Cloudflare pairs production context with OpenAI models to prioritize vulnerabilities

Cloudflare has opened early access to Vulnerability Discovery and Remediation, an invitation-only service within Cloudflare Managed Defense. It uses OpenAI Daybreak models, including GPT-5.6 Cyber, to inspect customer-authorized codebases, hunt for weaknesses, validate findings, and suggest fixes.

The key distinction is context. Rather than treating every scanner alert equally, the service connects source-code analysis with Cloudflare Web Assets, WAF data, Workers routes, observability metadata, traffic levels, and recent security events. A vulnerability affecting a heavily used endpoint with signs of active probing could therefore move ahead of an equally serious issue in an inactive or protected route.

From finding to mitigation

The workflow begins by mapping request paths to the code that handles them. Hunter agents then investigate targeted sections of the codebase, while validation checks whether reported issues are supported by evidence in the source. Cloudflare says network activity can increase a finding’s risk rating, but traffic context alone does not prove that a vulnerability exists.

For each prioritized issue, the system can propose a code patch and, where appropriate, a narrowly scoped WAF Custom Rule. Those rules can provide temporary protection while developers review the code change. Customers remain in control: proposed patches and mitigations are presented for approval, rather than being applied automatically unless customers have separately authorized Cloudflare to defend their zone.

For teams building and operating AI-assisted security workflows, the announcement points to a broader shift: model output becomes more useful when paired with deployment evidence and an enforcement layer. It also shows why validation and human review remain central as AI makes vulnerability discovery faster—and potentially increases the volume of alerts developers must triage.

Source: CloudFlare