Cloudflare's new service uses WAF traffic to rank flaws and draft patches

Cloudflare on September 3 opened early access to Vulnerability Discovery and Remediation, a new invitation-only service inside Cloudflare Managed Defense. It searches customer-authorized source code for vulnerabilities using OpenAI Daybreak models, then uses live traffic and WAF data from Cloudflare's network to rank the findings and prepare both a code patch and a WAF rule for review.

What the service does

Cloudflare says the goal is prioritization. A code scanner can now find many possible weaknesses in minutes, but it does not know which route is deployed, how much traffic it carries, what security events it has attracted, or which rules are already blocking attacks. Vulnerability Discovery and Remediation collects a snapshot from Web Assets and the Web Application Firewall, matches the source under review to the routes it actually serves in production, and treats high-traffic paths as the most important ones, which get stricter security profiling.

The workflow runs three agent stages in sequence. A Reconnaissance agent maps request paths to the code that handles them. Hunter agents then read specific sections of the customer-authorized code and pull in network context as needed. A Validation stage checks each candidate finding, and Cloudflare says every result must be corroborated by evidence in the source before it is shown.

For each confirmed finding, the harness proposes a source code patch and, where useful, a WAF rule that can reduce exposure while engineering reviews and releases the code change. Cloudflare gives an HTTP method override bypass as its worked example: the harness maps the source finding to the production route, scores it against traffic and recent attack activity, and drafts a WAF rule scoped to the requests that can reach the vulnerable code.

How it is limited

Access is invitation-only during early access and comes through the Managed Defense team. Each engagement starts with a single application whose codebase the customer authorizes Cloudflare to investigate, plus authorized read access to the Web Assets operation inventory, the relevant WAF controls, and Workers Trace Events Logpush where available. The investigation is semi-automated and the customer reviews every result before deciding whether to test or deploy it.

The harness runs on Cloudflare, but model inference does not. Prompts leave Workers through Cloudflare AI Gateway and reach OpenAI Daybreak models, including GPT-5.6 Cyber, on OpenAI's servers. No model runs at Cloudflare's edge, and Cloudflare says the model cannot apply any patch or rule it proposes. Before context reaches the model, the harness strips what the investigation does not need and applies the redaction controls configured for the engagement.

The interesting part here is the ranking step. Most application security teams already receive more scanner output than they can read, and the missing information is production exposure: which of these code paths is actually live, which of them gets heavy traffic, and which of them has recent attack traffic. Cloudflare has that information for any site that uses its network, and Vulnerability Discovery and Remediation is the first product that uses it directly in the triage step. Teams already on Managed Defense are the ones this affects, and they should ask about it; anyone else can read the writeup as an example of how triage works when the CDN and the WAF are part of it.

Source

• Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak models, Cloudflare, September 3, 2026.