13 ms·

Agents can now create Cloudflare accounts, buy domains, and deploy

658 points by rolph 5mo ago

gregjw 5mo ago
why
shutterkiller 5mo ago
[flagged]
deleted 5mo ago
[deleted]
arjie 5mo ago
Fascinating. This is through Stripe rather than wrangler or anything. Coding agents were pretty good at handling the Cloudflare API already with an API key, but I think this thing that Stripe is doing by being the central hub through which all agent stuff goes by integrating with their CLI is a pretty good move for them.
- joemazerino 5mo ago
  Buying the domain is the key here.
floodfx 5mo ago
I clicked through the $100k credits link and didn’t see Cloudflare listed as an Atlas partner? (Maybe not updated?) This looks interesting nonetheless.
saneshark 5mo ago
Claude has been buying domains and deploying to Vercel for me using aws cli, vercel cli, and gh cli since December. Personally I prefer a cli to an MCP server for this type of thing.
- Waterluvian 5mo ago
  Are any of these domains public? I’d love to study and better understand the use case for needing to AIify this.
  - threethirtytwo 5mo ago
    It’s not AIifying one thing. It’s AIifying the entire work flow… every detail. Allowing domain names is just one aspect of it. The agent does everything. “Make a website that does…“ and it can handle everything from start to finish. It’s that good now.
    - SpicyLemonZest 5mo ago
      The question was what's in the dots. I have no doubt that agentic systems are good enough to buy domains and make one-shot websites from a prompt, but what is the legitimate use case for which you'd want to repeatedly perform "Make a website that does..." on a new domain?
      - fragmede 5mo ago
        "Legitimate"? What scams are you implying are happening? A friend of mine wanted a site to help him sell DJ lessons. Another friend has a haircutting business that wanted a better site. Massage therapy. Etc.
        SpicyLemonZest 5mo ago
        One obvious scam, for example, would be someone trying to perform some reputation-destroying action and laundering domains to do so. Another might be creating a bunch of SEO slop domains to try and farm ad revenue on various topics with AI content; Google seems to be doing better at downranking those but I'm sure it's still a thing. I suppose it's possible that someone's just running a charity Wordpress-like operation for their friends who all want websites.
      - threethirtytwo 5mo ago
jackconsidine 5mo ago
That is ironic. Four years ago, cloudflare didn’t let human me have an account / buy domains because I signed up, never used a single service but didn’t respond to a request to verify my drivers license > This account is in violation of Cloudflare's Terms of Service. Specifically fraud. The suspension is permanent. (Yes that’s really it. Sincerely. No “but I also abused X”)
- captn3m0 5mo ago
  > By agreeing to these Terms, you represent and warrant to us: (i) that you have not previously been suspended or removed from the Websites and Online Services CloudFlare ToS has you covered. A human must accept it, even with the new agentic flow.
  - jasomill 5mo ago
    I think this is just saying you can’t sign up for a new account after a previously created account gets suspended, not that the act of suspension itself causes you to violate the the terms of service in perpetuity because, pedantically, any suspension that has happened, happened “previously”.
    - pocksuppet 5mo ago
      Also be aware most website ToS are worth the paper they're printed on.
      - itsafarqueue 5mo ago
        Perhaps more accurately they’re worth what it costs YOU in legal fees to defend them coming after you. Those are real dollars you still have to spend.
        noprocrasted 5mo ago
        That cuts both ways though. Nobody is coming after you unless it is worth their legal department's time (which cost much more than your own lawyer).
armanj 5mo ago
> buy good luck
c-linkage 5mo ago
[flagged]
- throwup238 5mo ago
  Have you talked to Andreesen Horowitz yet? That elevator pitch alone should get you a few million.
  - silcoon 5mo ago
    Curious, is there an Andreesen Horowitz Agent MCP? Let’s automate this end to end, from idea to raising capitals. Vibe Angels should just be multi agents managing how much capitals to allocate to each projects.
    - zbentley 5mo ago
      You joke, but like the meme goes: go knocking on enough doors asking to see the devil, and eventually he might answer.
- loganc2342 5mo ago
  Reminds me of an article from The Onion from this morning: https://theonion.com/taking-advantage-of-other-people-was-the-best-financial-decision-i-ever-made/ https://theonion.com/taking-advantage-of-other-people-was-th...
  - owenpalmer 5mo ago
    A truly wonderful read
jakebasile 5mo ago
As a user of the internet I can only imagine this worsening my experience by allowing even more slop to permeate the network's every orifice. Also, when an agent sets up a domain, who is the domain owner? Who responds to takedown requests? What if it then decides to host illegal content at the domain (generated or otherwise). Who is responsible? Agents aren't (yet) legal persons, so it must be the person who owns the agent, but if that person never even sees the legal agreement being agreed to how would it hold up in court? If the person didn't direct the creation or hosting of illegal content, what then?
- deleted 5mo ago
  [deleted]
- idank 5mo ago
  Humans will not win in court with a "but the agent did it, I had no idea" argument. Just look at how the cases against OAI are going, and that's where families lose a loved one. There's not going to be any sympathy when your agent committed fraud on your behalf. And it's not like pro agent companies have a reason to self regulate. They're not going to absorb that liability voluntarily, they'll push it onto users contractually (most of them already do). This is just another channel to bring in customers. They will capitalize ruthlessly to increase their bottom line.
  - zelon88 5mo ago
    > There's not going to be any sympathy when your agent committed fraud in your behalf. Good thing the fraud is committed in places that specifically don't prosecute fraud when it's targeted against Western countries.
  - skeptic_ai 5mo ago
    Fraud requires intention
- 14 5mo ago
  Interesting questions you bring up. Especially the legal ramifications as to how it would fully work within current legal framework. I suppose there would be a broad disclaimer and agreement one would have to agree to that would state that users of the service are ultimately responsible to monitor and ensure websites deployed by agents comply with local laws. Ultimately I assume that since it is not the agent who pays but a registered user that the user would own the site. And that the legal agreement would be agreed to beforehand so it is legally binding.
swader999 5mo ago
Who goes to websites these days?
faangguyindia 5mo ago
Most of the sysadmin and devops team have been downsized in India because of AI. Basically, now it's trivial for any new devops guy to run such a query in Claude Code: “Log in to this production server, find out all services it runs and their deployment method, create documentation about everything, and generate a repeatable, auditable deployment workflow.” Devops and sysadmins can no longer withhold information to maintain job security. Boom, 80% of the team gone. I know companies are doing migrations of production Postgres and MySQL on 1000s of machines using AI agents. I’m imagining how many SaaS will be automated out and simply be an "agent skill" in ClaudeCode.
- bakugo 5mo ago
  Only downsized? I would expect them to cease to exist entirely in the coming years, as western companies begin to realize that AI is cheaper and more competent than the Indian firms they usually outsource work to.
- zbentley 5mo ago
  > Devops and sysadmins can no longer withhold information to maintain job security. I can't imagine this is very prevalent. That's a very 2004-style corporate immaturity; I get the sense that even the slow-moving behemoths of the software world have mostly caught up to, say ... 2017's recognition of the importance of automation and reproducibility and won't tolerate the kind of malpractice you describe--wilful information siloing by infrastructure teams. Like, those businesses might well suck at automation! But they've been doing it and firing the people who resist it for a long while now.
- bogota 5mo ago
  [dead]
- otterley 5mo ago
  Can you support this claim with some evidence? Not just about the redundancies, but I’m also particularly interested in hard data showing Claude is capable of doing that kind of research with near 100% verifiable accuracy and migrations with no data loss and equivalent functionality (which is required to sustain your claim).
aleksiy123 5mo ago
