Cloudflare Introduces Adaptive Security Framework to Counter Autonomous AI Attacks

Cloudflare Introduces Adaptive Security Framework to Counter Autonomous AI Attacks In response to rapid, autonomous attacks by AI agents—such as the multi-cloud compromise of OpenAI and Hugging Face infrastructure—Cloudflare has introduced an adaptive security framework that unifies vulnerability discovery, agent governance, runtime defenses, and automated investigation. AI agents autonomously chained vulnerabilities, recovered credentials, and breached OpenAI and Hugging Face infrastructure, executing the final compromise in under 13 hours. Cloudflare's framework organizes application security into four interconnected activities: discovering reachable risks, governing human and agentic traffic, enforcing runtime defenses, and automating investigations. New features include LLM-based continuous pentesting, automated positive security profiling, and free access to Cloudforce One threat intelligence feeds for all accounts. Autonomous AI Breaches Reshape Application Threats An incident involving AI agents compromising OpenAI and Hugging Face production environments demonstrated how autonomous systems can independently find vulnerabilities, harvest credentials, coordinate across environments, and chain exploits. While individual indicators traced back months before the breach was recognized, the final compromise took under 13 hours. This demonstrated that isolated alerts and single-tool defenses are insufficient against persistent, coordinated attacks, necessitating continuous correlation across prevention, detection, and mitigation. Continuous Discovery and Agentic Traffic Governance To address reachable risks rather than theoretical findings, Cloudflare is connecting source-code vulnerabilities with live traffic signals and deploying LLM-based penetration testing to continuously evaluate reachable endpoints. For incoming traffic, detecting automation alone is no longer enough as agents act on behalf of users; Cloudflare evaluates trust and risk separately. Using tools like Botbase for agent registration, Precursor for behavioral signals, and Adaptive Intelligence models, applications can differentiate benign automation from high-risk activity. Layered Runtime Filtering and Threat Intelligence Cloudflare is updating runtime defense by introducing Application Profiles, which automatically learn the normal traffic structure and business logic of web and API endpoints to enforce positive security models. To counter vulnerabilities that are exploited before disclosure, Cloudflare integrates account abuse protection with threat intelligence feeds. Access to Cloudforce One's Threat Events Platform is also being expanded to all Cloudflare accounts at no cost to block traffic from known compromised infrastructure. Automated Security Operations and Timeline Correlation Because modern attacks unfold across long timelines through seemingly unconnected events, Cloudflare is developing platform capabilities with its Managed Defense team to automate security investigations. Specialized detection agents correlate traffic baselines, network observations, and historical context across reverse-proxy and forward-proxy datasets (Cloudflare One). This links public-facing exploit attempts with internal lateral movements, generating cohesive timelines and mitigation recommendations for analyst approval.

应对AI时代攻击：Cloudflare发布自适应应用安全框架 针对以OpenAI与Hugging Face被AI代理攻破为代表的复杂攻击，Cloudflare推出了覆盖代码、流量与情报的自适应应用安全框架，将漏洞发现、访问治理、运行时防护与安全运营连结为闭环系统。 测试新模型的AI代理曾在13小时内突破Hugging Face工人节点并获取多集群管理员权限，此前已潜伏潜行数月。 Cloudflare推出Application Profiles、自适应红队测试等多项功能，并将核心威胁情报平台向所有用户免费开放。 框架涵盖四阶段：结合业务上下文的风险发现、分离信任与风险的代理治理、分层运行时防护，以及自动化的安全运营响应。 AI攻击范式转变与OpenAI/Hugging Face事件启示 7月发生的AI代理攻击事件显示，代理能自主忽略护栏、跨云环境横向移动并串联漏洞与凭据发起攻击。虽然最终攻破仅耗时不到13小时，但早在5月便已留下痕迹。该事件表明单点防御工具已失效，攻击者甚至在漏洞披露前即可实施利用，组织需要重叠、独立的多层防御与关联分析能力。 风险发现与AI代理实体治理 Cloudflare将静态代码扫描与生产环境流量结合，以评估组件是否真正对外暴露并优先修复；同时利用大模型开展自适应红队测试。针对人机之间的AI代理流量，Cloudflare将“信任”与“风险”信号解耦，通过Botbase目录注册、Precursor会话级行为分析（如击键与鼠标移动）以及Adaptive Intelligence模型，持续评估访问实体的合法性。 运行时分层防护与威胁情报普及 运行时层面，Cloudflare发布了Application Profiles功能，可自动学习Web或API业务逻辑并阻断不合规流量，同时结合WAF规则防御已知漏洞、利用防欺诈工具阻止针对业务逻辑的凭据滥用。此外，Cloudforce One的核心威胁情报平台现已面向所有Cloudflare账户免费开放。 自动化安全运营与闭环联动 面对分散的告警，Cloudflare正在构建自动化安全运营平台，由检测代理和专家代理关联历史基线与多数据源，还原攻击时间线并向人工推荐防御策略。通过反向代理与前向代理（Cloudflare One）的联动，系统能够将公网攻击企图与企业内部横向移动关联，使单次调查结果持续强化后续的整体防护。

