Cloudflare Launches AI Vulnerability Discovery Service With OpenAI Daybreak Models

Cloudflare Uses AI to Find, Prioritize and Help Fix Software Vulnerabilities Before Attackers Can Exploit Them

Cloudflare has announced a new cybersecurity service designed to help organizations discover, investigate and remediate software vulnerabilities using artificial intelligence.

Called Vulnerability Discovery and Remediation, the service is being introduced through Cloudflare Managed Defense in early access.

The system combines source-code analysis with production traffic, Web Application Firewall data and security signals. It also uses OpenAI Daybreak models, including GPT-5.6 Cyber, for reconnaissance, vulnerability hunting and validation.

The important difference is that Cloudflare is not positioning the system as another vulnerability scanner that simply produces a long list of possible problems.

Instead, the company wants the system to determine which vulnerabilities matter most in the real world.

That means looking at the code, understanding which routes are actually being used, checking relevant security activity and determining whether existing protections are already blocking potential attacks.

What Is Cloudflare Vulnerability Discovery and Remediation?

Cloudflare's new service is designed to investigate customer-authorized codebases and connect discovered vulnerabilities with information from production environments.

Traditional vulnerability scanners can produce thousands of findings.

The problem is that a vulnerability in unused code may not be as urgent as a vulnerability affecting a heavily used API endpoint that is currently receiving suspicious traffic.

Cloudflare's approach attempts to add that missing context.

The service can examine:

Source code
Active application routes
Production traffic
Web Application Firewall activity
Security events
Workers information
Vulnerability findings
Potential code patches
Possible WAF mitigations

This gives security teams a more practical way to prioritize vulnerabilities.

Cloudflare says the service is designed to identify high-risk vulnerabilities and prepare potential fixes while keeping customers in control of deployment.

Why Production Context Matters

A vulnerability scanner normally answers an important question:

Does this code appear to contain a security weakness?

Cloudflare wants to answer another question:

How important is that weakness in the real production environment?

That difference can be significant.

Imagine an organization receives 4,000 vulnerability findings.

Among them are 78 critical findings.

A security team still has to determine which vulnerabilities should be investigated first.

Cloudflare's system can use network and security information to help establish that priority.

For example, a vulnerability may become more urgent when:

The affected route is actively used.
The route receives significant traffic.
Recent security activity targets the route.
The application has no existing WAF protection.
The vulnerable code is directly connected to an exposed endpoint.

This creates a risk picture that goes beyond static code analysis.

How the AI Vulnerability System Works

Cloudflare describes Vulnerability Discovery and Remediation as a multi-stage process.

Step 1: Collect Application Context

The system first gathers information from Cloudflare's Web Assets and WAF systems.

This can show which application routes are active and how much traffic they receive.

Security events can also provide additional information about whether a particular route has recently attracted suspicious activity.

This information becomes part of the investigation context.

Step 2: Analyze the Source Code

The system then performs source-code vulnerability analysis.

Cloudflare says its vulnerability harness can investigate authorized codebases and identify potential weaknesses.

For Cloudflare Workers, the system can retrieve the latest Worker source and configured routes.

It can then connect those routes with production information from Cloudflare's infrastructure.

This helps the system understand how the code being investigated relates to actual application traffic.

Step 3: AI Reconnaissance

The system uses a reconnaissance agent to map application request paths to relevant parts of the codebase.

The purpose is to narrow the investigation.

Instead of treating the entire codebase as one large target, the system can identify which sections are connected to specific production routes.

This allows additional AI agents to investigate relevant sections of the application.

Step 4: Vulnerability Hunting

Cloudflare says specialized hunter agents investigate sections of authorized code for potential vulnerabilities.

These agents can use available network context during their investigation.

However, production context does not automatically prove that a vulnerability exists.

Cloudflare says findings still need to be corroborated by evidence in the source code.

That distinction is important because AI security systems can otherwise generate large numbers of false positives.

OpenAI Daybreak Models Power the AI Investigation

One of the most notable parts of the announcement is the integration with OpenAI's Daybreak models.

