Cloudflare Launches AI Vulnerability Service That Uses Live Traffic to Rank Risk

Cloudflare has opened invitation-only early access to a service that uses OpenAI’s GPT-5.6-Cyber to inspect authorized application code and judge whether a suspected weakness is exposed in production. It can recommend a patch or prepare a narrowly scoped firewall rule, but customers must review either change before testing or deployment.

Called Vulnerability Discovery and Remediation, the service combines model-led code analysis with Cloudflare’s data on deployed routes, traffic volume, suspicious requests, and existing Web Application Firewall protections. The goal is to prioritize flaws in reachable code rather than treat every code finding as equally urgent.

From a code finding to a proposed defense

GPT-5.6-Cyber handles reconnaissance, vulnerability hunting, and validation. The resulting workflow produces prioritized findings and recommended software patches. When the evidence supports a safely limited edge response, it can also prepare a custom WAF rule around the request method, path, and other conditions used to reach the vulnerable code.

Production context stays at Cloudflare; model inference does not

Cloudflare’s network supplies the production context, but GPT-5.6-Cyber does not run at the edge. Prompts pass through AI Gateway to OpenAI’s servers. Cloudflare says each investigation is restricted to customer-authorized source and evidence, with unnecessary context removed, redaction controls, tool-call logs, and checks outside the model.

That data path is part of the product’s practical boundary. Early access is limited to selected enterprise customers, and each engagement starts with one authorized application. Customers are authorizing a managed investigation that can process selected code and supporting production evidence through OpenAI’s infrastructure.

The performance question remains open

Cloudflare has not published independent precision, recall, or remediation-success benchmarks for the service. The vulnerability totals in its launch illustration are not customer results. The meaningful test is whether live-traffic context reduces false alarms while still surfacing serious flaws that are less obvious in production data.

OpenAI introduced GPT-5.6-Cyber in August through Daybreak Red, an access tier for approved defenders. OpenAI says the model is trained for specialized work including vulnerability research and exploit-chain development. Cloudflare is putting that capability inside a defined investigation and remediation workflow rather than offering customers a general-purpose cyber model interface.