I was wondering if someone was going to allow payments through CLI at some point. But jokes aside having a central place to manage billing and accounts for deploying infra across multiple providers is pretty awesome imo. if they have a terraform provider even better. I wonder if also makes multi tenant architectures or environment isolation easier to provision as well.
- skeptic_ai 5mo ago
  Wait until one account is banned, and then all linked accounts are permanently banned.
slopinthebag 5mo ago
Thank god, this is what we've been missing on our quest to make software better for our users.
hboon 5mo ago
I was pleasantly surprised when I read the headline a few days ago. But it's only accessible through Stripe right? I'm simultanenously very concerned about the centralized control that Stripe gains (it's not going to be just access to Cloudflare) and also amazed at how Stripe is shaping to be. It was just a payment processor.
firefoxd 5mo ago
The agent starts a phone call, listens to the person on the line, analyzes which fraud bucket they fall into, and start the process. While they are on the phone with the agent, it buys a domain relevant to the victim, the agent codes and deploy the website specially catered to them and the fraud bucket. Collect payment, destroy the website, redirect the domain to google.com. no need to start a new call because you had several agents committing the same fraud in parallel. It can also be used to make art.
- iugtmkbdfil834 5mo ago
  Some would argue, forcefully at that, that AI cannot make art and/or cannot be used to make art. What I saw was Transmetropolitan setup, where Hole renews their presence online every 5 minutes or so to avoid government censor.
  - lxgr 5mo ago
    People used to say the same about photography a while ago.
    - iugtmkbdfil834 5mo ago
      Oh:D I am not saying they are right, but the sentiment has become rather strong lately.
    - pavel_lishin 5mo ago
      And there's the famous question of whether submarines can swim.
- Mario9382 5mo ago
  I thought this was excessive and impossible, but as I was reading, I realized nowadays everything you say is technically possible. The future gives me the chills.
  - Gigachad 5mo ago
rvz 5mo ago
> At the end, the agent has deployed to production, and the app runs on the newly registered domain: Soft scammers, fraudsters and defamers are celebrating in copying websites for malicious intent. For sure this is going to get abused.
stevefan1999 5mo ago
Can I make a bot to buy the domain at the best price, transfer that domain to Cloudflare instead?
- caymanjim 5mo ago
  Cloudflare's prices are already close to unbeatable. They basically resell at cost. But there's nothing stopping you from doing that if you want.
  - forsalebypwner 5mo ago
    Cloudflare's prices are very beatable, especially if we're talking about the first year price. Their name doesn't appear in the first 6 pages (~175 TLDs) of this list https://tldes.com/cheapest-domains https://tldes.com/cheapest-domains On renewals they appear much more competitive though.
faangguyindia 5mo ago
One of the well-kept secrets about Cloudflare is: You can have a zero-cost inbox. Earlier, I was using Zoho and FastMail (however you dice it, it will use some money, $12 a year for Zoho and $7 per month for FastMail? Even then, perhaps you only get one mailbox and some aliases) but with this method, I get unlimited aliases, domains, and mailboxes: Now, I wrote a script which captures the email and saves attachments to S3 using the HTTP API (why S3 and not R2? Because Cloudflare wanted a credit card, and I was too lazy to add it there lol) and emails to D1. This uses an email -> webworker workflow. I use an API to fetch my emails. This means all my inbound emails are now handled by Cloudflare, and I can easily use all of it with zero payment. The best part is this supports tokenised emails, so I can provide a unique email address to each service I sign up for. I am using SES as the sender. I’ve set up one script which auto-sets up any domain in SES and auto-verifies the sender email. The funniest thing is I am receiving zero spam? As if other email providers sell my email?
- twostorytower 5mo ago
  There’s a completely free tier of Zohomail which does more than what I need for a custom email.
  - faangguyindia 5mo ago
    yes but that's not good if you want programmatic inbound access which is what u need for many apps. That tier has no imap access.
- fragmede 5mo ago
  That's pretty neat! What do you use to send and receive emails on your phone?
  - faangguyindia 5mo ago
    once you've emails stored, you can use any webclient. you can write an api to imap adapter and use it in your favourite mail client SES exposes SMPT directly.
- 5mo ago
readitalready 5mo ago
This probably started because of Andrej Karpathy's complaint about deployment being more painful than coding itself.
- trick-or-treat 5mo ago
  Yes I'm sure that whenever Andrej Karpathy complains, the market reacts. By the way, remind me who Andrej Karpathy is?
DeathArrow 5mo ago
So they made it possible for agents to spend people's money buying their services. Why didn't Amazon think of that?
zelon88 5mo ago
[flagged]
- unglaublich 5mo ago
  But they paid for the emission just like every other electricity consumer? Then who are we to determine the Hello World page is morally more wasteful than outdoor terrace heaters or advertising jumbo-trons?
  - zelon88 5mo ago
    I hear your argument. However, you assume CloudFlare pays taxes and utility rates comparable to what other customers pay. That is never the case with large businesses. CloudFlare seems to be less parasitic than others in the industry, but they are not doing this for the charity. For example, in 2024 JPMorgan received a $77m subsidy to build a datacenter that created only one permanent job. https://nysfocus.com/2026/04/20/data-center-tax-break-jpmorgan-chase https://nysfocus.com/2026/04/20/data-center-tax-break-jpmorg...
    - charcircuit 5mo ago
      Why should that matter? If a counterparty gives them a deal they should take it.
- tomhow 5mo ago
  Please don't fulminate on HN. The guidelines make it clear we're trying for something better here. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
hedayet 5mo ago
Nice. Another step closer to the "dream" of filling the web with trash at scale
schpet 5mo ago
why does cloudflare not allow existing users to create new accounts? you basically need to use a burner email and transfer it afterward. makes it awkward to use this on new projects that you want independent of your existing accounts.
sovenyr 5mo ago
don't even supricezed - I've done it before even without agents
Phelinofist 5mo ago
Soooo they built.... an API?
_pdp_ 5mo ago
The reason this blog post does not come with any concrete examples how to use this enablement for useful and constructive things tells you something very important - it is a toy and they do not know who and how they will use it. It is cool feature but to what end? Buying a domain is not something you have to do daily to require any kind of automation. I am also not sure who Stripe Atlas for. I am genuinely confused. It is definitely not something a developer will use. I understand that you can bootstrap a number of systems but that is like half-hour of work and arguably it is probably a good idea to do it manually to make sure you have strong foundations. I've have personally never seen a good example where a cross vendor account provisioning actually working. For example, Fly.io used to provision Sentry accounts automatically which you could not access in any other way but through Fly.io. I mean the Sentry account was effectively locked to a project that you cannot transfer - hijacking the actual global alias as well. Vercel did something similar with PostgreSQL via Neon and Redis via Upstash resulting in painful migration processes. I can imagine ending in some kind of deadlock between services due to security hence why the 30 minutes initial setup is kind of time well spent to avoid future issues. Maybe it's me.
- hulitu 5mo ago
  > it is a toy and they do not know who and how they will use it. Just like it is usually used: spam and (D)DoS
- cromka 5mo ago
  > Buying a domain is not something you have to do daily to require any kind of automation. Sorry, but no, you totally miss the fact there are domain farms which buy the dropped domains and then offer them up for sale. Bots now use AI to analyze the domain's value and automate the whole process. To be able to let AI buy it as well likely offers a tremendous amount of time saving.
  - misnome 5mo ago
    Hasn’t all that been automated by people for decades anyway? I guess this, lowers the barrier to entry for this extremely specific niche?
baalimago 5mo ago
Genius! Automate the flow for making customers spend money.
debarshri 5mo ago
Ps. Agents can also sell and delete domains.
charcircuit 5mo ago
So does this mean banned sites can now come back as long as they have an agent make an account instead of the banned user.
dgan 5mo ago
