A security widget without backend verification is decoration. Make the agent prove the control.

Cloudflare says Turnstile now processes about 3 billion verifications on a typical weekday, yet a widget that never reaches server-side Siteverify does not protect the request. Turnstile Spin is designed around that gap: an AI coding agent wires the visible challenge and the backend verification together, then validates the result.

The useful security lesson is not that an agent can install a CAPTCHA. It is that security controls increasingly need an executable definition of done. A page can look protected while the enforcement path is absent, so installation success cannot be the acceptance test.

Visible controls are not enforcement

Turnstile has two parts. The frontend obtains a token; the backend sends that token to Siteverify and decides whether the protected action may continue. Cloudflare's documentation is explicit that omitting the second step leaves the widget ineffective even though users can see it.

Spin gives the coding agent the insertion points and canonical verification pattern. Cloudflare says the agent proposes a plan before changing code, while validation remains in the application's backend rather than moving into Cloudflare-managed application logic.

A security control is not installed when its interface appears. It is installed when the enforcement path fails closed.

Make the acceptance test adversarial

Cloudflare's validation flow does more than check that Siteverify returns success. It sends a real token through the protected endpoint and then replays that token to confirm the second request is rejected. That turns a configuration task into a behavioural test of the control boundary.

The same pattern should govern agent-installed security changes elsewhere. Define the expected failure behaviour before the agent edits anything: an expired credential must fail, an unauthorised identity must be denied, a reused token must be rejected, and a missing verification service must not silently permit the action.

Give agents proofs, not configuration checklists

Teams adopting coding agents should encode security work as assertions that can be executed after the change. A pull request saying that authentication, bot protection or policy enforcement was added is weaker evidence than a test showing that the protected operation succeeds once under valid conditions and fails under the corresponding abuse case.

That also changes review. The human approver can inspect the proposed code and the evidence produced by the validation step instead of inferring protection from files, middleware names or dashboard state. Agent autonomy becomes safer when completion is tied to observable enforcement.

Turnstile Spin is a narrow implementation, but the operating model is broader: let the agent automate the wiring, then require a machine-checkable proof that the control actually governs the request path.

Written by the Devence Lab research team.