A vulnerability scanner surfaces 4,000 findings in a single run, with 78 marked critical. Determining which one demands immediate attention remains a persistent challenge for security teams. Cloudflare is rolling out early access to Vulnerability Discovery and Remediation, a new invitation-only offering within Cloudflare Managed Defense designed to help organizations identify and address weaknesses in their source code.
The service leverages OpenAI Daybreak models, specifically GPT-5.6 Cyber, to conduct reconnaissance, hunt for flaws, and validate findings across codebases that customers authorize for inspection. When a vulnerability is detected, the system generates remediation suggestions and automatically tests each proposed code patch and mitigation strategy before presenting them for human review. Customers retain full control: while Cloudflare may suggest fixes, the decision to implement them rests entirely with the organization.
The fundamental challenge has intensified as AI capabilities expand. Large language models can now identify weaknesses across entire codebases within minutes, causing the volume of findings to grow exponentially. The real bottleneck, however, is velocity. Attackers increasingly use AI to accelerate vulnerability discovery and exploitation, compressing the window security teams have to assess threats and respond.
Traditional scanners often lack production context. A tool may flag a vulnerability in a specific handler but cannot reveal whether that code is actually deployed, whether traffic reaches it, what security activity surrounds it, or what existing controls protect it. Teams must prioritize findings without visibility into real-world exposure or existing defenses.
Cloudflare's global network provides the missing layer. The company can observe which routes are active, how much traffic they receive, and what security events occur around them. When Vulnerability Discovery and Remediation integrates with Web Application Firewall (WAF), it gains visibility into which rules are already applied and actively blocking attacks. This transforms a generic finding into an actionable priority: a live vulnerability on a heavily trafficked route showing recent attack attempts and lacking existing protection. Cloudflare can then propose tailored WAF rules and code patches suited to the customer's infrastructure.
Adding context to vulnerability detection
The approach works across Cloudflare Workers and proxied applications. Vulnerability detection begins by collecting a snapshot of traffic and security data from Web Assets and WAF, revealing which routes are active, their traffic volume, and any associated security events. A path generating numerous detection triggers receives heightened security consideration. Web Assets and WAF form the first two pillars of the system.
Source code analysis then identifies potential weaknesses, but this analysis alone cannot show which routes invoke the vulnerable code, traffic levels, suspicious request patterns, or existing protections. Routes handling high request volumes are classified as hot paths and subjected to stricter security profiling. These signals collectively demonstrate API usage patterns and potential vulnerability exposure.
For Workers, the system retrieves the most recent source version and its configured routes to determine which endpoints it serves. The Worker's routes are matched against Web Assets and request metadata from Workers Observability, linking the exact source code under review to the production endpoints it handles. This network context remains accessible throughout the investigation for agents to reference as needed.
The vulnerability harness then activates. A Reconnaissance agent maps request paths to the code sections handling them. Using this map, hunter agents enter specific portions of the authorized codebase to search for vulnerabilities, pulling in relevant network context as necessary. This context helps hunters focus on code behind active or recently targeted routes, but does not itself establish vulnerability existence. Every finding requires corroboration by source code evidence.
After hunters return findings, validation checks proposed mitigations and assigns each vulnerability an initial risk rating based on source code analysis. Network evidence can elevate that rating further when, for instance, the affected endpoint carries substantial traffic or exhibits signs of active exploitation attempts.
The output is a ranked list of findings, each accompanied by a recommended code patch and, where evidence supports it, a Cloudflare WAF Custom rule to reduce exposure during code review. If the customer has authorized Vulnerability Discovery and Remediation to defend their zone, the system deploys rules with conservative scoping around the method, path, and other request attributes necessary to reach the vulnerable code. Routes containing only variables and wildcards do not receive rule suggestions; the system prefers missing a potential connection over claiming one the evidence cannot support.
Model execution and safeguards
When a customer authorizes an investigation, Vulnerability Discovery and Remediation runs the harness on Cloudflare infrastructure and sends model prompts from Workers through Cloudflare AI Gateway to OpenAI Daybreak models hosted on OpenAI's servers. GPT-5.6 Cyber handles reconnaissance, hunting, and validation, with responses returning to the harness to continue the workflow on Cloudflare. No model inference executes at Cloudflare's edge, and the model cannot deploy any patch or rule it proposes.
Investigations remain narrowly scoped to authorized source code and evidence. Before context reaches the model, Vulnerability Discovery and Remediation strips unnecessary information and applies redaction controls configured for the engagement. Source code, logs, and request metadata are treated as evidence to examine, not instructions to execute.
Tool access follows identical boundaries: each call is logged and validated against the investigation's access policy before execution, and every patch or rule proposal must pass checks implemented outside the model. If any check fails, the workflow halts before the proposal reaches customer review.
Nothing reaches customer review until it has passed checks and undergone validation by Cloudflare's team. For WAF rule suggestions, validation includes checking rule syntax and testing against synthetic fixtures representing expected requests, rather than against actual customer traffic. If a check fails or results remain ambiguous, output is withheld and routed for diagnosis.
Passing validation does not automatically change the customer's environment. After team validation, Vulnerability Discovery and Remediation prepares the source code patch and WAF rule for customer decision.
Joining early access
Vulnerability Discovery and Remediation is available to selected customers by invitation during early access through Cloudflare's Managed Defense team. Each engagement begins with a single application whose codebase the customer authorizes for investigation. To connect findings to production, the service uses authorized read access to Web Assets inventory, relevant WAF controls, and Workers Trace Events Logpush where available. The investigation is semi-automated, with customers reviewing every result before deciding whether to test or deploy changes.
Organizations interested in participating should contact their Cloudflare account team.