{"slug": "ai-search-is-becoming-infrastructure-billing-multimodal-retrieval-and-private", "title": "AI Search Is Becoming Infrastructure: Billing, Multimodal Retrieval, and Private Backends", "summary": "Cloudflare began billing for its AI Search product on November 1, 2026, after the managed index and retrieval service reached general availability on October 1, 2026, combining Workers AI, Vectorize, R2 and Browser Run with native image embeddings, PDF OCR and larger file support. Cloudflare priced ingestion per million tokens, storage per gigabyte-month, and semantic, hybrid or vector queries per thousand queries, while Google's October 28, 2026 Connected Apps preview lets developers connect a cloud-hosted MCP server or Android MCP implementation through AppFunctions APIs to reach users across Search and the Gemini app, with more than 50 Connected Apps already available including Adobe, Experian, Peloton and Calm. Cloudflare also announced general availability on October 30, 2026 for private-origin services that route a proxied DNS A or AAAA record to a private IP over IPsec, GRE, CNI, Tunnel or Mesh, letting a private agent backend or MCP server reach the Internet without an inbound firewall exception.", "body_md": "The AI search story used to be about a better answer box. That frame is getting too small. Cloudflare started billing for AI Search on November 1, 2026. Google is putting connected apps into Search and Gemini. Cloudflare is giving private AI backends a route without a public origin. Microsoft is placing an audit trail beside finance work. Recent security reports show why the route and the trust store matter too. These are different product announcements, but they point to the same operating layer. Search now has an index, a retrieval path, an app surface, a network boundary, and a record of what happened after the answer. My read: the next search product will be judged less by the fluency of its answer and more by whether a team can explain where the answer came from, what it touched, and what it cost to run.\n\nThe change is easy to miss if the unit of analysis is only the model. The new operating layer decides what enters the index, how results are fused, which app can call the system, where the backend lives, and what evidence remains beside the answer.\n\nCloudflare’s AI Search announcement says the product became generally available on October 1, 2026, and billing began on November 1, 2026. It combines Workers AI, Vectorize, R2, and Browser Run into a managed index and retrieval path. The same announcement describes native image embeddings, OCR for PDFs, and larger file support.\n\nThe query path is the interesting part. Cloudflare describes optional query rewriting, vector and keyword search in parallel, fusion of those results, optional reranking, and then either retrieved chunks or a generated answer. Its published prices expose the units: ingestion is priced per million tokens, storage per gigabyte-month, and semantic, hybrid, or vector queries per thousand queries.\n\nThat changes the buying question. A team choosing AI Search is choosing what becomes searchable, how relevance is assembled, and when generation is allowed to speak. The model is one component. The index and the query path are the product.\n\n[Google’s Connected Apps Platform preview](https://blog.google/innovation-and-ai/technology/developers-tools/connected-apps-one-place/), published on October 28, 2026, lets developers build once and reach users across Search and the Gemini app. Google says developers can connect a cloud-hosted MCP server or an Android MCP implementation through AppFunctions APIs.\n\nThe Connected Console handles registration, testing, submission, and surface selection. It also exposes traffic, latency, and error tracking, while giving developers control over verified logos and authenticated accounts. Google says more than 50 Connected Apps were already available across Search and Gemini, including partners such as Adobe, Experian, Peloton, and Calm.\n\nThe product lesson is easy to miss: MCP is becoming a distribution boundary as well as an integration format. The app needs a route into a high-intent surface, a visible identity, and a way to show that the action completed.\n\nCloudflare announced general availability for services for private origins on October 30, 2026. A proxied DNS A or AAAA record can point to a private IP, while WAF, bot management, rate limiting, caching, transforms, and Workers keep working as they do for public origins.\n\nCloudflare says the path can use IPsec, GRE, CNI, Tunnel, or Mesh connectivity. The request is handed from the public edge to the private network layer, so the origin does not need an inbound firewall exception. The API example makes the intent explicit with a private_routing flag.\n\nThe AI use case is concrete. A private agent backend, MCP server, or operational tool may need to reach services on the Internet while its own address stays private. That separates the agent’s outward reach from the network exposure of the system it controls.