Bots passed humans online in 2026, and they don't click ads

1. Bots pass humans early — ▶ 1:28

   Bots were about 20% of internet traffic for most of Cloudflare's history, until AI-driven crawlers began climbing about 2 years ago. In fall 2025 the team projected the crossover at the end of 2027. By March 2026 that had moved to the first half of 2027. Then the team reported it had already happened in the first half of 2026. Prince says Cloudflare's sample is representative because it fronts so much of the web, and the data is public on Radar. Agent, bot and crawler are synonyms; the word depends on whether you approve of the machine.

2. 5 sites versus 5,000 — ▶ 5:17

   A person shopping for a digital camera might visit 5 sites. Their agent visits 5,000. Prince projects 1,000x today's traffic within 5 years and would take the over on that bet. COVID doubled traffic in 2 weeks; that will "seem quaint". It means more servers, CPUs, GPUs, memory and network, and someone has to pay. Advertising funded the old internet, and bots don't click on ads. He calls the replacement "totally undefined". A brand, which is a shortcut for human trust, also matters less to bots with infinite patience.

3. Free tier forced the product — ▶ 8:01

   Cloudflare began as a firewall in the cloud. A startup with no infrastructure couldn't sell to banks, so it gave a stripped-down version away. Budget and security problems line up on a diagonal, so SMBs stayed away. Hacker kids, who attack each other, and human rights groups, who anger governments, signed up overnight. The resulting attacks forced Cloudflare to build a registrar (a domain was nearly stolen), DDoS mitigation, DNS, a VPN and finally the developer platform. Prince says it "created so many problems over time for ourselves" that the solutions became the product line.

4. Free users unlock the network — ▶ 14:11

   Cloudflare launched with servers in 5 cities and switched the Tokyo servers on and off through the day because routing was wrong. Today it is in 350+ cities and 1,000+ data centers. ISPs let it in because of free users. Telecom Pakistan, which had kicked out Facebook and YouTube, asked for servers because its head of networks was a cricket fan and the national team used Cloudflare free. Cloudflare also hosts 2 of the 13 root servers, free. The limit of 13 comes from what fits in a standard packet.

5. Turkish escorts and Iran — ▶ 21:10

   Over 1,000 Turkish escort sites signed up in a week, protected from attacks by religious extremists on the free tier. Cloudflare's machine learning labeled the pattern "TE". It reappeared when Eurovision's Baku host went offline, then at JPMorgan. Prince says it traced to an Iranian student who was absorbed into the military's offensive cyber apparatus and still runs Iran's cyber attacks. The lesson is that serving odd corners of the internet trains the network, and an attack on one customer protects all. Lock-in is nil: 5 minutes to sign up, 10 seconds to leave.

6. Founders with clean lanes — ▶ 31:24

   Prince treated VCs as sources of money, not thought partners: no help hiring, no pricing advice, just pushing on what's over the horizon. Some firms thought the team were idiots. The three founders weren't friends. Michelle's model is a Venn diagram with big circles, minimal overlap and distinct lanes. Lee was the heads-down technical genius, Michelle the six-sigma operator who scales what works, Prince the storyteller. They haven't had a fight in nearly 17 years. Founders asking how to split responsibilities probably "have the wrong co-founders".

7. GPUs at the edge — ▶ 41:05

   Cloudflare announced GPUs at the edge with Nvidia in late 2021 or early 2022 and got crickets. It reissued the same press release in 2024 with a new date, and the stock doubled. Inference is now the strength: open models run on GPUs across hundreds of cities, at lower cost or within a required jurisdiction. OpenAI's mobile app and all of claude.ai run on Cloudflare. Training doesn't, because there is no InfiniBand fabric linking spread-out machines, though Prince won't rule it out. AI workloads are by far the fastest-growing part of the business.

8. AI Gateway built internally — ▶ 44:40

   Cloudflare needed to see how its own staff used models under regulatory constraints, so it built AI Gateway. It does 3 things. It audits every prompt and response, so a support agent "acting like a Nazi" surfaces fast. It injects company-specific guardrails. It routes by cost, since summarizing email doesn't need a frontier model, and staff often don't know which model they hit. Customers saw it and said they needed it. Prince compares this to AWS, which grew from Amazon building tools for its own engineers.

9. Agents break CPU economics — ▶ 47:54

   Give every knowledge worker on Earth one agent and, on container-based cloud, CPU demand would be 40x current annual CPU production. Prince calls one agent each "insane"; he expects hundreds. Workers use isolates, the sandboxing behind browser tabs, which skip a full operating system copy and start and stop far faster. Legacy software must also change. Cloudflare used AI to rewrite WordPress in Rust (Mdash) because PHP costs a few dollars to run today and would cost thousands at 1,000x traffic.

