On August 31, 2026, Cloudflare announced the launch of a new bot detection engine called Adaptive Intelligence, designed to handle automated attacks as a changing economic race rather than merely an attempt to block every suspicious request. The engine begins by continuously retraining the machine-learning model behind Bot Score using live traffic signals, instead of waiting for scheduled releases of a static model.
Cloudflare says bot operators can distribute requests across large networks of residential proxies, lower the request rate from each address, and change user agents and bot fingerprints, making a session appear to be normal traffic when each request is analyzed individually. Rate-limiting rules alone have difficulty detecting this pattern, particularly when an attack unfolds slowly across login, checkout, or account-recovery flows.
What Changes in the New Engine?
Adaptive Intelligence operates behind the existing Bot Score, which already combines machine learning, behavioral verification, JavaScript fingerprints, a set of heuristic rules, and checks for known and documented bots, such as search-engine crawlers. Rather than relying on a fixed rule that produces the same result when inputs are repeated, Cloudflare says the engine statistically evaluates the likelihood of automated abuse across multiple signals.
The component available at launch is continuous retraining. The model learns from detection-evasion tools and new bot frameworks as they appear in traffic, then distributes its new weights across the network without requiring the customer to select a version or schedule an upgrade. Generating disposable rules and broader learning from the traffic it protects are two components the company said would follow later.
The Observe, Train, Deploy, Validate Loop
Cloudflare describes the process as an automated four-stage loop: observing signals, training the model, deploying the update, and then validating its safety. The signals include JA4 TLS fingerprints, request structure, challenge results, session behavior, network reputation, and higher-level signals, along with data from Turnstile and Precursor.
The engine monitors traffic across multiple time windows; a short window may reveal a sudden increase, while a longer window clarifies repeated behavior distributed across thousands of addresses, clients, and sessions. Before making a new model version the primary line of defense, Cloudflare runs it in shadow mode alongside the current version without affecting visitors and compares the results, including challenge-solving rates. If the new version appears likely to increase the chance of incorrectly classifying real users, it is not activated, according to the company’s description.
Why Does This Matter?
The practical change is to move part of the response cycle from a pattern in which a team writes a rule and then waits to test and deploy it, toward a model that learns from constantly changing signals. This particularly benefits site operators facing credential stuffing, distributed scraping, or attacks designed to remain below rate limits.
Cloudflare also connects Adaptive Intelligence with the Precursor engine it introduced the previous month, which verifies continuous behavior within a browser session, such as timing, movement, and subtle human signals. According to the company, the signals collected by each engine can make it more difficult to bypass the other, while taking into account that Precursor was designed with a focus on privacy.
Availability and Limitations
Enterprise customers must enable the Auto Update Machine Learning option in the Bot Management dashboard to receive Adaptive Intelligence automatically, while continuing to use Bot Score without changes to the version or settings. The engine’s actual performance details, such as improvement rates or its impact across different types of sites, are not provided in the material; Cloudflare has also not yet launched the other two announced components. Therefore, the current description establishes the product strategy and deployment mechanism, but does not provide an independent comparison demonstrating that it outperforms other detection solutions.