Cloudflare Unveils Evidence-Grounded Multi-Agent Security Operations Harness

Cloudflare Unveils Evidence-Grounded Multi-Agent Security Operations Harness Cloudflare has introduced an AI agent harness for Cloudflare Managed Defense to tackle alert overload. By pairing deterministic data collection with specialized AI models, the architecture streamlines alert triage, aggregates evidence, and provides actionable recommendations while keeping human analysts in control. Reconnaissance workflows and scope enforcement run via deterministic application code prior to model inference to prevent hallucinations. Initial triage and evidence scoring use Clef, Cloudflare's decision model, while deeper analysis uses models from OpenAI Daybreak and Anthropic. A coordinator agent deploys four parallel specialist agents, whose typed outputs are combined into an advisory by a synthesis agent with a restricted vocabulary. The harness runs on Cloudflare Workers, Workflows, D1, R2, and Durable Objects, keeping human analysts responsible for final decisions and mitigations. Deterministic Reconnaissance and Initial Triage To address hallucinations seen in early single-agent prototypes, Cloudflare separated evidence retrieval from inference. Application code executes fixed reconnaissance workflows via versioned API calls, capturing customer identity, baseline traffic, and enforcement history into an immutable snapshot. Alerts are first evaluated using Clef on Workers AI to filter high-volume noise and likely false positives before engaging specialist agents. Specialist Agents and Evidence Verification Alerts requiring deeper review are distributed across four parallel specialist agents by a coordinator agent. Global telemetry is analyzed strictly in aggregate to safeguard tenant privacy. Before generation, a versioned evidence package is built; application code enforces that all model claims cite verified items in the package, and Clef scores whether the collected evidence is contradictory or sufficient. Platform Architecture and Analyst Oversight The operational pipeline is coordinated via Cloudflare Workers and Workflows, persisting state across D1, R2, and Durable Objects. The resulting advisory details affected surfaces, relevant controls, coverage gaps, and suggested mitigations like WAF or rate limiting adjustments. The harness operates strictly as a decision aid: human Managed Defense Analysts retain ultimate authority to confirm scope and deploy remediations.

Cloudflare推出基于证据的多AI Agent安全运营架构 面对安全警报过载与误报问题，Cloudflare在其Managed Defense服务中引入多AI Agent运营架构。该系统将确定性代码与大模型分析结合，严格基于可验证证据进行警报聚合与分类，降低单Agent幻觉风险并辅助分析人员决策。 初代单Agent原型由于Prompt扁平化导致幻觉，促使系统将数据收集与范围控制前置至确定性应用代码中。 采用两阶段模型体系：轻量级Clef模型进行初筛分流与证据评分，GPT-5.6 Cyber、Mythos等模型承担专项与综合分析。 架构依托Cloudflare自身平台（Workers、Workflows、D1、R2等）运行，严格隔离租户边界并强制证据引用校验。 最终处置权和规则缓解措施仍保留在人工分析师手中，AI仅输出带证据支撑的结构化建议报告。 架构变革：前置确定性数据收集 首代单一通用Agent容易因Prompt揉杂遥测、检测策略和威胁情报而产生无证据支持的幻觉。新架构将数据收集完全交给确定性代码，在模型推理前生成包含来源、版本与时间戳的侦察快照（recon snapshot）。固定快照确保了可复现性，使分析差异仅源于解释而非数据检索变动。 多模型协同与分层分流机制 系统利用运行在Workers AI上的开源决策模型Clef对警报进行快速初筛，高概率误报直接跳过专家分析。需要深度审查的警报交由协调Agent并发调用4个专家Agent，最后由综合Agent统一生成建议。综合Agent仅能使用受批准词汇且不可自行抓取新证据。后续阶段再次由Clef对收集的证据充分性与矛盾点进行评分。 证据链校验与技术基础设施支持 在模型分析前，系统生成版本化的证据包，应用代码强制检查专家的每一处引用是否存在并支持对应断言。整个流程基于Cloudflare开发者平台构建：Workers负责证据准入与结果验证，Workflows协调阶段状态，D1与R2分别持久化调查状态与上下文工件，Durable Objects维持对话状态。 分析师把控决策与缓解落地 LLM最终输出涵盖受影响面、执行结果与下一步建议的报告，并在数据缺失时清晰记录覆盖盲区而非强制分类。模型无权跨越租户边界或替人决策，Managed Defense分析师始终保有对最终结论和WAF/限流规则下发等缓解措施的最终决定权。

Security alerts rarely arrive one at a time. A single alert can cause a spike across the environment, requiring a human analyst to decide which alerts are related and what they mean. When multiple arrive at the same time, it can quickly overwhelm even a seasoned security analyst. Enter the alert paradox. Now, our built-in, multi-AI-agent security operations harness can handle more of this work at Cloudflare scale. Our [Cloudflare Managed Defense](https://www.cloudflare.com/managed-defense/) AI agent harness speeds up the process of gathering data, connecting and aggregating detections, and accounting for missing sources while new alerts continue to arrive. To further analyze context, we make use of the [OpenAI Daybreak Defense Network](https://openai.com/daybreak/partners/) and our partnership with Anthropic. Cloudflare uses approved OpenAI Daybreak and Anthropic models, including GPT-5.6 Cyber and Mythos, for deeper model-backed analysis. Initial analysis and scoring is done with [Clef](https://blog.cloudflare.com/clef-decision-models/), Cloudflare’s open-source decision model. Collecting evidence to understand what each alert means requires a lot of time. Even in a highly sophisticated Security Information and Event Management (SIEM), too much is still left for a human to review. Human analysts must gather data, connect and aggregate detections, and