10. Scary security, then better software — ▶ 52:13

    Prince expects a Log4j-class vulnerability every week for the next 104 weeks as models find bugs; Cloudflare used Mythos through Glasswing. He calls the wave of security startups a "head fake", because software will be far better in 2 years. After an embarrassing outage last year, Cloudflare built an agent, trained on 10 years of incidents, that reviews every code release and config change. Incidents dropped off a cliff and reliability improved an order of magnitude in a year. AI's biases are uncorrelated with the team's, so it measures well.

11. The skeptic who flipped — ▶ 56:35

    93% of R&D uses AI coding tools. The turn came from Kenton Varda, who built Workers. In spring 2025 he spent a month trying to prove the tools were a mess, then returned claiming he was 100x more productive. Engineering tipped around November 2025 with Claude Opus. Prince worries most about mid-career staff who succeeded under the old rules and now feel the game changed unfairly. He fears a "lost generation". A 100x engineer can't be paid like a 1x one: one of them will leave, and the worst case is the 100x one.

12. Cloudflare OS and auto@ — ▶ 59:49

    To bring legal, finance and sales along, Cloudflare built Cloudflare OS, a harness whose edge is security tooling that lets an agent inherit a user's access to ERP and sales systems. People omit half their job when describing it, so it launched auto@cloudflare.com as a "magic AI agent" staffed 24/7 by about 20 people who turned requests into skill files. Investor-relations earnings prep fell from 2 weeks to 3 minutes and surfaced old errors. The IOC now uses it to organize the 2034 Olympics in Utah.

13. Fewer measurers, 12:1 — ▶ 1:04:46

    Prince will hire as many developers and salespeople as he can; the roles that shrink are measurers, where AI beats humans. Internal audit can now cover all 105 risk areas continuously instead of 6-10 a quarter. Cloudflare cut more than 20% of staff, not from weakness but for fewer middle managers. Span of control moved from about 6 reports to 12, and he thinks Meta's 50:1 is too many. He expects almost every company to do the same within 6-12 months, calls waiting cruel because the job market will flood, and offered severance he calls the most generous in tech.

14. Scarcity, then micropayments — ▶ 1:16:19

    A market needs scarce supply: air is free until you go scuba diving. Cloudflare first gave sites controls to allow or block bots. About half its customers want bots in, and large publishers such as Condé Nast now sign better AI deals. Small creators need micropayments. Cloudflare handles about half a billion requests a second, and 1-10% are monetizable. That means 10 million transactions a second on day one, ramping to 100 million, against Visa's fewer than 100,000. The plan leans on Coinbase, Stripe and x402, which revives the unused HTTP 402 "payment required" code.

15. Paying for new knowledge — ▶ 1:21:48

    Prince calls traffic "a terrible proxy for value" and says the ad model rewards outrage. His template is Spotify, which paid about $12 billion to creators last year, more than the music industry's entire market cap 22 years ago. It publishes failed searches back to songwriters, and one Danish writer makes about €40 million a year serving them. LLMs are a mathematical model of knowledge with holes like Swiss cheese, and labs want sources that fill them. He wants Nobel-style awards plus payment. His Park City newspaper will earn more from AI licensing than display ads this year.

Advertising cannot pay for the internet that is arriving. The mismatch is between who consumes and who clicks. A person shopping for a digital camera might visit 5 sites. Their agent visits 5,000. Multiply that across every task people hand to machines and Matthew Prince expects 1,000 times today's traffic within 5 years. He would take the over on that bet. The trend has already outrun every forecast Cloudflare made. Bots were about 20% of traffic for most of the company's history. In fall 2025 the team put the crossover at the end of 2027. By March 2026 they had moved it to the first half of 2027. Then they discovered it had already happened in the first half of 2026. None of that traffic sees an ad. The bargain of the last 28 years, free content funded by human eyeballs, now covers a shrinking share of the load. What replaces it is, in Prince's words, "totally undefined."

That is the revenue problem. The cost problem is physical, and arguably harder. Prince's own figure: give every knowledge worker on Earth a single agent, and on container-based cloud the CPU demand would be 40 times annual CPU production. He thinks one agent each is insane. He expects hundreds. So the stack itself has to become cheaper, not just the billing. Cloudflare's answer is isolates, the same sandboxing that keeps browser tabs apart. They skip a copy of the operating system and start and stop far faster than containers. The same logic applies to legacy software. Cloudflare used AI to rewrite WordPress in Rust because a PHP codebase that costs a few dollars to run today would cost thousands at 1,000x traffic. His warning is that without rewrites like this, a lot of the internet simply breaks under load.

