Cloudflare Announces Early Access to Context-Aware Vulnerability Discovery and Remediation with OpenAI Daybreak Models

Cloudflare Announces Early Access to Context-Aware Vulnerability Discovery and Remediation with OpenAI Daybreak Models Cloudflare has introduced early access to Vulnerability Discovery and Remediation, an invitation-only Managed Defense service that pairs OpenAI Daybreak models like GPT-5.6 Cyber with Cloudflare edge traffic telemetry to detect, prioritize, and mitigate vulnerabilities in customer codebases. The service prioritizes vulnerability findings by linking code analysis with production signals, including active routes, traffic volume, and existing WAF defenses. A multi-agent pipeline uses OpenAI Daybreak models to run reconnaissance, code hunting, and mitigation validation across authorized codebases. Cloudflare generates both source code patches and conservatively scoped custom WAF rules, requiring customer approval before any changes are deployed. Prompt workflows run through Cloudflare AI Gateway to OpenAI servers with redactions and tool guardrails that treat customer code and logs strictly as evidence. Context-Driven Vulnerability Prioritization Traditional scanners often generate thousands of alerts without indicating whether vulnerable code is deployed, receiving live traffic, or already shielded by existing controls. Cloudflare's Vulnerability Discovery and Remediation connects code inspection with real-time operational context from Web Assets and WAF. By identifying active routes, traffic volume, and recent attack patterns, the service treats high-traffic endpoints as hot paths that undergo stricter security profiling, turning generic code weaknesses into prioritized, actionable findings. Multi-Agent Discovery and Remediation Workflow Adapted from Cloudflare's internal scanning harness, the process starts by matching authorized code, such as Cloudflare Workers source, to production endpoints using metadata and Web Assets. A reconnaissance agent maps request paths to corresponding codebase segments, directing hunter agents to inspect those specific areas for vulnerabilities. Findings must be corroborated by source code evidence before a validation stage assigns risk ratings and drafts both code patches and scoped WAF Custom rules to mitigate exposure while code fixes undergo review. Execution Architecture and Security Guardrails The harness runs on Cloudflare and routes prompts via Cloudflare AI Gateway to OpenAI Daybreak models, such as GPT-5.6 Cyber, with no model inference running on Cloudflare's edge. Investigations operate under strict access boundaries where logs, request metadata, and source code are treated as inspection evidence rather than instructions. Proposed edge defenses are tested against synthetic fixtures instead of live traffic, tool calls are logged and policy-checked, and models possess no ability to apply patches or rules without human review and customer authorization.

Cloudflare联合OpenAI Daybreak模型推出上下文感知漏洞发现与修复服务 Cloudflare宣布在Cloudflare Managed Defense中推出受邀抢先体验的“漏洞发现与修复”（VDR）服务，结合OpenAI Daybreak模型与自身全球网络数据，提供具备生产环境上下文的漏洞检测与补救方案。 VDR服务利用OpenAI Daybreak模型（包括GPT-5.6 Cyber）在客户授权的代码库中进行侦察、搜寻与验证。 系统将源码漏洞与生产环境流量、活跃路由及WAF防护状态相结合，解决漏洞告警泛滥与优先级评估难题。 服务提供定制化代码补丁和临时WAF自定义规则，所有防御建议均需通过模型外的自动化校验与团队审查，且由客户自主决定是否应用。 模型推理运行在OpenAI服务器上，Cloudflare通过AI Gateway进行数据脱敏与权限隔离，模型无法直接修改客户生产环境。 结合生产上下文解决漏洞优先级难题 传统安全扫描器往往产生大量告警，却无法判断代码是否部署、路由是否承载实际流量或是否已有防御措施。Cloudflare依托全球网络视角，从Web Assets和WAF获取流量与安全事件快照，将高频或存在攻击活动的路径标记为热路径进行严格审查，从而精准判断漏洞在生产环境中的实际暴露程度与修复优先级。 基于多智能体的工作流程与缓解方案 该方案适用于Cloudflare Workers和代理应用。系统通过侦察智能体将请求路径映射到代码模块，搜寻智能体深入授权代码挖掘漏洞并结合网络上下文辅助分析，但最终漏洞成立必须由源码证据支撑。验证阶段评估风险等级后，平台会生成优先级清单，并建议定制代码补丁；在代码修复期间，还可自动提供针对性的WAF规则以降低暴露风险。 安全控制与早期访问方式 在架构安全上，Cloudflare Workers通过AI Gateway将提示词发送至OpenAI的Daybreak模型，推理不运行在边缘，模型亦无权直接修改环境。输入数据经过脱敏，源码和日志仅被当作证据处理而非指令。所有提议需通过外部工具检验并在合成请求上验证。该服务目前通过Managed Defense团队以邀请制向早期客户开放单一应用的授权调查。

