Cloudflare links vulnerability discovery to defense with OpenAI

Cloudflare, which proxies roughly a fifth of web traffic, is running OpenAI models through Daybreak inside an early-access service called Vulnerability Discovery and Remediation, part of Cloudflare Managed Defense. The models investigate customer-authorized code and flag likely vulnerabilities. Cloudflare then layers in production signals: is the vulnerable route live, is it drawing suspicious traffic, do existing controls already cover it.

The output is proposed code patches and, where it fits, custom firewall rules to cut exposure while developers review a fix. Cloudflare runs automated checks and human review before customers see anything, and customers decide what to apply.

This is the version of AI security we want to see more of. Finding bugs is getting cheap; this week's PHP disclosures proved that. The hard part is deciding which of thousands of findings matter today. Pairing a code-level finding with live traffic evidence answers that question in a way a scanner alone cannot. A firewall rule as a stopgap while the real patch is reviewed is also exactly the bridge most teams lack.

The guardrails are reasonable on paper: authorized code only, automated checks, Cloudflare review, customer control over changes. We'd still flag the concentration. One network operator, using one lab's models, seeing customers' source code and proposing fixes for a large slice of the web creates a very valuable target and a single point of failure. A wrong patch or an overbroad rule pushed widely could break things at scale.

The Codex numbers deserve a skeptical ear. Cloudflare's Mark Anderson says a four-developer team rebuilt a postponed product in three days on $1,100 of tokens, work he estimates would otherwise have taken maybe ten times the developers. Every developer at the company, he says, uses Codex. That's a striking anecdote from a customer story, not an audited study, and we don't know what the product was or how much review followed.

Our read: strong, practical defense work with sensible human checkpoints. I'm watching whether customers actually keep reviewing AI-proposed patches carefully once the volume rises and approving becomes a habit.

Cloudflare says it blocked an average of 234 billion cyber threats daily in the first quarter of 2026. Daybreak is OpenAI's offering for access to its models for security work; this is an OpenAI customer story, and the service is early access.