The company celebrated its 16th birthday by unveiling how it is constructing a more resilient Internet amid fundamental shifts in how traffic flows and applications operate. As founders Matthew and Michelle noted in this year's letter, the Internet experienced transformative changes, with automated systems generating more activity than human users for the first time. Artificial intelligence is enabling developers to build at unprecedented scale, while agent-driven recommendations increasingly shape consumer behavior—a trend Cloudflare sees as requiring new approaches to ensure emerging businesses can compete.
The company shipped 46 announcements across five days, each addressing a distinct aspect of Internet infrastructure and application development. The rollout began Monday with open-source commitments, shifted Tuesday toward security and cryptographic readiness, explored Wednesday's economic models for agent-driven services, expanded Thursday's developer capabilities, and concluded Friday with performance and observability improvements. Interns contributed directly to multiple projects unveiled during the week, including EmDash, post-quantum visibility tools, CryptoLabe, and Protected Quick Tunnels—part of a broader initiative announced one year prior to hire 1,111 interns.
Monday: Open-source infrastructure and developer tools
Cloudflare introduced a new command-line interface alongside the pipeline used to generate it, along with SDKs and documentation, demonstrating its approach to supporting both human developers and AI agents. The cf CLI mirrors the Cloudflare API, outputs JSON by default, and uses typed configuration to provide a unified interface.
Additional open-source releases included Forge, a pluggable pipeline that runs in continuous integration to generate SDKs, CLIs, and documentation directly from API specifications. EmDash, an Astro-based serverless content management system, executes plugins in isolated Worker sandboxes with explicitly defined capabilities. VoidZero, since joining Cloudflare, has delivered more than 80 releases across the Vite ecosystem, with its previously commercial Void platform transitioning to full open-source availability.
The company also released Vinext 1.0, converting an AI-developed prototype into a production-ready, portable runtime for Next.js applications on Vite. Kitesurf, a Workers-based browser for agents, gained WebMCP support, improved DOM operations, broader web compatibility, and terminal-based rendering capabilities. BEACON made billions of anonymized real-user performance measurements from 10,000 major websites accessible as a public BigQuery dataset.
Experimental support for Emscripten as a compilation target enables developers to bring native Rust libraries and applications—including progress toward Tokio compatibility—to Workers. The Cold Start program offers five early-stage companies the chance to pitch at Cloudflare Connect and compete for resources to support growth.
Tuesday: Cryptography, post-quantum readiness and AI-driven security
Cloudflare announced its intention to become a public certificate authority, a move intended to add resilience to free, automated certificate issuance twelve years after launching Universal SSL. The planned CA will issue free Merkle Tree Certificates designed to make post-quantum authentication practical without imposing substantial costs on certificate size and handshake overhead.
CryptoLabe uses artificial intelligence to locate and classify cryptographic implementations across Cloudflare's codebase as the company works toward completing its post-quantum migration by 2029. The company helped develop an IETF extension that authenticates the full IKEv2 transcript and prevents attackers from downgrading post-quantum IPsec tunnels. HTTP Analytics, Log Explorer, and Logpush now display whether requests negotiated post-quantum key exchange, enabling customers to inspect and report on adoption.
Application Profiles learns the expected structure of HTTP requests, allowing customers to identify deviations and enforce what constitutes valid application traffic. An adaptive AI red-team system uncovered WAF detection gaps across six attack categories, informing improvements to normalization and managed rules. Threat Signals converts open-source reporting into structured indicators and connects context to WAF rules, while the Threat Events Platform expanded to all accounts.
Wednesday: Economic models for the agent-driven Internet
Cloudflare unveiled Pay Per Use and released its Monetization Gateway in beta, introducing new economic structures that enable creators to monetize content and services accessed by AI agents. As agent requests have grown rapidly, the company's strategy allows creators to set terms for access and receive payment when agents use their work.
