The agent signed in as a person
Sixty-eight per cent of organisations cannot separate agent activity from human activity and thirty-one per cent let an agent run under a person's own login, Cloudflare has built a setting that refuses AI training without giving up search, and a zero-knowledge VM audit began with six months of building the tools to do it.
How we Organise
A third of firms let an agent sign in as a person
The Cloud Security Alliance asked organisations running AI agents what identity those agents actually use. Eighty-five per cent have agents in production, and 31 per cent let the agent operate under a human user’s own login. Sixty-eight per cent then said they cannot clearly separate agent activity from human activity. Aembit paid for the work.
We tell a client that an agent is either on the team roster with somebody answerable for it, or nobody is watching it.
An agent is a member of the team, or it is running unsupervised.
The third of firms letting an agent borrow a person’s login have built something that sentence has no name for. The agent is supervised on paper, because a named human owns the credential. It is invisible in the log, because everything it does is recorded as that human. For our position to survive it has to stop treating the roster as the thing that settles supervision, and start asking what the audit trail can tell apart. The survey counts organisations rather than agents. A proportion of firms cannot settle a claim about one agent. If you think the split holds and we are reading a measurement problem as a third category, write to transform@dromologue.ai.
How we Build
Fewer than one site in a hundred blocks search and seventeen block training
Cloudflare has added a setting that refuses AI training while leaving the same crawler free to index for search. Apple, Google and Microsoft either honour it now or have committed to a date. The post is direct about why this had to be built into a network, because a robots.txt file publishes a preference and does nothing else. It cannot identify who is crawling, work out why they are crawling, or stop anyone who ignores it. Across Cloudflare’s own sites, fewer than 1 per cent block search bots and 17 per cent block training.
Our position is that a rule nobody can check gets obeyed by the people who were going to obey it anyway.
A standard that cannot be tested and validated is an opinion with a diagram.
What Cloudflare put behind the preference is identification, classification, enforcement, and a public record of what each operator does with it. The figures describe Cloudflare’s customers rather than the web. A company selling bot management is reporting on the problem it sells the answer to. Whether the three named operators honour the setting is a promise. The measurement comes later.
How we Assure
Six months of building tools came before the audit started
Trail of Bits was asked to review the Miden zero-knowledge virtual machine before launch. Miden runs its own assembly language, and almost no developer tooling existed for it, so the firm spent six months having agents build what it needed first. That came to a language server, a decompiler, a static analysis engine, and a model of the executor in Lean. Those tools found an unvalidated prover-supplied input that would have let a malicious prover forge Falcon signatures and take funds from account holders. The Lean work left 95 machine-checked correctness proofs behind.
This is what goes to every client about to ship something nobody has attacked yet.
Attack your own before somebody else does.
Miden did that, and the flaw that would have cost its account holders money was found by people it was paying to find it. What the story adds is the price. Our line does not separate a firm that pointed a scanner at its own repository from one that spent half a year building a decompiler because none existed, and both can say they went first. On an architecture nobody has seen before, only the second returns anything. Six months of preparation is not available to most teams shipping most things, and this is one review written up by a firm that publishes its wins. If your own pre-launch review caught something cheap tooling would have walked past, we would rather hear it: transform@dromologue.ai.