account for missing sources while new alerts continue to arrive. Think about every time a human analyst reviews an alert: "Which should we silence? Which action should we take? Which alert should we ignore? Which should we resolve as false positives? Which should we resolve as true positives? Which should trigger our incident team?" We address this predicament with our AI agent strategy. Our approach reduces all of those questions and gives Managed Defense Analysts a quick and consolidated view, directly providing insight into related alerts, admitted evidence, visible gaps, and recommended next steps. The result: cutting back on the time needed to analyze, and creating a hyper focus on actually getting security alerts resolved and mitigations deployed. Our first prototype showed the limits of one general-purpose agent. We provided the AI agent the whole investigation. It produced useful analysis, but it also hallucinated claims the evidence did not support. Telemetry, detector descriptions, policies, and threat intelligence were flattened into one prompt, which caused their distinct roles to merge together. We saw three recurring problems with our first single-shot AI agent harness: To address these challenges we moved evidence collection and scope enforcement into application code, before model analysis begins. It's tempting to put an AI agent at every step. The front half of our harness has none. Before we even call inference, deterministic code runs a fixed set of reconnaissance workflows with versioned API calls. It collects the customer's identity, detection history, traffic baseline, enforcement outcome, and network observations. Each piece of data is stored with its source, version, and timestamp. Cloudflare sees both the request and the action applied to it. That lets the investigation connect the behavior that triggered an alert with both the control that fired and its outcome. The fixed recon snapshot also makes evaluation reproducible. If AI agents fetch their own data, two runs may disagree because their inputs changed. Here, the same snapshot can be replayed, so differences between specialist AI agents’ findings come from interpretation rather than retrieval. Most alerts are not incidents. The same rule often fires repeatedly on a known traffic pattern, and paging Managed Defense Analysts every time makes it easier to miss a real security incident. We needed a lightweight triage model to compare each alert with its reconnaissance data: Has this event been detected for the customer before? What did Managed Defense Analysts decide previously? Does the traffic look consistent with normal human behavior? Alerts scored with a high likelihood to be false positives skip analysis by the specialist AI agents. [Clef](https://blog.cloudflare.com/clef-decision-models/), running on Workers AI, was the perfect fit for this type of fast agentic reasoning. Known high-volume noise is deterministically classified as passive when it arrives. It remains available as context but does not enter the active queue. For alerts that need deeper review, a coordinator AI agent runs four specialist AI agents in parallel: A synthesis AI agent combines their typed findings into one advisory; it can’t fetch new evidence or choose a classification outside the approved vocabulary. Keeping each task narrow makes unsupported claims easier to catch, and recommendations easier to audit. A security tool knows what happened inside the environment it is deployed in, but little about the world beyond it. Cloudflare compares an alert with patterns seen across its global network. For example, an IP may be targeting one site, scanning thousands of sites, or appearing for the first time. Those patterns carry different weights. To preserve customer privacy, the global telemetry specialist works only with aggregates; it never receives another customer's individual records or identity. This view combines features from Cloudflare's [CDN](https://www.cloudflare.com/products/cdn/), [WAF](https://www.cloudflare.com/products/waf/), [DDoS](https://www.cloudflare.com/products/ddos/), [Turnstile](https://www.cloudflare.com/products/turnstile/), [Rate Limiting](https://www.cloudflare.com/products/rate-limiting/), and [Cloudforce One threat intelligence](https://www.cloudflare.com/cloudforce-one/services/threat-intelligence/). The synthesis AI agent weighs both global reputation and customer history. This ensures a globally common pattern can still be used on a per-customer basis, but does not automatically imply a widespread campaign for all customers. Every evaluation is conscious of what came before it: the alert, the pattern, and which customer. The recon dossier records the alert's own track record including how many times this service alert has fired, how many of those were dispositioned as false