Cloudflare says GPT-5.6 Cyber is used during reconnaissance, hunting and validation.

The model does not run directly at Cloudflare's edge.

Instead, Cloudflare sends authorized model prompts through Cloudflare AI Gateway to OpenAI's Daybreak models running on OpenAI's servers.

Cloudflare says the investigation remains narrowly scoped.

Only source code and evidence authorized by the customer are used.

The company also says information unnecessary for the investigation can be removed and configured redaction controls can be applied before information reaches the model.

AI Does Not Automatically Deploy Its Own Fixes

This is one of the most important parts of Cloudflare's approach.

The AI can propose a code patch.

It can also propose a WAF mitigation.

But the model itself does not have unrestricted authority to modify the customer's environment.

Cloudflare says every proposed patch and mitigation goes through checks before being presented for review.

If validation fails or the result is ambiguous, the output is held back.

The customer then decides whether a proposed change should actually be tested or deployed.

This creates a workflow closer to:

AI discovers → AI investigates → AI proposes fix → automated checks → human review → deployment decision

rather than:

AI discovers → AI changes production automatically

That distinction could be critical for enterprise security.

Cloudflare Can Also Suggest WAF Protection

The service is not limited to code patches.

When the evidence supports it, Cloudflare can prepare a custom WAF rule that can help reduce exposure while engineers review the underlying code vulnerability.

This could be useful when a company needs immediate protection but cannot deploy a permanent code fix instantly.

For example, if vulnerable code is connected to an exposed route, a carefully scoped WAF rule may provide an additional defensive layer while developers work on the application-level fix.

Cloudflare says these rules are scoped conservatively around factors such as the HTTP method and request path.

The company says it would rather avoid suggesting a rule when evidence is insufficient than make an unsupported connection.

Why This Is Different From a Normal AI Coding Tool

AI coding assistants can already inspect source code and suggest fixes.

Cloudflare's system is different because it connects code analysis with live application context.

A normal coding assistant might identify a potentially unsafe function.

Cloudflare wants its security workflow to determine whether that code is actually connected to an active production route and whether that route is receiving suspicious activity.

This gives the AI more information about the operational importance of a finding.

It also creates a bridge between development and security operations.

Instead of vulnerability discovery being a separate process from production defense, both can become part of the same workflow.

The Service Can Help Prioritize Vulnerabilities

One of the biggest problems facing security teams is vulnerability overload.

Organizations can have enormous numbers of dependencies, applications and APIs.

A scanner may identify hundreds or thousands of possible issues.

But a security team has limited time.

Cloudflare's system attempts to rank findings based on evidence.

A vulnerability affecting an active, heavily used route could receive more attention than one located in code that is never reached.

Similarly, a route receiving suspicious traffic may deserve immediate investigation.

This could help security teams move away from simply counting vulnerabilities toward understanding their actual exposure.

AI Agents Are Becoming Part of Cybersecurity Workflows

Cloudflare's announcement also shows how AI agents are moving into security operations.

The system uses different stages for reconnaissance, hunting and validation.

That is closer to an agentic workflow than a simple chatbot.

The agents can investigate specific areas, collect relevant information and return findings to the larger vulnerability-analysis process.

However, Cloudflare has placed boundaries around those capabilities.

Tool calls are logged and checked against investigation policies.

Proposed patches and rules also have to pass checks implemented outside the model.

This approach reflects a broader trend in enterprise AI.

Companies are increasingly giving AI systems access to real tools, but they are also adding authorization and validation layers around those actions.

Security Teams Still Remain in Control

Cloudflare's service is not being presented as a replacement for security engineers.

Instead, it is intended to reduce the manual work involved in investigating large numbers of vulnerabilities.

Human teams still make important decisions.

They can review:

Vulnerability evidence
Risk prioritization
Suggested code patches
Proposed WAF rules
Validation results
Deployment decisions

That human-review step is particularly important for security because an incorrect automated fix could create a new problem.

The goal is therefore to accelerate the investigation and remediation process rather than remove humans from it.

