Cloudflare has introduced Vulnerability Discovery and Remediation, a new service that combines code analysis from OpenAI’s Daybreak models, including GPT-5.6 Cyber, with the traffic and security context Cloudflare’s network observes. The goal is to detect vulnerabilities, work out which ones are actually under attack, generate specific rules for the Web Application Firewall (WAF), and then propose a code fix. The service is available in early access, by invitation only, to select Enterprise customers.
Cloudflare and GPT-5.6 Cyber in 30 seconds
- Cloudflare combines code analysis from OpenAI Daybreak with intelligence drawn from real traffic.
- GPT-5.6 Cyber can help investigate vulnerabilities and generate proposed fixes.
- If there’s immediate risk, Cloudflare can prepare a specific WAF rule to block the attack at the edge.
- The platform tries to prioritize flaws that are actively under attack over vulnerabilities with lower immediate risk.
- No WAF rule or code fix goes live without human approval.
The move addresses one of the perennial problems in vulnerability management: finding a flaw doesn’t necessarily tell you what to fix first. A scanner can return thousands of results, but a security team needs to tell the difference between a theoretical vulnerability in a barely exposed component and one that’s already seeing active exploitation attempts.
Cloudflare wants to use its position inside production traffic to add that missing context. Rather than treating code analysis and network defense as two separate sources, the company cross-references its findings with signals observed across its security services.
From code to real traffic to decide which vulnerability matters most
The new capability is built into Cloudflare Managed Defense and connects three parts of the platform: Web Assets, WAF, and Workers Observability. OpenAI’s Daybreak models sit on top of these to investigate code and generate possible fixes.
The process follows a different sequence than a traditional scanner.
First, the code is analyzed to locate possible vulnerabilities. Cloudflare then adds context from the traffic the application receives and from its own security systems.
That lets it attempt to answer a more practical question: is anyone actually trying to exploit this flaw in production?
| Stage | Function |
|---|---|
| Discovery | Code analysis to locate vulnerabilities |
| Context | Cross-referencing with traffic and security signals |
| Prioritization | Identifying the highest-risk flaws |
| Temporary protection | Generating a specific WAF rule |
| Remediation | Proposed code fix |
| Review | Human approval before changes are applied |
Cloudflare calls this first prioritization process Triage What’s Actively Under Fire. The platform correlates vulnerability-analysis results with real-time internet traffic to bump up the priority of issues showing signs of exploitation.
That doesn’t mean vulnerabilities with no observed attacks get discarded. Cloudflare says explicitly that the system keeps those findings, but uses production context to help set priorities.
The distinction matters. A high CVSS score tells you about a vulnerability’s potential severity, but on its own it doesn’t tell you whether a specific application is reachable, whether the vulnerable code is actually running, or whether attackers are trying to exploit it.
Adding production telemetry can provide extra information for making that call.
Cloudflare is also starting from considerable scale. The company says it processes trillions of requests daily across millions of web assets, which it uses to observe attack patterns and feed its threat-intelligence capabilities. That figure comes from the company itself and isn’t an independent measurement.
The WAF acts as a temporary patch before the code is fixed
One of the most technically interesting pieces is the link between discovering a vulnerability and the Web Application Firewall.
When a flaw requiring immediate attention is identified, the customer can ask Cloudflare to generate a custom WAF rule specifically for the attack vector detected.
The rule runs on Cloudflare’s edge infrastructure and can block malicious requests before they reach the vulnerable application.
It’s a form of virtual patching.
It doesn’t fix the underlying error in the code. What it does is put a temporary barrier in the attacker’s path while the development team prepares, tests, and ships the permanent fix.
That distinction is especially relevant for critical vulnerabilities and zero-days. In a complex application, changing code can mean reviewing dependencies, running tests, cutting a new release, and deploying it to production. A WAF rule can offer earlier mitigation, as long as the exploitation vector can actually be blocked that way.
