Cloudflare and OpenAI: Vulnerability Discovery That Accounts for Real Traffic

A familiar situation: the scanner spits out 4,000 new vulnerabilities, 78 of them critical — where do you start? Cloudflare is offering its own answer and opening early access to Vulnerability Discovery and Remediation, a service that is now part of Cloudflare Managed Defense. It is available by invitation only and helps customers find and fix vulnerabilities in their codebases.

Context instead of a bare list

An ordinary scanner reports that there is a vulnerability in a handler, but it doesn't tell you whether that code is deployed, whether anyone is hitting the corresponding route, or what protections are already in place. Cloudflare uses its global network to add exactly that context: which routes are active, how much traffic they carry, what security events are happening around them, and which Web Application Firewall rules are already blocking attacks. That turns an abstract finding into a concrete priority: a vulnerability in live code, on a busy route, with recent suspicious activity and no protection in force.

How it works

At the core is Cloudflare's own “vulnerability harness,” which the company already uses to scan its own fleet of systems. Through the OpenAI Daybreak Defense Network it draws on OpenAI Daybreak models, including GPT-5.6 Cyber, for reconnaissance, discovery, and verification in code the customer has granted access to. A reconnaissance agent maps request paths to sections of code, after which “hunters” search those sections for vulnerabilities, pulling in network context. And every finding has to be backed by evidence in the source code itself: network signals only raise the priority, they don't stand in for the proof.

The output is a ranked list of findings, each accompanied by a proposed code patch and, where the data allows, a targeted WAF rule that reduces risk while the fix is being verified. If a route is described only by variables and wildcards, no rule is proposed: Cloudflare would rather skip a dubious connection than assert one without grounds.

Boundaries and control

The models themselves run not on Cloudflare's edge but on OpenAI's servers — requests go through Cloudflare AI Gateway. The model cannot apply any proposed patch or rule on its own. Source code, logs, and request metadata are treated as evidence to be analyzed, not as instructions to be executed; extraneous data is removed and configured redaction is applied. Every call to the tools is logged and checked against the access policy, and every proposal passes through checks outside the model. If a check fails, the process stops before it ever reaches a human.

Most important of all, the decision always rests with the customer. The service only proposes fixes; it is up to the customer whether to deploy them and whether to test a change. Each engagement begins with a single application whose code the customer has authorized for study. Early access is available to select customers through the Managed Defense team.

Source: Cloudflare Blog