Cloudflare checks AI-found code flaws against live traffic

Cloudflare now takes a flaw that an OpenAI model finds in a customer’s code and checks it against production: is the affected route active, is it drawing suspicious traffic, and do existing security controls already protect it? OpenAI described the setup in an October 21 post.

The service is called Vulnerability Discovery and Remediation. It is in early access as part of Cloudflare Managed Defense, and it pairs OpenAI models accessed through Daybreak with Cloudflare’s global network and threat context, OpenAI wrote in its customer story. Cloudflare proxies roughly 20% of the web’s traffic.

Cloudflare explains the problem in its own launch post, where it calls the service invitation-only. A scanner flags a vulnerability in a handler, but it can’t tell you whether that code is deployed, whether anyone is hitting the route, what security activity surrounds it, or what controls are already in place. So teams rank findings with no evidence of production exposure. Cloudflare adds that language models can now surface weaknesses across a codebase in minutes, so the number of findings keeps climbing, while attackers can use AI to speed up parts of discovery and exploitation.

Through the OpenAI Daybreak Defense Network, Cloudflare runs Daybreak models, including GPT-5.6 Cyber, for reconnaissance, hunting and validation on codebases customers authorize it to access. The models look into the code, flag potential vulnerabilities and check the evidence behind each finding. Cloudflare’s network then supplies what a scanner lacks: which routes are active, how much traffic they carry and what security events surround them. If a customer also enables the service with Cloudflare’s web application firewall (WAF), Cloudflare can see which rules are already applied and actively blocking attacks. The service works across Cloudflare Workers and proxied applications.

Each finding comes with a proposed code patch and, where appropriate, a custom WAF rule. The rule runs at Cloudflare’s edge, before requests reach the application, and reduces exposure while developers review the fix. Cloudflare runs automated checks on each patch and mitigation, and its team reviews them before anything goes to the customer. The customer still decides which changes ship.

Cloudflare earlier described a model-agnostic pipeline it uses to scan its own fleet, adversarially validate every finding and turn raw model output into fixes engineers can trust. It calls that internal system one pillar of the new service.

Where Daybreak fits

The code-analysis half resembles what OpenAI already sells. When OpenAI launched Daybreak, The Hacker News reported that it uses Codex Security to build an editable threat model of a repository, test vulnerabilities in an isolated environment and propose fixes. In September OpenAI’s Codex Security Cloud was already scanning connected GitHub repos and drafting patches for review. What Cloudflare adds appears to be the production side: traffic, security events and edge rules.

The model names have moved since launch. The Hacker News described Daybreak as built on three GPT-5.5 models: GPT-5.5 with standard safeguards, GPT-5.5 with Trusted Access for Cyber for verified defensive work in authorized environments, and GPT-5.5-Cyber, a permissive model for red teaming, penetration testing and controlled validation. The outlet also listed Cloudflare among the companies already integrating these capabilities under the Trusted Access for Cyber initiative, alongside Akamai, Cisco, CrowdStrike, Fortinet, Oracle, Palo Alto Networks and Zscaler. Cloudflare’s own post now names GPT-5.6 Cyber as one of the models it runs.

Codex inside Cloudflare

“Traditional security teams have a ton of useful data. They just don’t have the people and time to deal with it,” says Mark Anderson, Cloudflare’s President of Revenue. He presents the automation as a split of labour: “you can assign machines to do the grunt work so humans can exercise their judgment on the most important engineering and security decisions.”

The other half of the post covers Codex across Cloudflare’s engineering organization. By Anderson’s count, a third of the company are software developers, and “100% of them use Codex to boost their output and deliver better code.” He links that use to greater productivity, better code quality and fewer bugs introduced during development.

His main example is a rebuild of a product the team had kept postponing. “We were putting off building it because we didn’t have the manpower to do it,” he says. Anderson estimates the work would have needed months of sequencing and “maybe 10x more developers.” Instead, a team of four took it on with Codex: “We built it in three days, rolled it out and tested it, and spent $1,100 on tokens.”

For Anderson, the change is in the process more than the tool. Making AI part of everyday engineering, he says, means “rebuilding the internal process to build technology with machines in mind, not as a separate element, but as something that’s integrated into the build process.”