Cloudflare opened early access to Vulnerability Discovery and Remediation on September 3, a new component of Cloudflare Managed Defense that uses OpenAI Daybreak models to triage and mitigate code-level vulnerabilities Cloudflare Blog.
The service addresses a growing mismatch: scanners now surface thousands of findings, but security teams lack the context to decide which ones matter. Cloudflare’s approach combines Web Assets inventory, Web Application Firewall telemetry, and Workers Observability data with a model-agnostic vulnerability harness that runs reconnaissance, hunting, and validation agents against customer-authorized codebases.
“We can see which routes are active, how much traffic they carry, and what security events surround them,” the Cloudflare team wrote. “When customers enable Vulnerability Discovery and Remediation with WAF, we can also see what rules are already applied and are actively blocking attacks.”
OpenAI’s Daybreak models — including GPT-5.6 Cyber — power the reconnaissance, hunting, and validation stages through the Daybreak Defense Network. Cloudflare joined the Daybreak Cyber Partner Program as a technology partner alongside Palo Alto Networks, CrowdStrike, Cisco, and others, as noted in the Cloudflare blog Cloudflare Blog.
For Cloudflare’s service, the model runs on OpenAI’s servers via Cloudflare AI Gateway; no inference runs at Cloudflare’s edge, and the model cannot apply patches or rules directly. Every proposal passes deterministic checks outside the model — syntax validation, synthetic fixture testing, and scope enforcement — before reaching customer review Cloudflare Blog.
The workflow produces a prioritized list of findings, each with a recommended code patch and, when evidence supports it, a Cloudflare WAF Custom rule scoped conservatively to the method, path, and request details needed to reach the vulnerable code. If a route pattern contains only variables and wildcards, no rule is suggested.
Image credit: Cloudflare
Cloudflare previously described the internal harness in “Build your own vulnerability harness” Cloudflare Blog. That system scans Cloudflare’s own fleet; Vulnerability Discovery and Remediation brings the same pipeline to customer-authorized code.
Early access is invitation-only. Customers interested in the service can request access through Cloudflare Managed Defense Cloudflare.
Previously: Cloudflare ships tools to run AI agents at scale — Cloudflare’s Workers AI platform expanded with new agent tooling in August.
Related: Cloudflare can now flag AI agent traffic across company networks — Cloudflare added AI agent detection to its network analytics in August.
