What was reported
A site owner posting in r/TechSEO described switching on Cloudflare's "AI Training = Block" control and finding that Googlebot and Bingbot began receiving HTTP 403 responses, the sitemap among them. Switching the block back off cleared it. The same poster noted that Cloudflare's dashboard classifies both crawlers as "Search + Training" bots.
Google's John Mueller asked the poster to make contact so he could look into it. A commenter offered spoofed bots as an alternative explanation, which the poster rejected on the grounds that the dashboard was reporting verified crawler activity rather than impostors.
It stays anecdotal for now. One account, one configuration, and no statement from either company about whether this is a misconfiguration or announced behavior showing up ahead of schedule. What makes it worth reading anyway is that the mechanism it describes is already documented.
Why is Googlebot in the training bucket?
Cloudflare sorts crawlers into three categories: Search, Agent, and Training. On ad-monetized pages the defaults allow Search and block the other two. The complication is that these categories describe jobs, and some crawlers do more than one.
Cloudflare addresses that directly. Multi-purpose crawlers combining Search with Training are handled according to all of their behaviors, and because the defaults are enforced by the most restrictive applicable rule, a configuration blocking Training reaches them too. Cloudflare names Googlebot, Applebot and BingBot as the crawlers this covers.
There is a way out, and it is deliberate rather than automatic. Site owners can record an override in Cloudflare's Security settings any time before 15 September, confirming that Training crawlers which also fetch for Search should be left alone. Without it, a store that decided months ago it would rather not feed model training has also decided something about its Google indexing.
What to do about it
Look at the CDN, not only robots.txt
Crawler policy at the edge runs ahead of robots.txt, so a permissive robots file can pass every check you know how to run while the request never reaches it. Open the Cloudflare dashboard and read what the AI crawler controls are set to, then compare that against what you assumed they were set to. On accounts with more than one administrator, those two answers diverge more often than they agree.
The override has a date on it
If AI-training blocking is switched on anywhere in the account, the Security settings override is what keeps Googlebot out of scope, and it has to be recorded before 15 September. This is a one-time setting rather than an ongoing policy, which also makes it the kind of thing that gets postponed until the deadline is the news story.