Cloudflare taps OpenAI’s cyber models to find and block code flaws

Cloudflare Inc. has launched an early access program for Vulnerability Discovery and Remediation, a service that leverages OpenAI's cybersecurity models to identify software flaws in customer applications and thwart attacks at the network edge. The service operates within Cloudflare Managed Defense, a security operations center offering, and interfaces with OpenAI's GPT-5.6-Cyber model via the Daybreak Defense Network.

Cloudflare initially captures data from its Web Assets inventory and web application firewall to determine which routes are active and the security events they encounter. An agent then creates a map of request paths leading to code sections, while hunter agents utilize this map. Any code running on Cloudflare Workers is obtained through Workers Observability.

Each discovery undergoes validation before being assigned a risk rating, which increases if production evidence reveals heavy traffic or active probing on the affected route. The process generates two types of solutions: custom firewall rules tailored to the method, path, and request details necessary to access the vulnerable code, and code patches for engineers to review.

Neither fix nor rule takes effect without explicit human approval, and Cloudflare emphasizes that the models cannot independently apply either one. Prompts are transmitted through Cloudflare AI Gateway to OpenAI servers, with no inference occurring on Cloudflare's edge. Redaction removes any unnecessary context from the model's perspective.

Each proposal must also pass additional checks written outside the model. If a check fails, the workflow is halted before any customer sees the proposal. Cybersecurity threats are abundant, with the National Vulnerability Database recording 60,475 vulnerabilities by September and a total of 48,185 for the entire year of 2025. Scanning tools often generate thousands of findings without highlighting which ones pose a risk in production, and Cloudflare claims its service addresses this gap.

Cloudflare is moving away from the practice of addressing vulnerabilities "one at a time," according to co-founder and CEO Matthew Prince. Instead, the company views the network, combined with GPT-5.6-Cyber, as a means to proactively stop attacks before they occur. GPT-5.6-Cyber was introduced in August, when OpenAI divided Daybreak into two access tiers and placed the model in the higher Daybreak Red tier for vulnerability research and exploit validation.

The model achieved a 95% success rate on OpenAI's benchmark for advanced cybersecurity tasks, compared to just 1.5% for the general-purpose GPT-5.6 Sol. McCall McIntyre, OpenAI's head of global cyber partnerships, stated that the network aims to provide defenders with AI-powered "advantages safely." Palo Alto Networks has incorporated the same models into its Unit 42 consulting services, while Proofpoint announced today that its Daybreak models are now integrated with a SOC Analyst Agent for threat investigation.

OpenAI also utilized the day to pledge $1 billion in subsidized Daybreak access for water and electricity utilities, local government entities, community banks, and nonprofits. Access is by invitation only, and Cloudflare is currently holding the early phase for select enterprise customers, with each engagement starting with one application nominated by the customer.

Pricing details were not disclosed, and Cloudflare has not provided a timeline for expanding the service beyond the early access phase.