Intel / blog

Catching rogue AI behavior with identity-aware analytics

Source: blog.cloudflare.com
Author: Cloudflare
Date: Published Aug 5, 2026

Context

Cloudflare's User Insights compares AI spending with an account's own history to surface activity worth investigating. Its product explanation describes a combined threshold: a session must exceed twice the user's recent 95th-percentile session cost and clear organization-level spending thresholds. This avoids treating every expensive session, or every large percentage increase from a tiny baseline, as suspicious.

Connecting the gateway to Cloudflare Access attaches a verified user identity to requests, helping administrators trace unusual activity to a person. User Insights itself neither determines malicious intent nor blocks the account. It narrows the investigation to unusual traffic passing through the gateway.

Key takeaways · AI-distilled

Absolute spend thresholds do not work for AI usage, because $500 can be a normal session for a heavy user while $50 from an that always spends $5 is a 10x break. So each session is scored against that account's own 95th-percentile session cost over 30 days.
One threshold alone would drown admins in noise, so an alert needs two: more than 2x the user's own p95 and above the org-wide p99 session cost (about $200 in Cloudflare's own traffic), plus a dollar floor so a micro-user's 500x blip over pennies never fires.
The hardest behavior to catch is a trusted account doing more of what it is already permitted to do — no new tool, no blocked action, no policy tripped. A sudden break from an account's own baseline is often the first visible sign of a stolen credential or a runaway agent.
People and agents leave different fingerprints: an agent summarizing tickets every three hours is tight and consistent, a human is irregular and messy. The same size deviation is therefore noise for one and a real signal for the other, so baselines must be per-account.
Shared API keys destroy attribution, and the fix is to put an identity provider in front of the gateway: each authenticated request carries a verified user ID in its metadata, which turns spend limits into per-person budgets that can block or fall back to a cheaper model.

Terms in this piece · Glossary

AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.

Key quotes

“One report from Stanford University found that 59% of organizations said knowledge gaps were their biggest obstacle to responsible AI governance.”

“Solving these issues takes two things: a verified identity on every request (so a spike has a name behind it), and a picture of what normal looks like for that identity.”

“Absolute thresholds fail here: a $500 jump from a heavy user might be normal, while a $50 session from an agent that always spends $5 is a 10x change that could otherwise slip by.”

“Shared API keys make it almost impossible to tell who is using an AI service or apply the access rules we already have for employees”
Max Baumgarten

Read the source blog.cloudflare.com