Setup, developers can spend less time configuring email infrastructure and more time building what their agents can do. It's available today for domains using Vercel and Cloudflare, with more providers coming soon. Try it in the AgentMail console. AgentMail is the first email provider built for AI agents. Create an inbox in one API call, send and receive email, no OAuth and no domain verification. Free tier, no credit card required. Faq. AgentMail connects custom domains through Domain Connect, so on Vercel or Cloudflare you click a setup button, approve the DNS changes with your provider, and AgentMail verifies the domain with no records copied by hand. The same flow is available through the API, so an agent can create the domain and request the setup link itself, and the domain owner only has to approve it.