The fix for revenue starts with scarcity. A market needs scarce supply, not just supply and demand. Air is free until you go scuba diving. So Cloudflare first gave site owners controls to allow or block bots. About half its customers want bots in, and get tooling such as HTML-to-markdown conversion to make that cheap. The ad-supported rest can say no. The early result is that large publishers such as Condé Nast, now able to refuse, are signing better deals with AI companies. That does nothing for a small blog. So step two is a micropayment per access, and the scale is absurd. Cloudflare handles about half a billion requests a second. Prince estimates 1-10% are monetizable. That implies 10 million transactions a second on day one and a path to 100 million. Visa does fewer than 100,000. The plan leans on Coinbase, Stripe and x402, which revives the HTTP 402 "payment required" code the web defined and never used.

Why should Cloudflare be the one to build this? Its history shows a pattern: it builds what it needs, then finds others need it too. The free tier was a trust hack for a startup that couldn't sell to banks. It attracted hacker kids and human rights groups, who attracted attacks, which forced a registrar, DDoS mitigation, DNS, a VPN and a developer platform into existence. AI Gateway came from needing to audit how staff used models. Prince compares this to AWS growing out of Amazon's internal tooling. Free users also built the network. Telecom Pakistan, which had kicked out Facebook and YouTube, asked for servers because its head of networks was a cricket fan and the national team used Cloudflare free. Hosting 2 of the 13 root servers gives ISPs another reason to let it in. The position is strong but not locked. Customers can leave in 10 seconds.

Security shows the same compounding. An attack on one customer teaches the network that defends all of them. Prince's example is a pattern first seen against Turkish escort sites. It reappeared at Eurovision's Baku host and then at JPMorgan, traced by his account to an Iranian student later absorbed into the military's cyber apparatus. The next 2 years will be worse, he says. Expect a Log4j-class vulnerability every week as models find bugs. Then it reverses. Cloudflare built an agent, trained on 10 years of incidents, that reviews every code release and configuration change. Incidents fell off a cliff and reliability improved an order of magnitude in a year. AI's errors are uncorrelated with a team's, which makes it a good checker. He calls the vulnerability wave a head fake. In 2 years, software is far better.

Cloudflare is also its own test subject. 93% of R&D uses AI coding tools. The turn came from a skeptic. Kenton Varda, who built Workers, spent a month in spring 2025 trying to prove the tools were a mess and returned claiming to be 100 times more productive. To reach legal, finance and sales, the company built Cloudflare OS. It works because Cloudflare's security tooling lets an agent inherit a user's access to ERP and sales systems. People omit half their job when describing it, so the company launched auto@cloudflare.com as a "magic AI agent" actually staffed around the clock by about 20 people who turned requests into skill files. Earnings prep for investor relations fell from 2 weeks to 3 minutes. Prince's rule is that companies build, sell and measure. AI makes builders and sellers worth more and makes measurers redundant. Cloudflare cut more than 20% of staff, and moved span of control from about 6 reports to about 12. He expects almost every company to follow within 6-12 months. Waiting, he says, is "the cruelest thing that you can do", because the market will flood.

The upside, in his telling, is a healthier internet. Traffic has always been "a terrible proxy for value", and chasing it rewards outrage. His model is Spotify, which paid about $12 billion to creators last year, more than the whole music industry's market cap 22 years ago. It also hands failed searches back to songwriters, and one Danish writer earns about €40 million a year serving them. Prince sees the same shape in AI. LLMs are a mathematical model of human knowledge with holes in it, like Swiss cheese. Labs want reputable sources that fill the holes, not another story from 1500 Pennsylvania Avenue. His own Park City newspaper will earn more from AI licensing than display ads this year, because only a local paper knows the snow conditions.

The obvious objection is that none of this proves the labs will pay at scale. Prince says they get it as long as the rules are the same for everyone. His evidence is large-publisher deals and one local paper. A small creator earns nothing until payment rails exist at 100 times Visa's volume. Cloudflare also supplies both the scarcity and the rail, and he never addresses that conflict. His own analogy is generous. He concedes iTunes at 99 cents was not the model that won, only a flag planted, and no equivalent exists yet for agents. Employment is the other soft spot. He is confident the market floods in 6-12 months and that Cloudflare will not need to cut again. He also admits to fearing a lost generation of mid-career workers who played by the old rules. And the commercial question underneath is untouched. If a bot has infinite patience and needs no brand to trust, what is a brand worth, and what unit replaces the click? Prince says only that it will be discovered over the next 5 years.