Cloudflare uses AI not only to find vulnerabilities but also to determine which ones pose the greatest risk in practice. A new service combines OpenAI’s GPT-5.6 Cyber with information about actual network traffic to achieve this. Temporary protection via the firewall should then buy time for a permanent patch.
Vulnerability Discovery and Remediation will be available in early access within Cloudflare Managed Defense. The service uses models from the OpenAI Daybreak Defense Network to analyze software code. The key difference from a standard vulnerability scanner lies in the context that Cloudflare can provide for the identified issues.
To do this, the system first identifies which routes within an application are actually active, how much traffic they process, and what security events have been observed in connection with them. Next, a reconnaissance agent correlates the request paths with parts of the code. Other agents then use this information to search for potential vulnerabilities. For applications running on Cloudflare Workers, information from Workers Observability can be used for this purpose.
Traffic helps determine priority
A detected issue is not assigned a risk score based solely on the code. Cloudflare also examines what is happening in the production environment. For example, a vulnerability becomes more urgent if it is located behind a frequently used route or if suspicious requests are detected on that route.
In this way, Cloudflare aims to address a well-known challenge in vulnerability management. Scanners can generate large numbers of findings, after which security teams must determine which ones are actually relevant. According to figures cited by Cloudflare, as of September, 60,475 vulnerabilities had already been recorded in the U.S. National Vulnerability Database. In all of 2025, that number was 48,185.
After validation, the new service can propose two types of solutions. The first is a customized rule for Cloudflare’s Web Application Firewall. Such a rule can be specifically limited to, for example, the HTTP method, the path, and other characteristics of requests through which the vulnerable code is accessible. This allows the attack to be temporarily blocked at the edge while developers work on a permanent solution.
The second option is a modification to the source code itself. GPT-5.6 Cyber can draft a patch, which is then reviewed by developers. Human approval is required for both a code patch and a WAF rule.
AI does not run at the edge
Although Cloudflare can implement the protection at its edge, the AI model itself does not run there. Prompts are forwarded via the Cloudflare AI Gateway to the Daybreak models on OpenAI’s servers. The responses are then sent back to Cloudflare’s workflow. The model itself cannot activate a suggested patch or firewall rule.
According to SiliconANGLE, context that the model does not need is also removed, and suggestions are subject to checks established outside the AI model. If a suggestion fails such a check, the workflow is halted before the result reaches the customer.
GPT-5.6 Cyber is part of OpenAI’s Daybreak cybersecurity program. The same family of models is now also being used for security applications by other vendors. Thus, the collaboration with Cloudflare fits into a broader effort to have specialized AI models not only identify vulnerabilities but also directly integrate the results into existing security processes.
Vulnerability discovery and remediation is currently available by invitation only to selected Cloudflare Enterprise customers. The initial engagements are limited to a single application designated by the customer. Pricing and a timeline for general availability have not yet been announced.