Your scanner just flagged 4,000 new vulnerabilities, 78 of them critical. Which one do you fix first? To answer that question, Cloudflare is announcing early access to Vulnerability Discovery and Remediation, now part of [Cloudflare Managed Defense](https://www.cloudflare.com/managed-defense/). Vulnerability Discovery and Remediation is a new, invitation-only Cloudflare service that helps customers detect and mitigate vulnerabilities in their codebases. Through the OpenAI [Daybreak Defense Network](https://openai.com/index/putting-frontier-cyber-models-in-more-trusted-hands/), we use OpenAI Daybreak models, including GPT-5.6 Cyber, for reconnaissance, hunting, and validation against codebases that you authorize us to access. If we detect a vulnerability, we will then propose solutions to you, automatically checking each proposed patch and any accompanying proposed mitigation before presenting them for review. Importantly, you are in the driver’s seat: while we may propose code patches and other mitigations, you decide whether they are implemented. Choosing what to fix first has always been hard. It's getting harder. Large language models can now surface weaknesses across a codebase [in minutes](https://openai.com/index/the-defenders-window/), which means the number of findings keeps climbing. But the real problem is speed. Attackers can use AI to accelerate parts of vulnerability discovery and exploitation, giving security teams and developers less time to decide what matters and act on it. Imagine that your scanner tells you there's a vulnerability in a handler. It doesn't tell you whether that code is deployed. It doesn't tell you whether anyone is actually hitting that route, what security activity surrounds it, or what controls you already have in place. You have to prioritize the finding without evidence of its production exposure or the protections already in place. This is where we can help. With our global network, we can see which routes are active, how much traffic they carry, and what security events surround them. When customers enable Vulnerability Discovery and Remediation with Web Application Firewall (WAF), we can also see what rules are already applied and are actively blocking attacks. That context turns a generic finding into a specific priority: this vulnerability is in code that's live, on a route that's heavily used, with recent attack activity and no existing protection. And we can help you mitigate that vulnerability by proposing custom WAF mitigations and code patches tailored to your systems. If this sounds familiar, it should. In [“Build your own vulnerability harness”](https://blog.cloudflare.com/build-your-own-vulnerability-harness/), we described the model-agnostic pipeline we use to scan Cloudflare's fleet, adversarially validate every finding, and turn raw model output into fixes engineers can trust. That internal system is one pillar of Vulnerability Discovery and Remediation. The harness gave us a way to find bugs at fleet scale. Vulnerability Discovery and Remediation brings that discovery process to the code the customer authorizes us to inspect, then connects the findings to production traffic, security events, and the edge controls that can act on them. This diagram provides an overview of our process, which we explain in more detail below. Our solution works across Cloudflare Workers and proxied applications. The process of detecting vulnerabilities begins with the collection of a traffic and security data snapshot from [Web Assets](https://developers.cloudflare.com/security/web-assets/) and [WAF](https://www.cloudflare.com/products/waf/). The snapshot shows which routes are active, how much traffic they receive, and whether recent security events are associated with them. For instance, a path exhibiting a high volume of [detection triggers](https://blog.cloudflare.com/attack-signature-detection/) may also be considered critical for security context purposes. Web Assets and WAF itself serve as the first and second pillar of Vulnerability Discovery and Remediation respectively. Next, we use source code vulnerability analysis to identify potential weaknesses in code. But that analysis does not show which routes reach it, how much traffic those routes receive, whether they receive suspicious requests, or which protections already apply. We treat routes carrying a high volume of requests as hot paths. Source code deployed to these routes undergoes stricter security profiling. Together, these signals provide evidence about how the API is used and where a vulnerability may be exposed. For Workers, we retrieve the most recent source version of the Worker and its configured routes to identify the endpoints the Worker serves. Next, we match the Worker's routes to Web Assets and request metadata from [Workers Observability](https://developers.cloudflare.com/workers/observability/), tying the exact source under review to the endpoints