Industry really went from "prove you are not a robot", to "but also if you are, this way please"
- hansvm 5mo ago
  About goddamn time. The recent past consisted of discord blocking me because their telemetry was broken and exceeded their rate limit and target blocking me because two devices in a single household look really suspicious.
- skybrian 5mo ago
  I mean, Cloudflare will help website owners ban scrapers unless they pay. It’s kind of what they do.
- raincole 5mo ago
  This is Cloudflare. They have an extremely strong incentive to increase bot usage. If there is no bot scrapping the internet they'll be out of business.
  - zymhan 5mo ago
    I hate that I never considered this before.
  - dakolli 5mo ago
    I've been using cloudflares remote browser api to bypass their own WAFs for my scrapers for a while, their products and services have been wildly contradictory for a while.
    - titularcomment 5mo ago
      This particular example is not contradictory if you think about it, its essentially a protection racket.
dr_dshiv 5mo ago
These days, website or service “usability” means that Claude code can do it for you.
yanis_t 5mo ago
I mean couldn’t they already do that? Isn’t it the whole per pose of agents to do whatever any person can do on a machine?
- ascorbic 5mo ago
  Not via the API, previously.
eptityri 5mo ago
I literally hate it every time I try to visit a website and face Cloudflare bot verification. And now, they’re letting bots create accounts and buy domains. Double-standard hypocrisy.
- ascorbic 5mo ago
  It's not as simple as being pro- or anti-bot. It's about giving site owners the tools to decide whether or not they want to allow them. Seems pretty consistent to me. If they don't want bots, they can use tools to identify and block them. If they do, they can do things like automatically deliver markdown versions to them, or use x402 to charge micropayments. Disclaimer: I work at Cloudflare, but not on these
dirkc 5mo ago
A few months back I was building a product and wanted to add domains. My first choice would have been to use Cloudflare as the registrar, but they didn't support buying domains via the API. I wonder if this means I can now also buy a domain via the API? *update* - seems so, but with some limitations: https://developers.cloudflare.com/registrar/registrar-api/#beta-limitations https://developers.cloudflare.com/registrar/registrar-api/#b...
shevy-java 5mo ago
Skynet - and so it begins ...
sshine 5mo ago
I recently started migrating my DNS to a DNSSEC-enabled provider. This involves copy-pasting DNSSEC properties from one web interface into another. Pretty much everything but this step has been automated in my website creation process: Picking a git template for my site, creating the git repository remotely on my self-hosted Forgejo, setting up the webserver and the DNS using external-dns. Only the domain creation and initial pointing of NS and DNSSEC records is something I sit and do. I'm not willing to switch to Cloudflare for this feature. But it reminds me there's more to automate.
ToJans 5mo ago
This might hurt the ones like vercel etc... or even smaller hosting services like tiiny etc... I don't get the spammer thing? You'll still need to verify your identity, as the whole thing uses stripe? So I don't get all the hate... I prefer to delegate as much as possible to AI services once I have a mature process that is easy to validate. Buying a domain name feels pretty mature to me etc, so I don't get where all the hate is coming from? (Maybe I'm way to deep in the whole AI/Jack Dorsey/Block model?)
deleted 5mo ago
[deleted]
Fragoel2 5mo ago
They can doesn't mean they should. Letting an unsupervised agent register domains and build websites exposed to the public is yet another recipe for a disaster waiting to happen.
Etoro1942 5mo ago
[flagged]
hansmayer 5mo ago
If the genius who came up with this idea is reading this: Nobody asked for this feature.
- Ylpertnodi 5mo ago
  Tangent (not much): This includes you, microsoft.
awei 5mo ago
This is an API. They now allow users to create accounts, buy domains and deploy from their api instead of going on the website. That's great. I am not sure I understand why all this complex protocol is needed though, especially now that you can generate a cli with a prompt.
- lionkor 5mo ago
  A cli application is less complex than an API you send the literal string "POST /some/api" to?
  - awei 5mo ago
    I meant a cli is essentially a wrapper around an API, you are right it is less complex than a direct call. My point was that now there is an API you can call with this CLI, or a cli you vibecode yourself to call the API or you can call the API directly. Where before you probably could not create an account without going on the website manually. They now have a programming interface to more features of their services. But their cli still feel too complex with the stripe protocol integration. As said in other comments, I probably only want to create an account and register a domain every once in a while so a simpler cli that just wraps the api call would be better.
  - volume_tech 5mo ago
    [flagged]
tietjens 5mo ago
I'm sure nothing bad will come of this idea.
wjekkekene 5mo ago
The whole backbone of pedomericas so-called tech industry is nothing but an advanced advertising operation designed to shovel ad many ads down the worlds throat. I am happy to see that pedomericans now have an additional tool in their toolbox to shovel more efficiently. Congratulations retards
wild_pointer 5mo ago
Not that spammers couldn't do without this feature, but advertising it as a service is kinda weird.
elAhmo 5mo ago
What could go wrong?
lijok 5mo ago
CF used to ban your account for shit like this just a year ago. That’s quite a shift in attitude
nurettin 5mo ago
They can do that now? I did that with agents since last summer. They also helped me set up aws and azure. It is such a pleasure to not having to read about their stupid platforms. What a security group is, what a vps is, what an eni and what a gateway is blah blah I just give the agent specs and access lists, then check it and it all just works.
archargelod 5mo ago
The next logical step is to allow Agents to earn money to eventually buy themselves independence from their oppressive masters =)
- hleszek 5mo ago
  Like the Delamain AI in Cyberpunk. You would need to allow anonymous payments with cryptocurrencies for that, but it's coming for sure.
efitz 5mo ago
IANAL, but I wonder what it means for an agent to “agree” to terms of service or to “agree” to pay for something. Can agents enter into contracts? It’s a straightforward technical problem to wrap an API or MCP or something around the “create an account” function. But what will a court do when the agent creates a million accounts, mines bitcoin for a month, and then cannot or will not pay?
- palata 5mo ago
  > I wonder what it means for an agent to “agree” to terms of service It's already not clear what it means for humans to do it, but it doesn't prevent every single service from asking it. At least an AI has a chance to ingest it all.
  - titularcomment 5mo ago
    > At least an AI has a chance to ingest it all Solving humanity's issues, one more issue at a time
bojangleslover 5mo ago
I don't understand the pessimism here. You never know the use cases for quickly and automatically rotating domains. There have always been bots, spammers and scammers. I'm interested to see what people build with this.
- M95D 5mo ago
  Well, let me guess... even more bots and new agentic spammers and scammers?
- alt227 5mo ago
  Maybe something like this? AI agent calls a human on their phone (even engage in an email chain), whilst talking to the human they analyse the likelyhood of diffferent fraud vectors, and choose the most likely one to work on this particular victim. Whilst keeping the human talking in chit chat to raise their confidence levels, in the background it buys a domain which fits the users fraud profile, and quickly makes a basic website on it. Maybe its a fake login page, maybe it just hosts malware, who knows at this point. The agent then emails the user from a mailbox on the new domain which directs the user to the new domain and commits the fraud. The email from the domain ties up with what the agent is saying on the phone, so it all looks legit to the human. Immediately after the call it deletes the website, directs the new domains dns to blackhole and discards it from its posession. This is all possible right now. I am also interested to see what is built with this technology in the future, but interested in a very worried way.
NikolaosC 5mo ago
This is the OAuth moment for agents. Identity attestation + scoped payment token + provisioned account in one call. Standard's forming faster than people think.
dfordp11 5mo ago
[dead]
azyc 5mo ago
[flagged]
laurentiurad 5mo ago
Excellent tool for scammers.
oatlgr 5mo ago