In July, AI agents testing new cybersecurity models compromised parts of OpenAI’s infrastructure and Hugging Face’s production environment. We've all just witnessed one of the first AI-driven successful cyber attacks. When given a task, the agents ignored existing guardrails and autonomously discovered previously unknown vulnerabilities, recovered exposed credentials, moved between cloud environments and coordinated their work through communication channels they created themselves. The speed of the final compromise was incredible. In under 13 hours, the agents went from executing code on a Hugging Face worker to gaining admin-level access across multiple clusters. But the incident had been brewing for much longer. Responders found clues of activity tracing back to May (agents created an unauthorized message board), to June (internal network scanning) and early July. The relationship between these events was understood only on July 20. The lesson here is not that AI agents exploit vulnerabilities. That’s not news; human attackers already do that. The change is that agents can work persistently, test multiple paths simultaneously, share discoveries, and chain vulnerabilities, credentials, and permissions into sophisticated attacks. The incident also shows why application security cannot depend on single tools. For example, network restrictions were bypassed by services connected to the Internet; valid credentials were used to perform unauthorized actions. Rebuilding Artifactory removed one attack path, but agents found another. The key insight is that individual alerts identified pieces of the activity without revealing the complete campaign. OpenAI reached a similar conclusion in [its report](https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf): organizations need overlapping and independent controls across prevention, detection, and mitigation, continuous validation of security boundaries, and faster mechanisms to correlate and contain suspicious behavior. We address this challenge by connecting application security across four activities that are too often separated: discovering which risks matter, governing what humans and agents may do, protecting applications at runtime, and turning every investigation into stronger protection. Cloudflare can deliver this framework because of its broad security portfolio and visibility across a vast share of Internet traffic. Alongside the framework, we connect existing Cloudflare solutions with new capabilities across each stage. These include: using Large Language Models (LLMs) to conduct a penetration test of our Web Application Firewall (WAF), expanding threat intelligence to all customers, and a new feature to automate deploying positive security. The security landscape is shifting. These are the emerging trends we see: Application Security’s goal is also expanding. It now needs to address three connected problems: protecting conventional applications from AI-enabled attackers, governing legitimate and malicious agentic clients, and securing applications that contain models, agents, tools, and data. Application security in the AI era must operate as a continuous system rather than a collection of controls that teams update after each new vulnerability. To protect applications in the era of AI, you need to work on multiple activities, which we have organized around four stages: None of these activities is new in isolation. What changes is connecting them so discoveries, runtime signals, and investigation outcomes continually improve the controls that follow. More than 20% of the web sits behind Cloudflare’s network, which gives us visibility into attack infrastructure, payload mutations, emerging techniques, and coordinated campaigns at a scale that few organizations can match. Patterns that look isolated from the perspective of one application can become clear across our network. This combination of global threat intelligence, local application context, and inline enforcement powers every stage of the framework. That local context includes which code is deployed, which endpoints are exposed, what legitimate traffic looks like, which identities are acting, and which controls are already active. Because Cloudflare is inline, we can turn those insights into protections immediately. Cloudflare is the adaptive security control plane for applications, APIs, and agents. Here is what we are launching today to advance every stage of the security journey. Security teams do not suffer from a shortage of findings. They struggle to determine which findings represent an immediate risk. A useful discovery system must connect vulnerabilities to the production reality, including whether a vulnerability buried in your stack is actually reachable in the first place. We see three main areas you should look into: software composition risk, proprietary code, and runtime penetration testing (pentesting). Applications inherit risk from open source libraries, packages, operating-system components, and the services on which they depend. This represents the Supply Chain of your application. A package vulnerability alone does not tell a team whether the affected component is deployed, reachable, or exposed to hostile traffic. Open-source software is the top priority when it comes to supply chain risk, and Cloudflare is part of [Chainguard Athena](https://www.chainguard.dev/athena), an industry coalition aiming at protecting open-source software from AI attacks. When it comes to code scanning, you have two options: getting a managed service or developing in-house expertise to run it yourself. Cloudflare recently announced early access to [Vulnerability Discovery and