Cloudflare is using GPT-5.

If your vulnerability scanner spits out 4,000 new findings with 78 of them marked as critical, you aren't looking at a task list—you're looking at a crisis. The core issue isn't just finding the bugs; it's the lack of context. A scanner can tell you a handler is vulnerable, but it can't tell you if that specific route is actually receiving live traffic, if it's exposed to the public internet, or if your WAF is already silently dropping the exploit attempts.

Cloudflare is trying to solve this noise problem by launching early access to Vulnerability Discovery and Remediation, a new component of their Managed Defense suite. Instead of just handing you a list of CVEs, they are integrating code analysis with real-world edge telemetry.

How the AI-driven workflow actually works

The system relies on the OpenAI Daybreak Defense Network, specifically leveraging models like GPT-5.6 Cyber. The workflow isn't a simple "scan and report" loop; it operates through a multi-pillar pipeline:

• Reconnaissance and Hunting: The models scan authorized codebases (Cloudflare Workers or proxied applications) to find potential weaknesses.
• Contextual Validation: This is the differentiator. The system pulls a snapshot of traffic and security data from Web Assets and the WAF. It checks which routes are active, the volume of traffic they carry, and whether there is recent malicious activity targeting those specific endpoints.
• Automated Patch Proposing: If a vulnerability is confirmed to be "live" and unprotected, the system proposes both code patches and custom WAF mitigations.
• Verification: Before a human even sees the suggestion, the system automatically checks the proposed patch to ensure it actually fixes the issue without breaking the logic.

By combining these layers, a generic "high severity" finding gets re-ranked. A vulnerability on a high-traffic, unshielded route with active attack signatures becomes a "fix now" priority, while a vulnerability in a dead code path gets pushed down the list.

Deployment and Control

It is worth noting that this is an invitation-only service hosted within the Managed Defense ecosystem. While the AI does the heavy lifting of reconnaissance and validation, the human engineer remains the gatekeeper. The system proposes the code and the WAF rules, but nothing is implemented in your production environment without manual approval.

The technical foundation for this is based on an internal "vulnerability harness" Cloudflare uses to secure its own fleet. They’ve essentially productized that adversarial validation pipeline, shifting it from scanning their own infrastructure to scanning customer-authorized code.

For teams struggling with the sheer volume of LLM-generated findings in their security pipelines, this approach moves the needle from "finding everything" to "fixing what matters." It effectively turns a massive pile of raw model output into a prioritized, actionable remediation roadmap.