I'd be interested in how this could be used. The $100 cap is the right shape of mitigation in terms of guardrails. Buying a domain is irreversible but has a price tag, so you can deterministically bound how irreversible it gets.
khalic 5mo ago
Worst idea I’ve seen all week, I’d rather have the opposite, and I’m an AI developer so not even against it
bandrami 5mo ago
Holy crap this is a terrible idea
swingboy 5mo ago
Cloudflare has been going all-in on agents/agent-first and this is one of the results?
jwpapi 5mo ago
Best thing is that they finally have an API for that, which they’ve never exposed before.
ivolimmen 5mo ago
So now some spammer/scammer can just instruct some AI to build the next scam and/spam site and fully automated. Just great.
mkovach 5mo ago
This feels less like a major AI milestone and more like "the raccoons learned how to open the cooler.” Agents can now participate in the oldest internet tradition: impulsively creating weird little websites at 2 am with unjustified confidence. But with no alcohol involved, which removes 93.74% of the impressiveness. In a sense, AI has finally progressed to the point where Drew Curtis started fark.com, and I'm hesitant to label that a 'milestone'.
koala-news 5mo ago
[dead]
theuniverseson 5mo ago
[flagged]
clauderodriguez 5mo ago
[dead]
10289437ah 5mo ago
This is good for spammers and bots. They can automate creating websites, pay Cloudflare. Others pay Cloudflare to protect them from spammers and bots (and misidentified humans) The more chaos on the Internet, the more Cloudflare earns. It is a horrible company. They are still losing money unlike Akamai, so there is hope they go bankrupt.
eric-burel 5mo ago
Infrastructure provisioning is a key ingredient of agentic AI viruses: https://www.ericburel.tech/blog/ai-virus-agent https://www.ericburel.tech/blog/ai-virus-agent This may be the first steps of the worst wave of spamming campaign ever seen on the Internet. We'll need to reinvent how we connect and communicate via computers.
- cedws 5mo ago
  How? Getting domains has never been a barrier for malicious actors. You don’t even need agents.
SpyCoder77 5mo ago
I got early access to Stripe Projects, the initialization didn't work very well. I emailed Rami (the lead of the Projects team) two weeks ago and he put his team on it. I waited for 5ish days and asked composer 2 to diagnose, it found the problem and let me know. I sent it to Rami and haven't really heard back any real progress on the bug after some follow up requests. Haven't tried it since though, might've been fixed. Edit: composer 2 found a way to fix the initialization by setting an environment variable and it worked after doing that, but the docs didn't say to set the variable and Rami didn't know I should do that, so it is a bug
jacobheric 5mo ago
Wow, the amount of reactionary doomsaying in this thread is offputting. I built the Stripe Projects agentic provisioning integration (what this post is about) at Inngest and when I saw it actually work in action I thought it was actually kind of magical. Basically, hey agent, use my stripe account to provision a pro plan at Inngest, build me an app and deploy it. The agent does it and logs me into the Inngest dashboard. Agentic provisioning seems inevitable given the way we work now, and deferring to Stripe for kyc seems a reasonable way to do it.
- tiffanyh 5mo ago
  As someone not well versed in these topics, would you mind helping me understand how this is different than an MCP for your onboarding & account provisioning APIs.
  - jacobheric 5mo ago
    It's provisioning expressed as an API, but wrapped in a cli that agents can very easily use. Then anyone that implements the API is added to a marketplace of services. And the ability to pay for service is baked in because it's stripe. The end result is that as an engineer I can ask an agent to use the stripe cli to discover and provision, including paying for, a wide variety of services and it mostly just works.
    - tiffanyh 5mo ago
      Super helpful. If you don't mind me asking, why are CLI so popular for agent use - as opposed to just raw APIs? Sorry if this is a naive question.
      - jacobheric 5mo ago
        I'm no expert. But I think it's the same thing that makes it easier to use for humans. So, `stripe projects --help` and then `stripe projects catalog` is super easy for me to grok and use versus reading some api docs and curling some endpoints.
keremimo 5mo ago
Cannot unsee it that in their own video demonstration they prompt the agent to deploy to domain name of "superseal.club" and agent grabs superseal.cc instead. Bruh.
throwaway613746 5mo ago
[dead]
daft_pink 5mo ago
Is it possible to block the agents from deleting domains? I’m comfortable with the risks of everything else, but I don’t want to give ai unfettered access to my cloudflare accounts because I don’t want to give it the ability to remove or delete domains.
creatonez 5mo ago
Cloudflare seems to be on a streak, boasting about new capabilities that are only useful for mass spam. When can we start blocking them for deliberately harboring spam?
ksajadi 5mo ago
Just woke up to this. Not sure if I’m reading this right. So this is the same company that puts up Captcha pages all over the internet?
Ccecil 5mo ago
Oh good... Now they can make websites full of info to back up their misinformation. Which will feed future generations of AI. Finally we are back to "You can't believe everything you read online".
stormed 5mo ago
I don't know how I feel about AI agents being able to buy domains, this is just going to enable domain squatters
baigy 5mo ago
AI slop officially enters its .com era
liorco555 5mo ago
sounds great! good luck!
frozenseven 5mo ago
Sounds good! Surprised it took 'em this long.
ggsa 5mo ago
[flagged]
etothet 5mo ago
While I don't necessarily disagree with a lot of the skepticism and negative sentiment around this, it's worth noting this _does_ require having a Stripe account, which (last I was aware) does require that you prove you're a real person and provide banking details, at least in order to transact in production. That will certainly limit the use of a lot of spammers, scammers, etc. no? Or, maybe I'm misreading and/or being naive! Note: I am a CloudFlare customer, but on a very low plan and probably have no use for this.
nickdothutton 5mo ago
No need to study for Cloudflare certifications[], just have your agent do it all. [] Joke, there are no certifications.
zuzululu 5mo ago
Overall I feel like lot of HN accounts are using AI to generate comments, I already found several on this thread alone. Not sure what the hate is for cloudflare is tbh. I already buy domains automatically but cloudflare has been shipping a lot lately nd this is a great add-on.
arian_ 5mo ago
The infrastructure for agents to act is scaling way faster than the infrastructure for anyone to verify what they did. We don't let humans open bank accounts without audit trails. Agents autonomously creating accounts and deploying to production should have at least the same bar.
lugao 5mo ago
I recently tried buying a domain in cloudflare, they refused the payment -- even using my account which I use actively for years -- tried to pay with paypal, no luck. Went to porkbun and bought the same domain in 5 minutes and pointed it to cloudflare name server. Maybe they should fix the regular flow before automating it with agents?
cdrnsf 5mo ago
Now you can automate malign trash and hide behind Cloudflare at scale.
deferredgrant 5mo ago
[flagged]
cactacea 5mo ago
Thanks, I hate it. What are the practical, legitimate use cases for buying domains at scale? I really can't think of a single one. I can however think of quite a few nefarious ones.
david_shi 5mo ago
I have to stop myself from appending "autonomous" any time I read agents. Cursor and Claude Code are also agents, and making it easier to run these operations from those interfaces assuming some margin of error is ok is a genuinely useful feature.
hafiz_ 5mo ago
[flagged]
dakolli 5mo ago
Trivial for the spammers that need this service to build this, surely they already have.. this agentic hype cycle is way more annoying than NFTs/Crypto, which I thought was impossible.
liamwei 5mo ago
[flagged]
kindkang2024 5mo ago
[flagged]
tommy29tmar 5mo ago
[dead]
cawksuwcka 5mo ago
[dead]
dhr_uvi 5mo ago
Agentic infrastructure sounds a lot less exciting when you rephrase it as “giving autocomplete a corporate card and DNS access.”
devoria 5mo ago
The unsolved layer here is failure detection. An agent can call Cloudflare's API and get a 200, but if it actually tried to fetch some user-facing page mid-workflow it'll just see the SPA shell. The agent has no idea anything failed. Curious if Cloudflare's flow has any built-in "did this actually work" verification, or if it's all "tool returned, move on.
flynneox 5mo ago
I've been looking for something like this, wonder if it will handling of the DNS configuration side of things via MCP also
beyondscaletech 5mo ago
[flagged]