The flow Cloudflare proposes looks like this:
vulnerability → risk analysis → real traffic → WAF rule → code fix
OpenAI is involved both in the investigation and in the final step of the process.
Models from its Daybreak family, including GPT-5.6 Cyber, can run detailed code analysis and help generate the patches developers then review.
Cloudflare isn’t proposing, at least in this first version, a fully autonomous chain that can modify a production application on its own initiative.
There’s an explicit control in place: no code fix and no edge protection rule goes into effect without human approval.
That separates automation from autonomy. The AI can investigate, prioritize, and prepare an action, but the final decision still rests with the responsible team.
More than 60,000 vulnerabilities logged in 2026
Cloudflare justifies the need to automate part of the process by pointing to the growing number of vulnerabilities security teams have to manage.
According to figures the company cites, the National Vulnerability Database (NVD) had already logged 60,475 vulnerabilities as of September 2026, above the 48,185 recorded for all of 2025.
The comparison helps illustrate the volume problem, but the raw number of vulnerabilities doesn’t mean all of them affect any given company, or that they all carry the same odds of being exploited.
That’s precisely where the new service is trying to stand out.
Traditional vulnerability-management systems typically rely on severity ratings, affected software, exposure, and similar parameters. Cloudflare is adding another source: what’s actually happening in the traffic crossing its own network.
The approach can be especially useful when a new vulnerability appears and there’s still little public information about its exploitation. If Cloudflare detects traffic patterns consistent with real attack attempts and can tie them to a flaw located in a customer’s code, the priority of the response changes.
The company even argues that its infrastructure can help detect and neutralize certain zero-day attacks before they spread widely. That’s a capability Cloudflare attributes to its combination of global visibility and threat intelligence, not a guarantee that it can anticipate every new vulnerability.
GPT-5.6 Cyber is being brought in through the OpenAI Daybreak Defense Network, an initiative aimed at making specialized cybersecurity models available to defensive organizations.
For Cloudflare, the deal means connecting those models to a source of information an isolated LLM doesn’t have: production traffic, WAF telemetry, and application observability.
For OpenAI, it’s another use case for its cyber models in enterprise defensive systems, one where actions the model proposes can translate into concrete technical controls — a trend that’s also showing up as OpenAI and Anthropic push further into cybersecurity more broadly.
The combination also shows where security automation is heading. The goal is no longer just asking an AI to find bugs in a repository. The workflow is starting to connect code, threat intelligence, production telemetry, network mitigation, and software fixes — not unlike how Cloudflare’s Adaptive Intelligence engine already leans on real traffic patterns to sharpen its bot defenses.
Vulnerability Discovery and Remediation still isn’t a generally available product. Cloudflare is offering it in early access, by invitation, to select Cloudflare Enterprise customers, so its results at scale will still need to be verified as adoption grows.
The company hasn’t announced a date for general availability either.
For now, the most notable technical piece is the bridge it builds between two very different clocks in security: the time a team needs to fix an application, and the time an attacker needs to start exploiting it. Cloudflare’s approach uses the edge to temporarily cover that gap while GPT-5.6 Cyber helps prepare the permanent fix.
Frequently Asked Questions
What is Cloudflare Vulnerability Discovery and Remediation?
It’s a new Cloudflare Managed Defense service that combines code analysis via OpenAI Daybreak models with traffic and security intelligence from Cloudflare’s network to discover, prioritize, and help fix vulnerabilities.
What does GPT-5.6 Cyber do inside Cloudflare?
GPT-5.6 Cyber can take part in deep code investigation and help generate fixes. Cloudflare combines those results with its traffic context to determine which issues need the most priority.
Can Cloudflare patch a vulnerability without touching the code?
It can generate a WAF rule tailored to the attack vector to temporarily block exploitation at the edge. That’s a mitigation, not necessarily a substitute for fixing the code for good.
Can the AI apply changes automatically?
Not in the announced service. Cloudflare specifies that no code fix or WAF rule goes into effect without explicit human approval.
Source: cloudflare