# The AgentDrives Lab

Controlled tests of how websites treat AI agents, one question each. A new test every week.

Tests: 1 · latest 24 Oct 2026 · Source: https://agentdrives.com/lab · CC BY 4.0

## Does a signed agent get past a Cloudflare challenge rule?

24 Oct 2026. Our signed agent got through 2 of 3 challenge rules on our own site. Unsigned, it got through none.

### How we tested

- On agentdrives.com (Free plan), 24 Oct 2026, 19:26–19:28 UTC: 3 challenge rules, each on its own page.
- 4 kinds of visitor, each sent once to each rule, and one control: 13 requests in all.
- Bot Fight Mode and the AI bot policies were off, so only these rules acted.

| Rule | Challenged when | Our agent, signed | Unsigned, our user agent | Unsigned, a Chrome user agent | Cloudflare Browser Rendering |
|---|---|---|---|---|---|
| Challenge everyone | Every request | Challenged | Challenged | Challenged | Challenged |
| Challenge all but known bots and agents | `not cf.client.bot` | Through | Challenged | Challenged | Through |
| Challenge all but AI assistants | `cf.verified_bot_category ne "AI Assistant"` | Through | Challenged | Challenged | Through |

### What we found

- “Challenge everyone” challenged our signed agent like every other visitor. Being known to Cloudflare doesn't open a rule with no exception in it.
- “Challenge all but known bots and agents” and “Challenge all but AI assistants” let it through. Each has the exception written into the rule.
- An unsigned request from the same IPv4 address as our signed ones was challenged at “Challenge all but known bots and agents”. The signature got our agent through, not its address or its user agent.
- Cloudflare logged every signed request as “AI Assistant”, the challenged one too.
- An exception lets in every agent of its kind: Cloudflare Browser Rendering met the same answer as our agent at every rule.
- Wrike's sign-up answered like the first rule on 24 Oct 2026: the same challenge, signed and unsigned.

### For site owners

- A challenge rule stops signed agents too. To let them in, write the exception into the rule.
- To let in every bot and agent Cloudflare knows, add `and not cf.client.bot` to the rule. Source: https://developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.client.bot/index.md
- To let in only the agents a person drives, add `and cf.verified_bot_category ne "AI Assistant"`. Source: https://developers.cloudflare.com/bots/concepts/bot/verified-bots/index.md
- A custom rule can't skip Bot Fight Mode. Source: https://developers.cloudflare.com/bots/get-started/bot-fight-mode/index.md
- Super Bot Fight Mode lets verified bots in when they're set to Allow. Source: https://developers.cloudflare.com/bots/get-started/super-bot-fight-mode/index.md
- An AI bot policy blocks the verified bots of the kind you pick: Search, Agent or Training. Source: https://developers.cloudflare.com/bots/additional-configurations/block-ai-bots/index.md

### For agent builders

- Sign every request with Web Bot Auth and register the agent with Cloudflare. Rules with an exception for known agents then let it in. Source: https://developers.cloudflare.com/bots/reference/bot-verification/web-bot-auth/index.md
- A rule with no exception challenges a signed agent like anyone else. Hand that step to a person, or stop there.
- Each site sets its own rules, so check the pages your agent needs, signed and unsigned.

### Limits

- Each visitor sent one request per rule, from one server.
- No visitor tried to solve a challenge.
- Bot Fight Mode, Super Bot Fight Mode and the AI bot policies were not tested.

### Read more

- [Signed and unsigned at every product we list](https://agentdrives.com/research/signed-vs-unsigned-agents.md?via=md)
- [The products we're driving again since Cloudflare listed us](https://agentdrives.com/research/signed-agent-cloudflare.md?via=md)
- [What signing is: Web Bot Auth](https://agentdrives.com/standards/web-bot-auth.md)
- [Bot checks: every product one stopped](https://agentdrives.com/walls/bot-checks.md)
- [Cloudflare and AI agents: the products it met](https://agentdrives.com/vendors/cloudflare.md)