\n\n[Microsoft’s Copilot for finance announcement](https://www.microsoft.com/en-us/copilot/blog/2026/10/29/microsoft-copilot-for-finance-purpose-built-for-the-way-finance-teams-work/) on October 29, 2026 describes more than 25 finance skills and partner plugins across Copilot, Excel, accounting, capital markets, and finance work. Microsoft says that in seven days of limited Insider availability, more than 8,000 unique users invoked accounting skills more than 44,000 times across more than 18,000 Copilot conversations. Those are Microsoft’s reported usage figures, not an independent adoption measure.\n\nThe useful design detail is the audit trail in Excel. Microsoft says it can record what Copilot changed and why. The post also describes Work IQ grounding work in organization knowledge, permissions and sensitivity labels, and a human retaining recommendations, decisions, and approvals.\n\nThis is a better test for an enterprise agent than a good-looking answer. Can the person receiving the work see what changed, why it changed, and where their approval still matters?\n\nCloudflare’s Q3 2026 DDoS Threat Report, published on October 29, 2026, counted 18.2 million network-layer DDoS attacks and 14.4 trillion HTTP DDoS requests. Cloudflare says that works out to about 8,226 attacks per hour, or one every 0.44 seconds.\n\nThe shape of the traffic matters more than the largest number. Short-burst attacks under ten minutes and under 1 Gbps rose 208 percent quarter over quarter, while attacks above 1 Tbps fell nearly 69 percent. Cloudflare also reports a 215 percent rise in DNS amplification and a 122 percent rise in UDP floods.\n\nFor AI services, the practical connection is the control loop. Retrieval, tool calls, and agent endpoints need detection and response that work at a high event rate. A system tuned only for a giant spike can miss the small bursts that keep a service busy and expensive.\n\nCloudflare’s October 30 follow-up on eMudhra describes eight weak intermediate certificate authority keys. Cloudflare says the keys could be recovered from public certificates and used to create certificates for domains that an unpatched client would accept.\n\nCloudflare says it patched high-impact systems within hours and used AI-assisted source analysis to find other systems that trusted the weak keys. The company reports a full analysis within four hours, about 22,000 attempted handshakes with the weak keys, and roughly 160 certificates whose names stood out as unrelated to the requested domain. It says there is no evidence so far that the keys were used to intercept Cloudflare’s connections.\n\nThe remaining exposure is a systems problem. Cloudflare says modern browsers are mostly patched, while embedded browsers such as Android WebView still showed 30 to 40 percent acceptance in its probes, with important caveats about traffic mix. An AI system that can act across tools needs the same ability to update its trust boundary before an old client becomes the weak link.\n\nBefore buying another model, ask five plain questions. What content enters the index? How are keyword and vector results combined? Which surface can call the app? Where does the private work run? What evidence stays with the answer?\n\nThe model supplies capability. The operating layer decides whether that capability can find the right source, reach the right system, and leave work that another person can trust.\n\n*The answer is the visible edge. The search system is the product.*\n\n[AI Search Is Becoming Infrastructure: Billing, Multimodal Retrieval, and Private Backends](https://pub.towardsai.net/ai-search-is-becoming-infrastructure-billing-multimodal-retrieval-and-private-backends-bf2bb380a9c9) was originally published in [Towards AI](https://pub.towardsai.net) on Medium, where people are continuing the conversation by highlighting and responding to this story.", "url": "https://wpnews.pro/news/ai-search-is-becoming-infrastructure-billing-multimodal-retrieval-and-private", "canonical_source": "https://pub.towardsai.net/ai-search-is-becoming-infrastructure-billing-multimodal-retrieval-and-private-backends-bf2bb380a9c9?source=rss----98111c9905da---4", "published_at": "2026-11-03 06:20:03+00:00", "updated_at": "2026-11-03 06:52:26.786320+00:00", "lang": "en", "topics": ["ai-search", "agent-protocols", "ai-infrastructure", "ai-agents"], "entities": ["Cloudflare", "Google", "Microsoft", "Workers AI", "Vectorize", "Gemini", "Adobe", "Experian"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/ai-search-is-becoming-infrastructure-billing-multimodal-retrieval-and-private", "markdown": "https://wpnews.pro/news/ai-search-is-becoming-infrastructure-billing-multimodal-retrieval-and-private.md", "text": "https://wpnews.pro/news/ai-search-is-becoming-infrastructure-billing-multimodal-retrieval-and-private.txt", "jsonld": "https://wpnews.pro/news/ai-search-is-becoming-infrastructure-billing-multimodal-retrieval-and-private.jsonld"}}