positives, and what the Managed Defense Analyst concluded. An attack pattern that has been benign every time your Managed Defense Analysts have seen it is a very different object from the first sighting of something new, and the specialist AI agents are told which one they are looking at. Approved background context is retrieved from previous alerts and cases, so yesterday's conclusions are carried into today's decision, instead of being rebuilt from scratch. Our system aggregates related alerts into a consolidated case. In each case, we store evidence, findings, and recommendations. Our system deterministically joins and correlates this data, but we leave it to a Managed Defense Analyst to confirm the actual scope. Over time, a case can connect network, application, and Zero Trust evidence together, while tracking the source of the evidence for additional context and reference purposes. Before analysis, the system creates a versioned evidence package with the subject, scope, time anchor, admitted evidence, policy versions, sources, and coverage gaps. Specialists must cite items in that package. Application code checks that every citation exists, belongs to the investigation, and supports the attached claim. Invalid findings are corrected or recorded as limitations. We lean on Clef a second time to score our evidence. Is the collected evidence enough for a decision? Does any of our collected evidence contradict? Based on this evidence, Clef picks from a deterministically reduced list of attack classifications and dispositions. Cloudflare's developer platform runs this process. Application code on Workers admits evidence and validates results; [Workflows](https://developers.cloudflare.com/workflows/) coordinates each stage and saves completed work before the next begins, so a failed stage reuses evidence and findings that already passed validation instead of starting over. [D1](https://developers.cloudflare.com/d1/) keeps investigation and advisory state, [R2](https://developers.cloudflare.com/r2/) holds bounded context and evidence artifacts. Case-chat state persists in [Durable Objects](https://developers.cloudflare.com/durable-objects/), uses [Flue](https://flueframework.com/), and is enriched with [AI Search](https://developers.cloudflare.com/ai-search/). Finally, an LLM-powered agent produces an advisory report using terms that Managed Defense Analysts already work with: affected surface, enforcement outcome, relevant controls, and next step. Managed Defense Analysts can inspect evidence, investigate further, revise the recommendation, or group alerts into a case. Application code fixes the customer scope before any model sees results, and gives each specialist only the evidence it needs. The model never receives authority to cross tenant boundaries or act for the Managed Defense Analysts. At network scale, a source will sometimes fail. A comparison may time out, metadata may be missing, or a threat intelligence lookup may return no match. The system keeps evidence already collected and records the gap. The advisory distinguishes three states: If global telemetry is unavailable, the system can describe what is unusual for the customer but cannot say whether the pattern is widespread. When the evidence is insufficient, it makes no classification or disposition recommendation. A useful recommendation should lead to a solution, rather than a ticket. The advisory might suggest a rate limiting rule for an abusive path, a WAF custom rule for a signature, or a DDoS protection change. For fully managed customers, Managed Defense Analysts can apply the suggested rules; other customers will receive their recommendations in the dashboard and through their chosen alert path. In the end, the Managed Defense Analyst remains responsible for the decision and any mitigation. Each alert and case includes the evidence behind the AI agent’s recommendation, which empowers the Managed Defense Analyst to reach a conclusion by accepting or updating the AI agent’s advice. Managed Defense Analysts remain responsible for judgment. The AI agent harness handles more of the repetitive work: assembling investigations, connecting related events, and showing the evidence behind each recommendation. Over the next few quarters, we plan to add a Custom Managed level with more flexibility for each organization. We also plan to explore continuous AI agents that monitor Cloudflare traffic and surface patterns that fixed rules and thresholds may miss. The early beta is available in [Cloudflare Managed Defense](https://www.cloudflare.com/managed-defense/) for eligible application-security alerts and cases. If you already use Cloudflare WAF, DDoS protection, Magic Transit, or [another supported product](https://www.cloudflare.com/managed-defense/), talk to your enterprise account team about adding Managed Defense.