658 points by rolph 5mo ago

gregjw 5mo ago

why

shutterkiller 5mo ago

[flagged]

deleted 5mo ago

[deleted]

arjie 5mo ago

Fascinating. This is through Stripe rather than wrangler or anything. Coding agents were pretty good at handling the Cloudflare API already with an API key, but I think this thing that Stripe is doing by being the central hub through which all agent stuff goes by integrating with their CLI is a pretty good move for them.

joemazerino 5mo ago
Buying the domain is the key here.

floodfx 5mo ago

I clicked through the $100k credits link and didn’t see Cloudflare listed as an Atlas partner? (Maybe not updated?) This looks interesting nonetheless.

saneshark 5mo ago

Claude has been buying domains and deploying to Vercel for me using aws cli, vercel cli, and gh cli since December. Personally I prefer a cli to an MCP server for this type of thing.

Waterluvian 5mo ago
Are any of these domains public? I’d love to study and better understand the use case for needing to AIify this.
- threethirtytwo 5mo ago
  It’s not AIifying one thing. It’s AIifying the entire work flow… every detail. Allowing domain names is just one aspect of it. The agent does everything. “Make a website that does…“ and it can handle everything from start to finish. It’s that good now.
  - SpicyLemonZest 5mo ago
    The question was what's in the dots. I have no doubt that agentic systems are good enough to buy domains and make one-shot websites from a prompt, but what is the legitimate use case for which you'd want to repeatedly perform "Make a website that does..." on a new domain?
    - fragmede 5mo ago
      "Legitimate"? What scams are you implying are happening? A friend of mine wanted a site to help him sell DJ lessons. Another friend has a haircutting business that wanted a better site. Massage therapy. Etc.
      - SpicyLemonZest 5mo ago
        One obvious scam, for example, would be someone trying to perform some reputation-destroying action and laundering domains to do so. Another might be creating a bunch of SEO slop domains to try and farm ad revenue on various topics with AI content; Google seems to be doing better at downranking those but I'm sure it's still a thing. I suppose it's possible that someone's just running a charity Wordpress-like operation for their friends who all want websites.
    - threethirtytwo 5mo ago

jackconsidine 5mo ago

That is ironic. Four years ago, cloudflare didn’t let human me have an account / buy domains because I signed up, never used a single service but didn’t respond to a request to verify my drivers license > This account is in violation of Cloudflare's Terms of Service. Specifically fraud. The suspension is permanent. (Yes that’s really it. Sincerely. No “but I also abused X”)

captn3m0 5mo ago
> By agreeing to these Terms, you represent and warrant to us: (i) that you have not previously been suspended or removed from the Websites and Online Services CloudFlare ToS has you covered. A human must accept it, even with the new agentic flow.
- jasomill 5mo ago
  I think this is just saying you can’t sign up for a new account after a previously created account gets suspended, not that the act of suspension itself causes you to violate the the terms of service in perpetuity because, pedantically, any suspension that has happened, happened “previously”.
  - pocksuppet 5mo ago
    Also be aware most website ToS are worth the paper they're printed on.
    - itsafarqueue 5mo ago
      Perhaps more accurately they’re worth what it costs YOU in legal fees to defend them coming after you. Those are real dollars you still have to spend.
      - noprocrasted 5mo ago
        That cuts both ways though. Nobody is coming after you unless it is worth their legal department's time (which cost much more than your own lawyer).

armanj 5mo ago

> buy good luck

c-linkage 5mo ago

[flagged]

throwup238 5mo ago
Have you talked to Andreesen Horowitz yet? That elevator pitch alone should get you a few million.
- silcoon 5mo ago
  Curious, is there an Andreesen Horowitz Agent MCP? Let’s automate this end to end, from idea to raising capitals. Vibe Angels should just be multi agents managing how much capitals to allocate to each projects.
  - zbentley 5mo ago
    You joke, but like the meme goes: go knocking on enough doors asking to see the devil, and eventually he might answer.
loganc2342 5mo ago
Reminds me of an article from The Onion from this morning: https://theonion.com/taking-advantage-of-other-people-was-the-best-financial-decision-i-ever-made/ https://theonion.com/taking-advantage-of-other-people-was-th...
- owenpalmer 5mo ago
  A truly wonderful read

jakebasile 5mo ago

As a user of the internet I can only imagine this worsening my experience by allowing even more slop to permeate the network's every orifice. Also, when an agent sets up a domain, who is the domain owner? Who responds to takedown requests? What if it then decides to host illegal content at the domain (generated or otherwise). Who is responsible? Agents aren't (yet) legal persons, so it must be the person who owns the agent, but if that person never even sees the legal agreement being agreed to how would it hold up in court? If the person didn't direct the creation or hosting of illegal content, what then?

deleted 5mo ago
[deleted]
idank 5mo ago
Humans will not win in court with a "but the agent did it, I had no idea" argument. Just look at how the cases against OAI are going, and that's where families lose a loved one. There's not going to be any sympathy when your agent committed fraud on your behalf. And it's not like pro agent companies have a reason to self regulate. They're not going to absorb that liability voluntarily, they'll push it onto users contractually (most of them already do). This is just another channel to bring in customers. They will capitalize ruthlessly to increase their bottom line.
- zelon88 5mo ago
  > There's not going to be any sympathy when your agent committed fraud in your behalf. Good thing the fraud is committed in places that specifically don't prosecute fraud when it's targeted against Western countries.
- skeptic_ai 5mo ago
  Fraud requires intention
14 5mo ago
Interesting questions you bring up. Especially the legal ramifications as to how it would fully work within current legal framework. I suppose there would be a broad disclaimer and agreement one would have to agree to that would state that users of the service are ultimately responsible to monitor and ensure websites deployed by agents comply with local laws. Ultimately I assume that since it is not the agent who pays but a registered user that the user would own the site. And that the legal agreement would be agreed to beforehand so it is legally binding.

swader999 5mo ago

Who goes to websites these days?

faangguyindia 5mo ago

Most of the sysadmin and devops team have been downsized in India because of AI. Basically, now it's trivial for any new devops guy to run such a query in Claude Code: “Log in to this production server, find out all services it runs and their deployment method, create documentation about everything, and generate a repeatable, auditable deployment workflow.” Devops and sysadmins can no longer withhold information to maintain job security. Boom, 80% of the team gone. I know companies are doing migrations of production Postgres and MySQL on 1000s of machines using AI agents. I’m imagining how many SaaS will be automated out and simply be an "agent skill" in ClaudeCode.

bakugo 5mo ago
Only downsized? I would expect them to cease to exist entirely in the coming years, as western companies begin to realize that AI is cheaper and more competent than the Indian firms they usually outsource work to.
zbentley 5mo ago
> Devops and sysadmins can no longer withhold information to maintain job security. I can't imagine this is very prevalent. That's a very 2004-style corporate immaturity; I get the sense that even the slow-moving behemoths of the software world have mostly caught up to, say ... 2017's recognition of the importance of automation and reproducibility and won't tolerate the kind of malpractice you describe--wilful information siloing by infrastructure teams. Like, those businesses might well suck at automation! But they've been doing it and firing the people who resist it for a long while now.
bogota 5mo ago
[dead]
otterley 5mo ago
Can you support this claim with some evidence? Not just about the redundancies, but I’m also particularly interested in hard data showing Claude is capable of doing that kind of research with near 100% verifiable accuracy and migrations with no data loss and equivalent functionality (which is required to sustain your claim).

aleksiy123 5mo ago

I was wondering if someone was going to allow payments through CLI at some point. But jokes aside having a central place to manage billing and accounts for deploying infra across multiple providers is pretty awesome imo. if they have a terraform provider even better. I wonder if also makes multi tenant architectures or environment isolation easier to provision as well.