Who Can Use Cloudflare's New AI Security Service?

The service is currently in early access through Cloudflare Managed Defense and is available to selected customers by invitation.

Cloudflare says each engagement begins with an application whose codebase the customer authorizes the company to investigate.

The system can use authorized access to relevant Cloudflare information, including Web Assets, WAF controls and Workers-related telemetry where available.

The investigation is semi-automated, but customers review results before deciding whether to test or deploy changes.

This means it is currently more of an enterprise security service than a general-purpose AI tool that anyone can sign up for.

What Cloudflare's Launch Means for AI Cybersecurity

Cloudflare's announcement points to an important change in how AI can be used for cybersecurity.

The first generation of AI security tools focused heavily on analyzing logs, detecting suspicious patterns and helping security analysts investigate alerts.

The newer generation is becoming more active.

AI can now participate in:

Code investigation
Vulnerability discovery
Security validation
Risk prioritization
Patch generation
WAF rule generation
Security remediation

The important question is no longer simply whether AI can find a vulnerability.

The bigger question is whether AI can help determine which vulnerability matters, explain why it matters and safely prepare a solution.

Cloudflare is attempting to build that entire workflow into one service.

How It Compares With Other AI Security Platforms

Cloudflare is entering a rapidly developing AI security market.

Your existing TheInfoBytes coverage already includes products such as Operant AI's Semantic Firewall, which focuses on controlling AI-agent actions, and OpenAI's Daybreak initiative for cybersecurity.

Cloudflare's new service sits in a different part of the security workflow.

Cloudflare

Focuses on discovering vulnerabilities in authorized application code and connecting findings with production traffic and WAF security context.

Operant AI

Focuses more directly on controlling AI-agent intent and preventing dangerous actions before they execute.

OpenAI Daybreak

Focuses on broader AI-powered cybersecurity capabilities and expanding access to advanced AI for defenders.

These products can therefore be viewed as different layers of the growing AI cybersecurity ecosystem.

Why Developers Should Pay Attention

The launch is also relevant to developers.

Security vulnerabilities are often discovered after applications have already been deployed.

That can create a gap between development and production security.

A system that connects code analysis with production telemetry could help developers understand which vulnerabilities are actually exposed.

It may also shorten the path between:

Finding a vulnerability → understanding its impact → preparing a fix → reducing exposure

That could become increasingly important as software becomes more complex and development teams rely more heavily on AI coding tools.

What Businesses Should Watch Next

The biggest question is whether AI-powered vulnerability remediation can operate reliably at enterprise scale.

AI can analyze code quickly, but security requires a high level of accuracy.

False positives waste time.

False negatives can be dangerous.

Incorrect patches can introduce new vulnerabilities.

Cloudflare's use of validation layers and human review is therefore an important part of the service design.

If the approach proves effective, similar workflows could become common across application-security platforms.

Security tools may increasingly move from simply reporting problems toward helping organizations investigate and remediate them.

Cloudflare's Vulnerability Discovery and Remediation is a significant development in AI-powered cybersecurity because it combines several pieces that are normally separated.

It connects source-code vulnerability analysis with production traffic, WAF information and security events.

It uses OpenAI Daybreak models, including GPT-5.6 Cyber, to support reconnaissance, hunting and validation.

Most importantly, it can prepare potential code patches and edge mitigations while keeping humans responsible for final deployment decisions.

The service is still in invitation-only early access, so its long-term effectiveness has not yet been demonstrated publicly at broad scale.

But the direction is clear.

AI cybersecurity is moving beyond alert analysis.

The next generation of security platforms will increasingly use AI to investigate vulnerabilities, understand their real-world exposure and help teams move from detection to remediation faster.

For organizations struggling with growing vulnerability volumes, that could become one of the most valuable applications of agentic AI.

FAQs

What is Cloudflare Vulnerability Discovery and Remediation?

It is a Cloudflare Managed Defense service that uses AI-assisted code investigation and production security context to discover, prioritize and help remediate software vulnerabilities.