Agents can now create Cloudflare accounts, buy domains, and deploy
86 points
1 hour ago
| 21 comments
| blog.cloudflare.com
| HN
c-linkage
45 minutes ago
[-]
Having to manually register new domains was something that was really holding back my ability to commit fraud. Now that large language models and agents can do this for me, that will really speed up my ability to defraud the innocent and elderly.
reply
loganc2342
33 minutes ago
[-]
Reminds me of an article from The Onion from this morning: https://theonion.com/taking-advantage-of-other-people-was-th...
reply
owenpalmer
15 minutes ago
[-]
A truly wonderful read
reply
throwup238
42 minutes ago
[-]
Have you talked to Andreesen Horowitz yet? That elevator pitch alone should get you a few million.
reply
silcoon
34 minutes ago
[-]
Curious, is there an Andreesen Horowitz Agent MCP?

Let’s automate this end to end, from idea to raising capitals. Vibe Angels should just be multi agents managing how much capitals to allocate to each projects.

reply
zbentley
8 minutes ago
[-]
You joke, but like the meme goes: go knocking on enough doors asking to see the devil, and eventually he might answer.
reply
jackconsidine
49 minutes ago
[-]
That is ironic. Four years ago, cloudflare didn’t let human me have an account / buy domains because I signed up, never used a single service but didn’t respond to a request to verify my drivers license

> This account is in violation of Cloudflare's Terms of Service. Specifically fraud. The suspension is permanent.

(Yes that’s really it. Sincerely. No “but I also abused X”)

reply
nojs
2 minutes ago
[-]
This conflict is popping up everywhere. There is a push by a lot of companies to allow agentic use of their services (and new companies explicitly offering "X for agents"), ignoring the fact that "agent" means the same thing as "bot" which we've spent the last couple of decades actively filtering out. Will be interesting to see how it plays out.
reply
captn3m0
35 minutes ago
[-]
> By agreeing to these Terms, you represent and warrant to us: (i) that you have not previously been suspended or removed from the Websites and Online Services

CloudFlare ToS has you covered. A human must accept it, even with the new agentic flow.

reply
hedayet
17 seconds ago
[-]
Nice. Another step closer to the "dream" of filling the web with trash at scale
reply
faangguyindia
9 minutes ago
[-]
One of the well-kept secrets about Cloudflare is:

You can have a zero-cost inbox.

Earlier, I was using Zoho and FastMail (however you dice it, it will use some money, $12 a year for Zoho and $7 per month for FastMail? Even then, perhaps you only get one mailbox and some aliases)

but with this method, I get unlimited aliases, domains, and mailboxes:

Now, I wrote a script which captures the email and saves attachments to S3 using the HTTP API (why S3 and not R2? Because Cloudflare wanted a credit card, and I was too lazy to add it there lol) and emails to D1.

This uses an email -> webworker workflow.

I use an API to fetch my emails.

This means all my inbound emails are now handled by Cloudflare, and I can easily use all of it with zero payment.

The best part is this supports tokenised emails, so I can provide a unique email address to each service I sign up for.

I am using SES as the sender. I’ve set up one script which auto-sets up any domain in SES and auto-verifies the sender email.

The funniest thing is I am receiving zero spam? As if other email providers sell my email?

reply
zelon88
4 minutes ago
[-]
And CloudFlare engineers sleep comfily at night knowing that they just produced 800 lbs of carbon emissions to generate a static "Hello World" HTML page.

I see the amount of work that gets put into these workflows and it boggles my mind that anyone thinks that it's faster or easier or more convinient or more cost efffective than installing a LAMP stack on one of the 6 laptops they have stuffed in a closet. God forbid anyone have any native local capability.

reply
unglaublich
2 minutes ago
[-]
[delayed]
reply
schpet
1 minute ago
[-]
why does cloudflare not allow existing users to create new accounts? you basically need to use a burner email and transfer it afterward. makes it awkward to use this on new projects that you want independent of your existing accounts.
reply
firefoxd
12 minutes ago
[-]
The agent start a phone call, listens to the person on the line, analyzes which fraud bucket they fall into, and start the process.

While they are on the phone with the agent, it buys a domain relevant to the victim, the agent codes and deploy the website specially catered to them and the fraud bucket. Collect payment, destroy the website, redirect the domain to google.com. no need to start a new call because you had several agents committing the same fraud in parallel.

It can also be used to make art.

reply
faangguyindia
18 minutes ago
[-]
Most of the sysadmin and devops team have been downsized in India because of AI.

Basically, now it's trivial for any new devops guy to run such a query in Claude Code:

“Log in to this production server, find out all services it runs and their deployment method, create documentation about everything, and generate a repeatable, auditable deployment workflow.”

Devops and sysadmins can no longer withhold information to maintain job security.

Boom, 80% of the team gone.

I know companies are doing migrations of production Postgres and MySQL on 1000s of machines using AI agents.