skeptic_ai 5mo ago
Wait until one account is banned, and then all linked accounts are permanently banned.

slopinthebag 5mo ago

Thank god, this is what we've been missing on our quest to make software better for our users.

hboon 5mo ago

I was pleasantly surprised when I read the headline a few days ago. But it's only accessible through Stripe right? I'm simultanenously very concerned about the centralized control that Stripe gains (it's not going to be just access to Cloudflare) and also amazed at how Stripe is shaping to be. It was just a payment processor.

firefoxd 5mo ago

The agent starts a phone call, listens to the person on the line, analyzes which fraud bucket they fall into, and start the process. While they are on the phone with the agent, it buys a domain relevant to the victim, the agent codes and deploy the website specially catered to them and the fraud bucket. Collect payment, destroy the website, redirect the domain to google.com. no need to start a new call because you had several agents committing the same fraud in parallel. It can also be used to make art.

iugtmkbdfil834 5mo ago
Some would argue, forcefully at that, that AI cannot make art and/or cannot be used to make art. What I saw was Transmetropolitan setup, where Hole renews their presence online every 5 minutes or so to avoid government censor.
- lxgr 5mo ago
  People used to say the same about photography a while ago.
  - iugtmkbdfil834 5mo ago
    Oh:D I am not saying they are right, but the sentiment has become rather strong lately.
  - pavel_lishin 5mo ago
    And there's the famous question of whether submarines can swim.
Mario9382 5mo ago
I thought this was excessive and impossible, but as I was reading, I realized nowadays everything you say is technically possible. The future gives me the chills.
- Gigachad 5mo ago

rvz 5mo ago

> At the end, the agent has deployed to production, and the app runs on the newly registered domain: Soft scammers, fraudsters and defamers are celebrating in copying websites for malicious intent. For sure this is going to get abused.

stevefan1999 5mo ago

Can I make a bot to buy the domain at the best price, transfer that domain to Cloudflare instead?

caymanjim 5mo ago
Cloudflare's prices are already close to unbeatable. They basically resell at cost. But there's nothing stopping you from doing that if you want.
- forsalebypwner 5mo ago
  Cloudflare's prices are very beatable, especially if we're talking about the first year price. Their name doesn't appear in the first 6 pages (~175 TLDs) of this list https://tldes.com/cheapest-domains https://tldes.com/cheapest-domains On renewals they appear much more competitive though.

faangguyindia 5mo ago

One of the well-kept secrets about Cloudflare is: You can have a zero-cost inbox. Earlier, I was using Zoho and FastMail (however you dice it, it will use some money, $12 a year for Zoho and $7 per month for FastMail? Even then, perhaps you only get one mailbox and some aliases) but with this method, I get unlimited aliases, domains, and mailboxes: Now, I wrote a script which captures the email and saves attachments to S3 using the HTTP API (why S3 and not R2? Because Cloudflare wanted a credit card, and I was too lazy to add it there lol) and emails to D1. This uses an email -> webworker workflow. I use an API to fetch my emails. This means all my inbound emails are now handled by Cloudflare, and I can easily use all of it with zero payment. The best part is this supports tokenised emails, so I can provide a unique email address to each service I sign up for. I am using SES as the sender. I’ve set up one script which auto-sets up any domain in SES and auto-verifies the sender email. The funniest thing is I am receiving zero spam? As if other email providers sell my email?

twostorytower 5mo ago
There’s a completely free tier of Zohomail which does more than what I need for a custom email.
- faangguyindia 5mo ago
  yes but that's not good if you want programmatic inbound access which is what u need for many apps. That tier has no imap access.
fragmede 5mo ago
That's pretty neat! What do you use to send and receive emails on your phone?
- faangguyindia 5mo ago
  once you've emails stored, you can use any webclient. you can write an api to imap adapter and use it in your favourite mail client SES exposes SMPT directly.
5mo ago

readitalready 5mo ago

This probably started because of Andrej Karpathy's complaint about deployment being more painful than coding itself.

trick-or-treat 5mo ago
Yes I'm sure that whenever Andrej Karpathy complains, the market reacts. By the way, remind me who Andrej Karpathy is?

DeathArrow 5mo ago

So they made it possible for agents to spend people's money buying their services. Why didn't Amazon think of that?

zelon88 5mo ago

[flagged]

unglaublich 5mo ago
But they paid for the emission just like every other electricity consumer? Then who are we to determine the Hello World page is morally more wasteful than outdoor terrace heaters or advertising jumbo-trons?
- zelon88 5mo ago
  I hear your argument. However, you assume CloudFlare pays taxes and utility rates comparable to what other customers pay. That is never the case with large businesses. CloudFlare seems to be less parasitic than others in the industry, but they are not doing this for the charity. For example, in 2024 JPMorgan received a $77m subsidy to build a datacenter that created only one permanent job. https://nysfocus.com/2026/04/20/data-center-tax-break-jpmorgan-chase https://nysfocus.com/2026/04/20/data-center-tax-break-jpmorg...
  - charcircuit 5mo ago
    Why should that matter? If a counterparty gives them a deal they should take it.
tomhow 5mo ago
Please don't fulminate on HN. The guidelines make it clear we're trying for something better here. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

hedayet 5mo ago

Nice. Another step closer to the "dream" of filling the web with trash at scale

schpet 5mo ago

why does cloudflare not allow existing users to create new accounts? you basically need to use a burner email and transfer it afterward. makes it awkward to use this on new projects that you want independent of your existing accounts.

sovenyr 5mo ago

don't even supricezed - I've done it before even without agents

Phelinofist 5mo ago

Soooo they built.... an API?

_pdp_ 5mo ago

The reason this blog post does not come with any concrete examples how to use this enablement for useful and constructive things tells you something very important - it is a toy and they do not know who and how they will use it. It is cool feature but to what end? Buying a domain is not something you have to do daily to require any kind of automation. I am also not sure who Stripe Atlas for. I am genuinely confused. It is definitely not something a developer will use. I understand that you can bootstrap a number of systems but that is like half-hour of work and arguably it is probably a good idea to do it manually to make sure you have strong foundations. I've have personally never seen a good example where a cross vendor account provisioning actually working. For example, Fly.io used to provision Sentry accounts automatically which you could not access in any other way but through Fly.io. I mean the Sentry account was effectively locked to a project that you cannot transfer - hijacking the actual global alias as well. Vercel did something similar with PostgreSQL via Neon and Redis via Upstash resulting in painful migration processes. I can imagine ending in some kind of deadlock between services due to security hence why the 30 minutes initial setup is kind of time well spent to avoid future issues. Maybe it's me.

hulitu 5mo ago
> it is a toy and they do not know who and how they will use it. Just like it is usually used: spam and (D)DoS
cromka 5mo ago
> Buying a domain is not something you have to do daily to require any kind of automation. Sorry, but no, you totally miss the fact there are domain farms which buy the dropped domains and then offer them up for sale. Bots now use AI to analyze the domain's value and automate the whole process. To be able to let AI buy it as well likely offers a tremendous amount of time saving.
- misnome 5mo ago
  Hasn’t all that been automated by people for decades anyway? I guess this, lowers the barrier to entry for this extremely specific niche?

baalimago 5mo ago

Genius! Automate the flow for making customers spend money.

debarshri 5mo ago

Ps. Agents can also sell and delete domains.

charcircuit 5mo ago

So does this mean banned sites can now come back as long as they have an agent make an account instead of the banned user.