it handles in production. This collected network context stays available throughout the investigation, allowing agents to pull it when they need it. Our vulnerability harness then starts up. It begins by using the Reconnaissance agent to map request paths to the parts of the codebase that handle them. Reconnaissance uses that map to send hunter agents into specific sections of the customer-authorized code, where they look for vulnerabilities and pull in relevant network context as needed. That context can help the hunter agents pay more attention to code behind an active or recently targeted route, but it does not establish that a vulnerability exists. Every vulnerability finding has to be corroborated by evidence in the source code. Once the hunters return their findings, the validation stage checks the proposed mitigations before assigning each vulnerability an initial risk rating based on source code. The network evidence we collect can raise that rating further when, for example, the affected endpoint carries significant traffic or shows signs of active probing. The result is a prioritized list of findings, each with a recommended code patch and, when the evidence supports it, a Cloudflare WAF Custom rule that can reduce exposure while the code fix is reviewed. If you have authorized our VDR to defend your zone, we will deploy the rules, scoped conservatively around the method, path, and other request details needed to reach the vulnerable code. If a route pattern contains only variables and wildcards, we do not suggest a rule. We would rather miss a possible connection than claim one the evidence cannot support. The HTTP method override bypass example above shows how these signals work together. The harness maps the source finding to the production route, uses traffic and security activity to prioritize it, and scopes a proposed WAF rule around the requests that can reach the vulnerable code. That rule can reduce exposure while engineering reviews and ships the code patch. When you authorize an investigation, Vulnerability Discovery and Remediation runs the harness on Cloudflare and sends model prompts from Workers through Cloudflare AI Gateway to OpenAI Daybreak models on OpenAI's servers. GPT-5.6 Cyber is used during reconnaissance, hunting, and validation, and its responses return to the harness so the workflow can continue on Cloudflare. No model inference runs at Cloudflare's edge, and the model cannot apply any patch or rule it proposes. We keep each investigation narrow by limiting it to the source code and evidence the customer authorizes. Before that context reaches the model, Vulnerability Discovery and Remediation removes what the investigation does not need and applies the redaction controls configured for the engagement. The harness treats source code, logs, and request metadata as evidence to inspect, rather than instructions to follow. Tool access follows the same boundary: each call is logged and checked against the investigation's access policy before it runs, and every patch or rule proposal must pass checks implemented outside the model. If one of those checks fails, the workflow stops before the proposal reaches customer review. Nothing is presented for review until it has cleared the checks and our team validates the output. For an edge-defense suggestion, that means validating the rule syntax and running it against synthetic fixtures that represent expected requests, rather than against customer traffic. If a check fails or the result remains ambiguous, we hold the output back and route it for diagnosis. Passing those checks still does not change your environment. After validation by our team, Vulnerability Discovery and Remediation prepares the source code patch and WAF rule. Vulnerability Discovery and Remediation is available to selected customers by invitation during early access through our Managed Defense team. Each engagement starts with one application whose codebase the customer authorizes us to investigate. To connect the findings to production, Vulnerability Discovery and Remediation uses authorized read access to the Web Assets operation inventory, the relevant WAF controls, and Workers Trace Events Logpush where available. The investigation is semi-automated, but you review every result before deciding whether to test or deploy a change. If you're interested in learning more, talk to your Cloudflare account team.