Containers gained faster startup times, flexible image and instance selection, new scheduling controls, and filesystem snapshots for persistent agent workspaces. The Monetization Gateway permits sellers to set prices on resources behind Cloudflare and collect payments from agents using HTTP 402 and x402. Pay Per Use provides enrolled publishers with usage reports, billing, and payouts when verified AI buyers access their content.
A redesigned domain-search experience and expanded Registrar APIs simplify domain searching, registration, transfer, and management for both people and agents. AI Gateway User Insights identifies tasks, model fit, and overuse patterns, enabling teams to determine where smaller or less expensive models may suffice. Issues groups Workers errors and routes relevant stack traces, logs, and traces to coding agents or any webhook for faster investigation.
Auto Router classifies each request at the edge and directs it to an appropriate model, reducing costs while maintaining response quality. Initiatives including Project Galileo, the Athenian Project, and Cloudflare for Campaigns have now delivered more than $100 million in donated services.
Thursday: Expanding the developer platform
Cloudflare announced general availability for Basin, its serverless data analytics platform built on Apache Iceberg and R2 for ingesting, managing, and querying large datasets. The company also launched K2, a durable serverless event stream, and announced a new developer contest inviting teams to build a Git platform designed for agent-driven development.
Workers added opt-in native Web Crypto support for ML-KEM and ML-DSA, providing developers with post-quantum primitives without requiring them to bundle custom implementations. AI Search reached general availability with visual search, OCR for scanned PDFs, larger file support, and compatibility with any chat model. Artifacts entered open beta alongside the competition for building an agent-focused Git platform.
K2 provides durable, ordered event streams on R2, decoupling producers and consumers without the operational burden of managing broker clusters. Cloudflare OS offers an agent workspace connected to an organization's data and systems, with a waitlist open for fully managed deployments. Workers KV Instant delivers sub-two-millisecond p99 reads and rapid global replication across more than 300 locations using the familiar Workers KV API.
The company is expanding local open-source model options and model-agnostic security tools, enabling nations to pursue AI sovereignty without isolation. Clef and Clef-flash are open-source decision models for rapid classification and agent workflows, accompanied by a platform for reinforcement-learning fine-tuning.
Friday: Performance, observability and accessibility
Cloudflare concluded the week with eight updates to its observability platform, consolidating logs, traces, analytics, alerts, dashboards, querying, and telemetry export with simplified pricing. Cloudflare Traces provides request-level visibility across security rules, transformations, cache, Workers, services, and origins without requiring an agent or SDK.
One year after pledging broader access, Logpush, multi-account governance, higher platform limits, and other capabilities are now available to more customers across pricing tiers. A self-serve OHTTP Gateway entered closed beta, while Privacy Gateway was renamed Cloudflare OHTTP Relay to clarify the distinction between the two roles. Account Abuse Protection uses stateful analysis and privacy-preserving Hashed User IDs to help teams investigate credential stuffing and fake-account creation.
Quick Tunnels now support email authentication, allowing developers to share a local application with selected people or domains without requiring Cloudflare accounts. Civil society organizations are leveraging Cloudflare's developer platform to automate and scale work protecting human rights and the public interest. Using an expanded real-user measurement methodology, Cloudflare now ranks as the fastest provider across 74% of the top 1,000 networks.
AI Gateway's Web Search API brings current web context from multiple providers into model calls through REST APIs, Workers bindings, or customer-managed keys. Streamline, an open-source example for building continuous video pipelines, combines Workers, Durable Objects, and a containerized media engine.
Building forward
Throughout the week's announcements, a consistent message emerged: the Internet should continue expanding opportunities for people to create, contribute, and succeed. This vision encompasses open tools developers can shape, security that keeps pace with emerging threats, fairer economic exchange between agents and the people whose work they use, and infrastructure designed for an agent-driven Internet. Over 16 years, Cloudflare has built alongside developers, creators, researchers, customers, partners, and open-source communities, with their ideas, feedback, and willingness to challenge the company shaping its direction.