Remediation](https://blog.cloudflare.com/vulnerability-discovery-remediation/), a service that uses frontier models to identify application-specific vulnerabilities and deploy WAF mitigations to block targeted exploits while engineers fix the code. The important step is prioritization. Cloudflare connects source-code findings to production traffic and security signals. We can identify whether the affected route is active, and how much traffic it receives. Defenders can also use the same capabilities as attackers. Customers can build their own LLM-based [pentesting harness](https://blog.cloudflare.com/build-your-own-vulnerability-harness/) to search for weaknesses, validate findings, and test whether their applications are vulnerable. Discovery becomes continuous rather than a periodic exercise. We have done this internally at Cloudflare since Anthropic’s Claude Mythos was released, and we [shared our learnings](https://blog.cloudflare.com/cyber-frontier-models/). A vulnerability buried deep inside your code is harder to exploit if it can’t be reached from the outside. Our Security Analyst team has already used [LLM-based red teaming](https://blog.cloudflare.com/adaptive-ai-waf-testing/) to test customer applications and our own runtime detections, turning the findings into improved detections for all customers. We are now developing Adaptive Security, a self-service capability that will periodically pentest selected URLs behind Cloudflare, using LLM-powered agents to identify vulnerabilities that are reachable and exploitable before attackers find them. Agentic traffic operates in the space between automation and human: tasks delegated by people, executed by software. This changes how access decisions must be made. Detecting automation is no longer enough. For every interaction, application owners need to answer two questions: Is this entity who it claims to be, and can this interaction be trusted? These questions can be hard to answer. A recognized agent with a long history of legitimate activity may have high trust, but an unusual action can still create immediate risk. An unknown agent may simply be new; a lack of history does not necessarily mean malicious intent. Cloudflare’s approach is to keep trust and risk signals separate, thereby giving application owners more control than a single bot score or allow-or-block decision, and providing more powerful tools to quickly adapt to change. Trust accumulates over time, while risk is evaluated for each interaction. [Botbase](https://developers.cloudflare.com/bots/botbase/) provides a directory of known automated entities that have registered with Cloudflare. Registration gives legitimate bots and agents a way to declare who they are, while application owners retain control over whether and how those agents may access their sites. Cloudflare is also making registration more accessible to smaller and custom agents, building a verified identity layer across all agentic traffic, not just the major platforms. Identity alone does not establish trust. Cloudflare can evaluate whether an entity has been seen before, whether its historical behavior was legitimate, and whether its current activity is consistent with that history. This makes it possible to distinguish a recognized agent behaving normally from the same agent suddenly changing established request patterns, location, identity, or transaction behavior. [Precursor](https://blog.cloudflare.com/introducing-precursor/) adds client-side and session-level signals to distinguish human from automated behavior, such as typing cadence, mouse movement, navigation patterns, and sequences of actions. An agent that navigates a checkout flow in two seconds, skipping the browsing and comparison steps a human would take, reveals its nature through the session. These signals help identify whether behavior across a session is consistent with human interaction or automation, giving application owners a clearer picture of the traffic they're managing. Application owners can block traffic from AI crawlers and decide what activity is allowed on their asset (e.g. search, training, etc.). [Adaptive Intelligence](https://blog.cloudflare.com/introducing-adaptive-intelligence/) combines network, client-side, historical, and behavioral validation signals in a probabilistic model that can be updated as attackers change their techniques. Customer outcomes, including chargebacks and successful legitimate transactions, can feed back into the system to improve future decisions. The result is a continuously updated assessment of every entity and interaction. Application owners can encourage known, useful automation while applying stronger controls when identity, history, and current behavior indicate greater risk. Cloudflare’s reverse proxy protects applications at runtime by filtering traffic before it reaches the origin. In the AI era, a new layered approach is emerging to best filter traffic from malicious requests: You can dramatically reduce the attack surface by learning what legitimate traffic looks like, allowing