Until now, defense sat at the gates - login, checkout, form. Between them it was blind. Once a bot got past the door once, the rest of the walk was its own. Precursor fills exactly that gap. It watches the whole path, not the two doors.
Fact
The facts: announced July 13, 2026. The script is embedded in the HTML response and collects behavior - cursor movement, keystroke rhythm, focus changes, page visibility. According to Cloudflare, human movement is bounded by physics (wrist, tremor, hesitation while thinking), while automation draws a straight line or an overly perfect curve. The signature accumulates across the session - refreshing the page doesn't reset it. The keyboard is read as rhythm, not content. It's given away free until general availability later this year. There is no CVE: this is a new bot detection product, not a software flaw.
There are two sides and I'll say both. As someone who guards a site, I like it - the check at the door hasn't caught anyone serious in a long time. But the same mechanism watches the agents we build too. The network stopped measuring them by signature. It started measuring them by gait. That's a different game. And it's not won with a better user-agent string.
The network stopped asking who you are. It watches how you move.
One detail is worth not skipping - they read keyboard rhythm, not the keys. The difference between the two is the whole difference between defense and eavesdropping, and it's good that they took the trouble. Except the idea is already published. The next one to copy it might not take the same trouble. And won't tell you in a blog post.
Official primary sources
Cloudflare - Introducing Precursor (July 13, 2026)The visual is generated code-art, no third-party images.