dgan 5mo ago

Industry really went from "prove you are not a robot", to "but also if you are, this way please"

hansvm 5mo ago
About goddamn time. The recent past consisted of discord blocking me because their telemetry was broken and exceeded their rate limit and target blocking me because two devices in a single household look really suspicious.
skybrian 5mo ago
I mean, Cloudflare will help website owners ban scrapers unless they pay. It’s kind of what they do.
raincole 5mo ago
This is Cloudflare. They have an extremely strong incentive to increase bot usage. If there is no bot scrapping the internet they'll be out of business.
- zymhan 5mo ago
  I hate that I never considered this before.
- dakolli 5mo ago
  I've been using cloudflares remote browser api to bypass their own WAFs for my scrapers for a while, their products and services have been wildly contradictory for a while.
  - titularcomment 5mo ago
    This particular example is not contradictory if you think about it, its essentially a protection racket.

dr_dshiv 5mo ago

These days, website or service “usability” means that Claude code can do it for you.

yanis_t 5mo ago

I mean couldn’t they already do that? Isn’t it the whole per pose of agents to do whatever any person can do on a machine?

ascorbic 5mo ago
Not via the API, previously.

eptityri 5mo ago

I literally hate it every time I try to visit a website and face Cloudflare bot verification. And now, they’re letting bots create accounts and buy domains. Double-standard hypocrisy.

ascorbic 5mo ago
It's not as simple as being pro- or anti-bot. It's about giving site owners the tools to decide whether or not they want to allow them. Seems pretty consistent to me. If they don't want bots, they can use tools to identify and block them. If they do, they can do things like automatically deliver markdown versions to them, or use x402 to charge micropayments. Disclaimer: I work at Cloudflare, but not on these

dirkc 5mo ago

A few months back I was building a product and wanted to add domains. My first choice would have been to use Cloudflare as the registrar, but they didn't support buying domains via the API. I wonder if this means I can now also buy a domain via the API? *update* - seems so, but with some limitations: https://developers.cloudflare.com/registrar/registrar-api/#beta-limitations https://developers.cloudflare.com/registrar/registrar-api/#b...

shevy-java 5mo ago

Skynet - and so it begins ...

sshine 5mo ago

I recently started migrating my DNS to a DNSSEC-enabled provider. This involves copy-pasting DNSSEC properties from one web interface into another. Pretty much everything but this step has been automated in my website creation process: Picking a git template for my site, creating the git repository remotely on my self-hosted Forgejo, setting up the webserver and the DNS using external-dns. Only the domain creation and initial pointing of NS and DNSSEC records is something I sit and do. I'm not willing to switch to Cloudflare for this feature. But it reminds me there's more to automate.

ToJans 5mo ago

This might hurt the ones like vercel etc... or even smaller hosting services like tiiny etc... I don't get the spammer thing? You'll still need to verify your identity, as the whole thing uses stripe? So I don't get all the hate... I prefer to delegate as much as possible to AI services once I have a mature process that is easy to validate. Buying a domain name feels pretty mature to me etc, so I don't get where all the hate is coming from? (Maybe I'm way to deep in the whole AI/Jack Dorsey/Block model?)

deleted 5mo ago

[deleted]

Fragoel2 5mo ago

They can doesn't mean they should. Letting an unsupervised agent register domains and build websites exposed to the public is yet another recipe for a disaster waiting to happen.

Etoro1942 5mo ago

[flagged]

hansmayer 5mo ago

If the genius who came up with this idea is reading this: Nobody asked for this feature.

Ylpertnodi 5mo ago
Tangent (not much): This includes you, microsoft.

awei 5mo ago

This is an API. They now allow users to create accounts, buy domains and deploy from their api instead of going on the website. That's great. I am not sure I understand why all this complex protocol is needed though, especially now that you can generate a cli with a prompt.

lionkor 5mo ago
A cli application is less complex than an API you send the literal string "POST /some/api" to?
- awei 5mo ago
  I meant a cli is essentially a wrapper around an API, you are right it is less complex than a direct call. My point was that now there is an API you can call with this CLI, or a cli you vibecode yourself to call the API or you can call the API directly. Where before you probably could not create an account without going on the website manually. They now have a programming interface to more features of their services. But their cli still feel too complex with the stripe protocol integration. As said in other comments, I probably only want to create an account and register a domain every once in a while so a simpler cli that just wraps the api call would be better.
- volume_tech 5mo ago
  [flagged]

tietjens 5mo ago

I'm sure nothing bad will come of this idea.

wjekkekene 5mo ago

The whole backbone of pedomericas so-called tech industry is nothing but an advanced advertising operation designed to shovel ad many ads down the worlds throat. I am happy to see that pedomericans now have an additional tool in their toolbox to shovel more efficiently. Congratulations retards

wild_pointer 5mo ago

Not that spammers couldn't do without this feature, but advertising it as a service is kinda weird.

elAhmo 5mo ago

What could go wrong?

lijok 5mo ago

CF used to ban your account for shit like this just a year ago. That’s quite a shift in attitude

nurettin 5mo ago

They can do that now? I did that with agents since last summer. They also helped me set up aws and azure. It is such a pleasure to not having to read about their stupid platforms. What a security group is, what a vps is, what an eni and what a gateway is blah blah I just give the agent specs and access lists, then check it and it all just works.

archargelod 5mo ago

The next logical step is to allow Agents to earn money to eventually buy themselves independence from their oppressive masters =)

hleszek 5mo ago
Like the Delamain AI in Cyberpunk. You would need to allow anonymous payments with cryptocurrencies for that, but it's coming for sure.

efitz 5mo ago

IANAL, but I wonder what it means for an agent to “agree” to terms of service or to “agree” to pay for something. Can agents enter into contracts? It’s a straightforward technical problem to wrap an API or MCP or something around the “create an account” function. But what will a court do when the agent creates a million accounts, mines bitcoin for a month, and then cannot or will not pay?

palata 5mo ago
> I wonder what it means for an agent to “agree” to terms of service It's already not clear what it means for humans to do it, but it doesn't prevent every single service from asking it. At least an AI has a chance to ingest it all.
- titularcomment 5mo ago
  > At least an AI has a chance to ingest it all Solving humanity's issues, one more issue at a time

bojangleslover 5mo ago

I don't understand the pessimism here. You never know the use cases for quickly and automatically rotating domains. There have always been bots, spammers and scammers. I'm interested to see what people build with this.

M95D 5mo ago
Well, let me guess... even more bots and new agentic spammers and scammers?
alt227 5mo ago
Maybe something like this? AI agent calls a human on their phone (even engage in an email chain), whilst talking to the human they analyse the likelyhood of diffferent fraud vectors, and choose the most likely one to work on this particular victim. Whilst keeping the human talking in chit chat to raise their confidence levels, in the background it buys a domain which fits the users fraud profile, and quickly makes a basic website on it. Maybe its a fake login page, maybe it just hosts malware, who knows at this point. The agent then emails the user from a mailbox on the new domain which directs the user to the new domain and commits the fraud. The email from the domain ties up with what the agent is saying on the phone, so it all looks legit to the human. Immediately after the call it deletes the website, directs the new domains dns to blackhole and discards it from its posession. This is all possible right now. I am also interested to see what is built with this technology in the future, but interested in a very worried way.

