Cloudflare taps OpenAI’s cyber models to find and block code flaws

Cloudflare Inc. opened early access to Vulnerability Discovery and Remediation, a service that uses OpenAI Group PBC's GPT-5.6-Cyber model to find software flaws and block attacks at the network edge. The service runs inside Cloudflare Managed Defense and requires explicit human approval for any firewall rules or code patches. Cloudflare cited 60,475 vulnerabilities in the National Vulnerability Database by September, up from 48,185 in all of 2025.

Cloudflare taps OpenAI’s cyber models to find and block code flaws Cloudflare Inc. today opened early access to Vulnerability Discovery and Remediation https://www.cloudflare.com/press/press-releases/2026/cloudflare-partners-with-openai-daybreak-models-to-redefine-vulnerability-management-with-ai-powered-edge-defense/ , a service that uses OpenAI Group PBC’s cybersecurity models to find software flaws in customer applications and block attacks on them at the network edge. The service runs inside Cloudflare Managed Defense, the company’s security operations center offering, and reaches OpenAI’s GPT-5.6-Cyber model through the Daybreak Defense Network. Cloudflare first takes a snapshot https://blog.cloudflare.com/vulnerability-discovery-remediation from its Web Assets inventory and web application firewall showing which routes are live and what security events they have thrown off. A reconnaissance agent maps request paths to sections of the codebase, and hunter agents work from that map. Code running on Cloudflare Workers is pulled in through Workers Observability. Every finding is validated before it gets a risk rating, which then moves up if production evidence shows heavy traffic or active probing against the affected route. Two kinds of fixes come out of the process. Custom firewall rules, scoped to the method, path and request details needed to reach the vulnerable code, can go up as a stopgap while developers work. The models also draft code patches for engineers to review. No rule and no patch takes effect without explicit human approval, and Cloudflare said the models cannot apply either one on their own. Prompts travel through Cloudflare AI Gateway to OpenAI servers, and no inference runs on Cloudflare’s own edge. Redaction strips out context the model does not need. Every proposal must also pass checks written outside the model. A failed check stops the workflow before a customer sees anything. Nobody is short of vulnerabilities to fix. The National Vulnerability Database took in 60,475 of them by September, Cloudflare said. The total for all of 2025 was 48,185. Scanners will hand a team thousands of findings without showing which ones matter in production, and Cloudflare said that’s the gap the service is meant to close. Cloudflare is leaving behind what co-founder and Chief Executive Matthew Prince called chasing patches “one vulnerability at a time.” Teams fighting AI-driven attacks by hand are losing, in his view. A network that reads internet traffic in real time, paired with GPT-5.6-Cyber, lets defenders stop attacks before they land, he added. GPT-5.6-Cyber arrived in August https://siliconangle.com/2026/08/10/openai-expands-daybreak-cybersecurity-research-program/ , when OpenAI split Daybreak into two access tiers and put the model behind the higher one, Daybreak Red, for vulnerability research and exploit validation. The model completed 95% of advanced cybersecurity requests on OpenAI’s own benchmark, against 1.5% for the general-purpose GPT-5.6 Sol. McCall McIntyre, head of global cyber partnerships at OpenAI, said the network is meant to give defenders the advantage of frontier AI “safely.” Palo Alto Networks Inc. put the same models to work inside its Unit 42 consulting engagements last month https://siliconangle.com/2026/08/12/palo-alto-networks-run-openai-cyber-models-inside-customer-networks/ . Notably, Proofpoint Inc. also announced today https://www.globenewswire.com/news-release/2026/09/03/3356309/35374/en/proofpoint-brings-openai-gpt-cyber-models-into-security-operations-to-help-defenders-investigate-threats-faster.html that Daybreak models now sit behind a SOC Analyst Agent for threat investigation. OpenAI used the same day https://openai.com/index/daybreak-for-frontline-defenders/ to commit $1 billion to subsidized Daybreak access for water and electricity utilities, local government, community banks and nonprofits. Access is by invitation only. Cloudflare is holding the early phase to selected enterprise customers, and each engagement begins with one application the customer nominates. Pricing was not disclosed. Cloudflare gave no timeline for taking the service beyond early access. Image: Cloudflare A message from John Furrier, co-founder of SiliconANGLE: Support our mission to keep content open and free by engaging with theCUBE community. Join theCUBE’s Alumni Trust Network , where technology leaders connect, share intelligence and create opportunities. 15M+ viewers of theCUBE videos , powering conversations across AI, cloud, cybersecurity and more 11.4k+ theCUBE alumni — Connect with more than 11,400 tech and business leaders shaping the future through a unique trusted-based network Are you an AWS customer? Support SiliconANGLE financially by buying your AWS services from our Marketplace portal page and links: https://siliconangle.com/aws-marketplace/ https://siliconangle.com/aws-marketplace/ About SiliconANGLE Media SiliconANGLE https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fsiliconangle.com%2F&esheet=54119777&newsitemid=20240910506833&lan=en-US&anchor=SiliconANGLE&index=9&md5=646b1b564e2259100a2b8638aab0a552 , theCUBE Network https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fwww.thecube.net%2F&esheet=54119777&newsitemid=20240910506833&lan=en-US&anchor=theCUBE+Network&index=10&md5=7de2a85f95ab4a4a495cede20b8cb1da , theCUBE Research https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fthecuberesearch.com%2F&esheet=54119777&newsitemid=20240910506833&lan=en-US&anchor=theCUBE+Research&index=11&md5=7bb33676722925eb57d588ec343e4f6f , CUBE365 https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fwww.cube365.net%2F&esheet=54119777&newsitemid=20240910506833&lan=en-US&anchor=CUBE365&index=12&md5=d310fb35919714e66ad8d42c9c0c1bc6 , theCUBE AI https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fwww.thecubeai.com%2F&esheet=54119777&newsitemid=20240910506833&lan=en-US&anchor=theCUBE+AI&index=13&md5=b8b98472f8071b23ebb10ab9a8dd0683 and theCUBE SuperStudios — with flagship locations in Silicon Valley and the New York Stock Exchange — SiliconANGLE Media operates at the intersection of media, technology and AI. Founded by tech visionaries John Furrier and Dave Vellante, SiliconANGLE Media has built a dynamic ecosystem of industry-leading digital media brands that reach 15+ million elite tech professionals. Our new proprietary theCUBE AI Video Cloud is breaking ground in audience interaction, leveraging theCUBEai.com neural network to help technology companies make data-driven decisions and stay at the forefront of industry conversations.