AIArticle The viral 'AI psychosis' takedown misdiagnoses what broke at Cloudflare — and what teams shipping LLM-written code should fix.
Mariana Souza A post titled "Cloudflare's AI Psychosis" hit the Hacker News front page this morning, and it's the kind of piece that travels because it names a feeling: a longtime Cloudflare customer arguing that the company has traded infrastructure discipline for announcement velocity, shipping a sprawl of overlapping AI-branded products while logs go missing and tracing sits in open beta. The diagnosis is catchy. It's also, I think, aimed at the wrong organ.
Look closely at Cloudflare's actual failures over the past year and a pattern emerges — but it isn't "the AI wrote bad code." It's that AI-assisted output let the company make claims faster than anyone was verifying them. That distinction matters a lot if you're shipping LLM-assisted changes to your own production systems, because one of those problems is fixable with process and the other is a moral panic.
What actually broke, and what wrote it #
Start with the outages, since "operational fallout" is the emotional core of the complaint. The September 12, 2025 dashboard and API outage — roughly 75 minutes of control-plane unavailability — came down to a React useEffect
hook with a bad dependency array that re-fired API calls on every render, stampeding the Tenant Service that authorizes every API request. The far worse November 18, 2025 outage, nearly six hours of failures that knocked major sites offline, was a database permissions change that doubled the size of a Bot Management feature file until it blew past a hardcoded limit and panicked the core proxy.
Neither postmortem implicates AI-generated code. These are the two most consequential Cloudflare incidents of the past year, and they're classic human failures: a footgun API, a missing size check, insufficient rollback automation. If you want to argue Cloudflare's reliability culture has slipped, that's a legitimate argument — but it was slipping in hand-written code.
The genuinely AI-shaped failure is different in kind. In late January, Cloudflare published a blog post claiming a serverless, post-quantum Matrix homeserver running on Workers, with a README calling it production-grade and the post saying the team used it internally for real encrypted communications. The community took it apart within days: no state resolution (a core Matrix protocol requirement), authentication stubs, TODOs like "Return actual auth chain" that had been deleted rather than implemented. Matrix co-founder Matthew Hodgson said the post "severely overclaimed the scope of the project." Cloudflare backpedaled — the README now discloses the code was built with Claude's assistance and calls it an example prototype.
Nobody's traffic went down because of that repo. What went down was trust, which for an infrastructure vendor is the same balance sheet.
The control group Cloudflare already ran #
Here's what makes the "psychosis" framing unsatisfying: Cloudflare has already demonstrated, publicly, how to do AI-assisted engineering well — and the difference wasn't the model, it was the process.
In mid-2025, Kenton Varda built workers-oauth-provider, an OAuth 2.1 library for Workers, with Claude writing most of the code. The AI's role was disclosed up front. The prompts were preserved in the commit history, so anyone could audit how the code came to be. The library shipped with the explicit caveat that humans reviewed every line, and outside security researchers promptly picked it over and surfaced real design questions (support for the deprecated implicit grant, among others) that got public discussion. That's what a functioning immune system looks like: disclosure, review, external scrutiny, iteration.
The Matrix homeserver got the opposite treatment — AI-generated code, undisclosed, wrapped in marketing claims that no reviewer with Matrix protocol experience could have signed off on. Same company, same tooling, roughly six months apart, opposite outcomes. The variable is whether verification kept pace with generation. LLMs collapsed the cost of producing a plausible-looking codebase from months to days; they did nothing to collapse the cost of confirming it works. Any org that lets announcement cadence set its merge cadence will fall into that gap, with or without AI. AI just gets you there faster.
What the complaint gets right #
The sprawl critique lands harder. Cloudflare now offers D1, Durable Objects (with their own SQLite), KV, R2, Queues, and Hyperdrive on the storage side, and multiple compute paths across Workers and Containers — with an AI-agents product line layered on top. Meanwhile, per the post, Workers tracing still carries a beta badge in August 2026, non-I/O operations report 0ms because of Spectre mitigations in the runtime, and the author describes a March 2026 stretch where most logs vanished from their account despite correct configuration. Those last claims are one customer's account and I couldn't independently corroborate them — but they rhyme with long-standing Workers observability complaints, and "our tracing is in beta while we ship agent frameworks" is not a flattering ratio regardless.
What to actually do about it #
If you're shipping LLM-assisted changes to production, the Cloudflare year gives you a usable rulebook rather than a vibe: Disclosure is a technical control, not PR. The oauth-provider survived scrutiny because reviewers knew what they were reviewing. Tag AI-heavy PRs so humans allocate skepticism accordingly.Budget review to match generation speed. If Claude Code produces in an afternoon what took a sprint, your review capacity is now the bottleneck — staff it, or your effective quality bar drops silently.Treat public claims as production claims."We use this internally for real traffic" is an SLO statement. The Matrix fiasco happened at the blog layer, not the code layer.If you're a Cloudflare customer, the November outage is the bigger signal than any AI drama: keep critical paths on mature primitives, and test what your app does when Cloudflare's control plane — or your logs — disappear for an afternoon.
The post's prescription is "hire people that care." Cloudflare demonstrably has them; Varda's project is proof. What it needs — what any team adopting these tools needs — is to make the careful path the default one, so verification scales with the newfound speed. Calling it psychosis makes for a great headline, but the condition is more mundane and more treatable: review debt, compounding at AI interest rates.
Sources & further reading #
[Cloudflare's AI Psychosis](https://opensauce.it/cloudflare-ai-psychosis/)— opensauce.it -
[Deep dive into Cloudflare's September 12 dashboard and API outage](https://blog.cloudflare.com/deep-dive-into-cloudflares-sept-12-dashboard-and-api-outage/)— blog.cloudflare.com -
[Cloudflare outage on November 18, 2025](https://blog.cloudflare.com/18-november-2025-outage/)— blog.cloudflare.com -
[Cloudflare backpedals on Matrix server blog post with 'AI-assisted' code](https://www.thestack.technology/cloudflare-matrix-blog-ai-assisted-vibe-coding/)— thestack.technology -
[Building a serverless, post-quantum Matrix homeserver](https://blog.cloudflare.com/serverless-matrix-homeserver-workers/)— blog.cloudflare.com -
[workers-oauth-provider](https://github.com/cloudflare/workers-oauth-provider)— github.com -
[A look at Cloudflare's AI-coded OAuth library](https://neilmadden.blog/2025/06/06/a-look-at-cloudflares-ai-coded-oauth-library/)— neilmadden.blog
[Mariana Souza](https://sourcefeed.dev/u/mariana_souza)· Senior Editor
Mariana covers the fast-moving world of machine learning and generative AI, with a particular focus on how these technologies are reshaping development workflows. When she isn't stress-testing the latest foundation models, she's usually at a local hackathon.
Discussion 0 #
No comments yet
Be the first to weigh in.