Cloudflare runs four specialist agents in parallel on each security alert

A single AI agent given a whole security investigation hallucinates claims the evidence does not support. Cloudflare's Managed Defense team wrote up how its own prototype did exactly that, and what shape of harness replaced it in production.

The three failures the first version produced were specific. Context became authority: a detection is a hypothesis, and a broad agent read it as proof. Scope drifted: the agent queried the wrong account or time range because the prompt was treated as a boundary. Failure disappeared: a timed-out lookup read the same as "checked and found nothing". Each of these produces an advisory with claims the evidence does not support.

The replacement moves evidence collection out of the model. Before any inference runs, deterministic code performs a fixed set of reconnaissance workflows with versioned API calls. It gathers the customer's identity, detection history, traffic baseline, enforcement outcome, and network observations, and stores each piece with its source, version, and timestamp. Two runs over the same snapshot see the same inputs, so any disagreement between them is about interpretation alone.

Clef, Cloudflare's open-source decision model, then does fast triage on Workers AI: has this event fired for this customer before, how did the analyst decide last time, does it look like normal human traffic. Alerts scored as likely false positives skip the specialist stage.

For alerts that pass triage, a coordinator agent runs four specialists in parallel. Traffic analysis reviews request behaviour and enforcement. Customer context reviews earlier alerts and the analyst's past decisions. Global telemetry compares the activity to aggregate patterns across Cloudflare's network, and never receives any other customer's records. Threat intelligence checks indicators already in the case. A synthesis agent combines their typed findings and cannot fetch new evidence or choose a classification outside the approved vocabulary.

Clef is also called a second time, to score whether the evidence is sufficient. If it is not, the system refuses to classify. The advisory distinguishes three evidence states by name: not checked, checked with no match, and checked with support for absence. A timed-out global telemetry source produces a note that the harness cannot say whether the pattern is widespread. The advisory never reads as a confident finding when the lookups behind it did not complete.

The harness runs on Cloudflare's own developer platform: Workers admits evidence, Workflows coordinates the stages and saves work between them so a failed stage reuses what already passed, D1 holds investigation state, R2 keeps evidence artefacts, and Durable Objects carries case-chat state. Approved OpenAI Daybreak and Anthropic models (GPT-5.6 Cyber and Mythos) handle deeper analysis.

The pattern transfers. A team building an agent that acts on real customer data can take the same decisions one at a time: fix the data before inference, use a small decision model for triage so most alerts never reach a large one, give each specialist only the evidence it needs, and constrain the final step to a vocabulary a human can audit. Managed Defense Analysts still own every classification; the harness only changes what reaches them.

Source

Building an evidence-grounded agentic security operations harness on Cloudflare, Cloudflare.