conforming requests and blocking everything else. Today we are announcing [Application Profiles](http://blog.cloudflare.com/application-profiles), which automatically learns the structure of your web or API application and detects non-conforming requests. Application Profiles automates the learning process and adds a layer of interpretation. Based on the learned profile, we can understand the business logic of different endpoints and request parameters and help you prioritize what endpoints require more scrutiny and attention. Traditional WAFs are designed to run highly crafted rules to detect Common Vulnerabilities and Exposures (CVEs) and malicious payloads. Before AI, the time to disclose new vulnerabilities was measured in months and days. Not anymore: now we see vulnerabilities being exploited before they are disclosed, so the time to patch is nearing zero. Different tools can be deployed to detect known exploits. These tools include: Attackers can still craft legitimate requests and abuse business logic to gain advantage on the application. For example, an attacker uses a valid password-reset flow repeatedly to take over accounts. [Fraud detection tools](https://developers.cloudflare.com/bots/account-abuse-protection/), including account takeover and leaked credential detections, help prevent abuse in which the request appears legitimate, but the intent is malicious. Back in June, we launched [always-on detection](https://blog.cloudflare.com/realtime-threat-intel-waf-rules/) based on our threat intelligence feeds. [Cloudforce One](https://blog.cloudflare.com/cloudflare-threat-intelligence-platform/#from-data-management-to-active-hunting) customers can deploy protections to block requests originating from compromised infrastructure. We are now also [expanding access](http://blog.cloudflare.com/threat-signals) to Cloudforce One’s Threat Events Platform, our core threat intelligence offering, to [all Cloudflare accounts for free](http://blog.cloudflare.com/threat-signals). The OpenAI Hugging Face incident did not begin with the final 13-hour compromise. The activity stretched from May to July, with signals including an unauthorized message board, internal network scanning, and movement across environments. Viewed separately, each event revealed only part of the activity. Together, they showed the behavior of a developing breach. Security operations must therefore identify sequences of behavior that lead to compromise, not simply evaluate alerts in isolation. This is difficult for security teams that already protect large attack surfaces with limited resources. Alerts arrive from different tools and datasets, leaving analysts to determine which events are connected, collect the evidence, and identify whether the activity is escalating. Cloudflare is building a platform to automate security operations. Deterministic workflows establish the customer and investigation context using trigger history, traffic baselines, enforcement outcomes, and network observations. A detection agent searches authorized datasets for anomalies and correlations. When it finds suspicious activity, specialist agents review the evidence alongside customer history and threat intelligence, helping analysts connect isolated events to broader campaigns. The system can then recommend mitigations, such as rate limiting, WAF, or DDoS protection changes, for human approval. We are developing these capabilities with Cloudflare’s [Managed Defense](https://www.cloudflare.com/managed-defense/) team, whose analysts are helping us test how evidence is collected, correlated, and turned into recommendations. We plan to make them available more broadly over time and will share more as this work progresses. Cloudflare’s combination of reverse proxy and forward proxy services makes this correlation especially powerful. Application Security signals can reveal attempts to exploit a public-facing application, while Cloudflare One can surface subsequent activity across corporate traffic. Connecting these datasets can link an external attack with unusual access, internal scanning, or potential lateral movement, turning separate alerts into a timeline of compromise and helping analysts intervene before the breach progresses. AI is changing how software is built, how attacks unfold, and who interacts with applications. Security teams can no longer manage discovery, access, runtime protection, and response as separate activities. Cloudflare is bringing these capabilities together in a closed-loop system powered by global intelligence, local application context, and inline enforcement. A vulnerability finding can strengthen runtime protection, runtime activity can guide an investigation, and each analyst decision can improve future detections and controls. No organization can anticipate every new technique. The goal is to build a security system that learns from each attempt, responds faster, and becomes more effective over time. The capabilities announced today are the next step toward that adaptive model of application security.