I’m imagining how many SaaS will be automated out and simply be an "agent skill" in ClaudeCode.

reply
zbentley
2 minutes ago
[-]
> Devops and sysadmins can no longer withhold information to maintain job security.

I can't imagine this is very prevalent. That's a very 2004-style corporate immaturity; I get the sense that even the slow-moving behemoths of the software world have mostly caught up to, say ... 2017's recognition of the importance of automation and reproducibility and won't tolerate the kind of malpractice you describe--wilful information siloing by infrastructure teams.

Like, those businesses might well suck at automation! But they've been doing it and firing the people who resist it for a long while now.

reply
bakugo
48 seconds ago
[-]
Only downsized? I would expect them to cease to exist entirely in the coming years, as western companies begin to realize that AI is cheaper and more competent than the Indian firms they usually outsource work to.
reply
hboon
15 minutes ago
[-]
I was pleasantly surprised when I read the headline a few days ago. But it's only accessible through Stripe right? I'm simultanenously very concerned about the centralized control that Stripe gains (it's not going to be just access to Cloudflare) and also amazed at how Stripe is shaping to be. It was just a payment processor.
reply
aleksiy123
17 minutes ago
[-]
I was wondering if someone was going to allow payments through CLI at some point.

But jokes aside having a central place to manage billing and accounts for deploying infra across multiple providers is pretty awesome imo.

if they have a terraform provider even better. I wonder if also makes multi tenant architectures or environment isolation easier to provision as well.

reply
readitalready
8 minutes ago
[-]
This probably started because of Andrej Karpathy's complaint about deployment being more painful than coding itself.
reply
stevefan1999
12 minutes ago
[-]
Can I make a bot to buy the domain at the best price, transfer that domain to Cloudflare instead?
reply
saneshark
56 minutes ago
[-]
Claude has been buying domains and deploying to Vercel for me using aws cli, vercel cli, and gh cli since December. Personally I prefer a cli to an MCP server for this type of thing.
reply
Waterluvian
39 minutes ago
[-]
Are any of these domains public? I’d love to study and better understand the use case for needing to AIify this.
reply
threethirtytwo
30 minutes ago
[-]
It’s not AIifying one thing. It’s AIifying the entire work flow… every detail. Allowing domain names is just one aspect of it.

The agent does everything. “Make a website that does…“ and it can handle everything from start to finish. It’s that good now.

reply
jakebasile
38 minutes ago
[-]
As a user of the internet I can only imagine this worsening my experience by allowing even more slop to permeate the network's every orifice.

Also, when an agent sets up a domain, who is the domain owner? Who responds to takedown requests? What if it then decides to host illegal content at the domain (generated or otherwise). Who is responsible? Agents aren't (yet) legal persons, so it must be the person who owns the agent, but if that person never even sees the legal agreement being agreed to how would it hold up in court? If the person didn't direct the creation or hosting of illegal content, what then?

reply
idank
16 minutes ago
[-]
Humans will not win in court with a "but the agent did it, I had no idea" argument. Just look at how the cases against OAI are going, and that's where families lose a loved one. There's not going to be any sympathy when your agent committed fraud on your behalf.

And it's not like pro agent companies have a reason to self regulate. They're not going to absorb that liability voluntarily, they'll push it onto users contractually (most of them already do). This is just another channel to bring in customers. They will capitalize ruthlessly to increase their bottom line.

reply
zelon88
11 minutes ago
[-]
> There's not going to be any sympathy when your agent committed fraud in your behalf.

Good thing the fraud is committed in places that specifically don't prosecute fraud when it's targeted against Western countries.

reply
arjie
1 hour ago
[-]
Fascinating. This is through Stripe rather than wrangler or anything. Coding agents were pretty good at handling the Cloudflare API already with an API key, but I think this thing that Stripe is doing by being the central hub through which all agent stuff goes by integrating with their CLI is a pretty good move for them.
reply
joemazerino
53 minutes ago
[-]
Buying the domain is the key here.
reply
DeathArrow
6 minutes ago
[-]
So they made it possible for agents to spend people's money buying their services.

Why didn't Amazon think of that?

reply
swader999
19 minutes ago
[-]
Who goes to websites these days?
reply
floodfx
1 hour ago
[-]
I clicked through the $100k credits link and didn’t see Cloudflare listed as an Atlas partner? (Maybe not updated?)

This looks interesting nonetheless.

reply
rvz
12 minutes ago
[-]
> At the end, the agent has deployed to production, and the app runs on the newly registered domain:

Soft scammers, fraudsters and defamers are celebrating in copying websites for malicious intent.

For sure this is going to get abused.

reply
slopinthebag
17 minutes ago
[-]
Thank god, this is what we've been missing on our quest to make software better for our users.
reply
armanj
47 minutes ago
[-]
> buy

good luck

reply