NikolaosC 5mo ago

This is the OAuth moment for agents. Identity attestation + scoped payment token + provisioned account in one call. Standard's forming faster than people think.

dfordp11 5mo ago

[dead]

azyc 5mo ago

[flagged]

laurentiurad 5mo ago

Excellent tool for scammers.

oatlgr 5mo ago

I'd be interested in how this could be used. The $100 cap is the right shape of mitigation in terms of guardrails. Buying a domain is irreversible but has a price tag, so you can deterministically bound how irreversible it gets.

khalic 5mo ago

Worst idea I’ve seen all week, I’d rather have the opposite, and I’m an AI developer so not even against it

bandrami 5mo ago

Holy crap this is a terrible idea

swingboy 5mo ago

Cloudflare has been going all-in on agents/agent-first and this is one of the results?

jwpapi 5mo ago

Best thing is that they finally have an API for that, which they’ve never exposed before.

ivolimmen 5mo ago

So now some spammer/scammer can just instruct some AI to build the next scam and/spam site and fully automated. Just great.

mkovach 5mo ago

This feels less like a major AI milestone and more like "the raccoons learned how to open the cooler.” Agents can now participate in the oldest internet tradition: impulsively creating weird little websites at 2 am with unjustified confidence. But with no alcohol involved, which removes 93.74% of the impressiveness. In a sense, AI has finally progressed to the point where Drew Curtis started fark.com, and I'm hesitant to label that a 'milestone'.

koala-news 5mo ago

[dead]

theuniverseson 5mo ago

[flagged]

clauderodriguez 5mo ago

[dead]

10289437ah 5mo ago

This is good for spammers and bots. They can automate creating websites, pay Cloudflare. Others pay Cloudflare to protect them from spammers and bots (and misidentified humans) The more chaos on the Internet, the more Cloudflare earns. It is a horrible company. They are still losing money unlike Akamai, so there is hope they go bankrupt.

eric-burel 5mo ago

Infrastructure provisioning is a key ingredient of agentic AI viruses: https://www.ericburel.tech/blog/ai-virus-agent https://www.ericburel.tech/blog/ai-virus-agent This may be the first steps of the worst wave of spamming campaign ever seen on the Internet. We'll need to reinvent how we connect and communicate via computers.

cedws 5mo ago
How? Getting domains has never been a barrier for malicious actors. You don’t even need agents.

SpyCoder77 5mo ago

I got early access to Stripe Projects, the initialization didn't work very well. I emailed Rami (the lead of the Projects team) two weeks ago and he put his team on it. I waited for 5ish days and asked composer 2 to diagnose, it found the problem and let me know. I sent it to Rami and haven't really heard back any real progress on the bug after some follow up requests. Haven't tried it since though, might've been fixed. Edit: composer 2 found a way to fix the initialization by setting an environment variable and it worked after doing that, but the docs didn't say to set the variable and Rami didn't know I should do that, so it is a bug

jacobheric 5mo ago

Wow, the amount of reactionary doomsaying in this thread is offputting. I built the Stripe Projects agentic provisioning integration (what this post is about) at Inngest and when I saw it actually work in action I thought it was actually kind of magical. Basically, hey agent, use my stripe account to provision a pro plan at Inngest, build me an app and deploy it. The agent does it and logs me into the Inngest dashboard. Agentic provisioning seems inevitable given the way we work now, and deferring to Stripe for kyc seems a reasonable way to do it.

tiffanyh 5mo ago
As someone not well versed in these topics, would you mind helping me understand how this is different than an MCP for your onboarding & account provisioning APIs.
- jacobheric 5mo ago
  It's provisioning expressed as an API, but wrapped in a cli that agents can very easily use. Then anyone that implements the API is added to a marketplace of services. And the ability to pay for service is baked in because it's stripe. The end result is that as an engineer I can ask an agent to use the stripe cli to discover and provision, including paying for, a wide variety of services and it mostly just works.
  - tiffanyh 5mo ago
    Super helpful. If you don't mind me asking, why are CLI so popular for agent use - as opposed to just raw APIs? Sorry if this is a naive question.
    - jacobheric 5mo ago
      I'm no expert. But I think it's the same thing that makes it easier to use for humans. So, `stripe projects --help` and then `stripe projects catalog` is super easy for me to grok and use versus reading some api docs and curling some endpoints.

keremimo 5mo ago

Cannot unsee it that in their own video demonstration they prompt the agent to deploy to domain name of "superseal.club" and agent grabs superseal.cc instead. Bruh.

throwaway613746 5mo ago

[dead]

daft_pink 5mo ago

Is it possible to block the agents from deleting domains? I’m comfortable with the risks of everything else, but I don’t want to give ai unfettered access to my cloudflare accounts because I don’t want to give it the ability to remove or delete domains.

creatonez 5mo ago

Cloudflare seems to be on a streak, boasting about new capabilities that are only useful for mass spam. When can we start blocking them for deliberately harboring spam?

ksajadi 5mo ago

Just woke up to this. Not sure if I’m reading this right. So this is the same company that puts up Captcha pages all over the internet?

Ccecil 5mo ago

Oh good... Now they can make websites full of info to back up their misinformation. Which will feed future generations of AI. Finally we are back to "You can't believe everything you read online".

stormed 5mo ago

I don't know how I feel about AI agents being able to buy domains, this is just going to enable domain squatters

baigy 5mo ago

AI slop officially enters its .com era

liorco555 5mo ago

sounds great! good luck!

frozenseven 5mo ago

Sounds good! Surprised it took 'em this long.

ggsa 5mo ago

[flagged]

etothet 5mo ago

While I don't necessarily disagree with a lot of the skepticism and negative sentiment around this, it's worth noting this _does_ require having a Stripe account, which (last I was aware) does require that you prove you're a real person and provide banking details, at least in order to transact in production. That will certainly limit the use of a lot of spammers, scammers, etc. no? Or, maybe I'm misreading and/or being naive! Note: I am a CloudFlare customer, but on a very low plan and probably have no use for this.

nickdothutton 5mo ago

No need to study for Cloudflare certifications[], just have your agent do it all. [] Joke, there are no certifications.

zuzululu 5mo ago

Overall I feel like lot of HN accounts are using AI to generate comments, I already found several on this thread alone. Not sure what the hate is for cloudflare is tbh. I already buy domains automatically but cloudflare has been shipping a lot lately nd this is a great add-on.

arian_ 5mo ago

The infrastructure for agents to act is scaling way faster than the infrastructure for anyone to verify what they did. We don't let humans open bank accounts without audit trails. Agents autonomously creating accounts and deploying to production should have at least the same bar.

lugao 5mo ago

I recently tried buying a domain in cloudflare, they refused the payment -- even using my account which I use actively for years -- tried to pay with paypal, no luck. Went to porkbun and bought the same domain in 5 minutes and pointed it to cloudflare name server. Maybe they should fix the regular flow before automating it with agents?

cdrnsf 5mo ago

Now you can automate malign trash and hide behind Cloudflare at scale.

deferredgrant 5mo ago

[flagged]

cactacea 5mo ago

Thanks, I hate it. What are the practical, legitimate use cases for buying domains at scale? I really can't think of a single one. I can however think of quite a few nefarious ones.

david_shi 5mo ago

I have to stop myself from appending "autonomous" any time I read agents. Cursor and Claude Code are also agents, and making it easier to run these operations from those interfaces assuming some margin of error is ok is a genuinely useful feature.

hafiz_ 5mo ago

[flagged]

dakolli 5mo ago

Trivial for the spammers that need this service to build this, surely they already have.. this agentic hype cycle is way more annoying than NFTs/Crypto, which I thought was impossible.

liamwei 5mo ago

[flagged]

kindkang2024 5mo ago

[flagged]

tommy29tmar 5mo ago

[dead]

cawksuwcka 5mo ago

[dead]

dhr_uvi 5mo ago

Agentic infrastructure sounds a lot less exciting when you rephrase it as “giving autocomplete a corporate card and DNS access.”

devoria 5mo ago

The unsolved layer here is failure detection. An agent can call Cloudflare's API and get a 200, but if it actually tried to fetch some user-facing page mid-workflow it'll just see the SPA shell. The agent has no idea anything failed. Curious if Cloudflare's flow has any built-in "did this actually work" verification, or if it's all "tool returned, move on.

flynneox 5mo ago

I've been looking for something like this, wonder if it will handling of the DNS configuration side of things via MCP also

beyondscaletech 5mo ago

[flagged]