Cloudflare put Artifacts, a Git platform for AI agents, into open beta with three primitives: repo event subscriptions, Workers bindings and region controls. The detail comes from a third-party dev.to write-up, and its latency and residency claims still need confirming in Cloudflare's documentation.
Reality
- Evidence30
- Adoption
- Insufficient
- Hype gap+40
- Incentives
- Insufficient
- Confidence35
Cloudflare's Issues for Workers, in open beta since September 30, can send grouped production errors and the affected Worker version to a coding agent. A dev.to walkthrough argues each failure needs sorting first, since a correct refusal can arrive looking like a bug.
Reality
- Evidence35
- Adoption
- Insufficient
- Hype gap0
- Incentives
- Insufficient
- Confidence40
Cloudflare now sells web search from Ceramic.ai, Exa and Linkup through AI Gateway at partner list prices, billed from gateway credits with no markup. Teams already on the gateway skip a separate search vendor account, though their agents still have to issue each search call.
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap+10
- Incentives75
- Confidence55
Cloudflare has put Traces into open beta, recording each supported step a request takes through its edge as an OpenTelemetry span. The spans export to any OTLP endpoint, so edge decisions can sit in the tracing backend a team already runs.
Reality
- Evidence40
- Adoption
- Insufficient
- Hype gap+10
- Incentives85
- Confidence45
Cloudflare has opened Logpush, once Enterprise-only, to Free, Pro and Business customers on self-service pay-as-you-go pricing. Small teams can now send edge logs to their own tools without a contract, though the company concedes its year-old pledge to open every feature is unfinished.
Reality
- Evidence50
- Adoption15
- Hype gap+15
- Incentives70
- Confidence55
Cloudflare is merging logs, traces, alerts, dashboards and exports into one observability platform, shipped as eight updates under one pricing model. With Logpush now on self-serve plans, teams that run their own Cloudflare log pipeline have a built-in alternative to cost out.
Reality
- Evidence50
- Adoption
- Insufficient
- Hype gap+20
- Incentives75
- Confidence55
Cloudflare Workers adds five ML-KEM and ML-DSA parameter sets to Web Crypto behind the webcrypto_modern_algorithms flag. Developers can now test post-quantum code against primitives built into the runtime, but they still have to build the protocols on top.
Reality
- Evidence60
- Adoption
- Insufficient
- Hype gap0
- Incentives55
- Confidence62
Ahrefs, Known Agents, Profound and Scrunch run a Worker on every request, so a 20-file page spends 21 of Cloudflare's 100,000 free daily invocations. A site with 10,000 page views a day would need more than twice that.
Reality
- Evidence64
- Adoption
- Insufficient
- Hype gap+8
- Incentives
- Insufficient
- Confidence58
Cloudflare's Workers Issues, now in open beta, groups production errors from one config line and sends them to Claude Code, Cursor or Devin. Detection and dispatch happen inside Cloudflare; the fix, and any gate before it ships, live in the agent's workflow.
Reality
- Evidence45
- Adoption10
- Hype gap+15
- Incentives85
- Confidence50
Cloudflare's EmDash 1.0 runs each CMS plugin in its own isolate capped at 50ms of CPU per request, a dev.to breakdown says. Isolation limits what a bad plugin can reach, and choosing which publisher keys to trust stays with the site owner.
Reality
- Evidence45
- Adoption30
- Hype gap+25
- Incentives65
- Confidence50
Google stops serving the Custom Search JSON API on January 1, 2027 and has already closed it to new customers. Teams using it for general web search now pick between rewriting for another provider and running a shim that copies the old contract.
Reality
- Evidence40
- Adoption
- Insufficient
- Hype gap+20
- Incentives65
- Confidence45
Azure Front Door charges about $205 a month for a terabyte of static files that Cloudflare Workers serves for $0, per a dev.to list-price comparison. Past the included allowance, each paid Azure route bills by the gigabyte, so the service a site ships through puts the same terabyte at about $78 to $205.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+15
- Incentives30
- Confidence55
Cloudflare fixed a Containers flaw that let paying customers read other tenants' leftover disk data, found on 18 of 24 production tries. Sandboxes, the product it sells for running untrusted and AI-written code, was affected too.
Perspective Coverage
3 publishers
- Builder
- Builder 42%
- Operator
- Operator 48%
- Investor
- Investor 10%
Reality
- Evidence72
- Adoption
- Insufficient
- Hype gap+10
- Incentives55
- Confidence70
bcb-br-mcp's maintainer found Brazil's central bank API answers unknown series codes with an HTTP 200 HTML error page after about 30 seconds. The same page hit a valid Selic series on 3 of 9 calls, so the server now retries before it declares any code invalid.
Reality
- Evidence55
- Adoption12
- Hype gap−5
- Incentives30
- Confidence45
Socket confirmed 40 Firefox extensions as wallet stealers posing as OKX, Rabby and TronLink, with Supabase as a remote switch. Detection-first controls do not survive this pattern.
Reality
- Evidence62
- Adoption
- Insufficient
- Hype gap+10
- Incentives
- Insufficient
- Confidence60
Researchers read a token out of a co-located Worker in Cloudflare's production fleet, 360 times faster than the 2021 demo that justified language-level isolation.
Reality
- Evidence58
- Adoption45
- Hype gap+15
- Incentives55
- Confidence62
Cloudflare moved its main blog from WordPress to EmDash, its own TypeScript CMS, on a Worker stack tested to 7,000 requests per second. The test ran on a cached blog built from Cloudflare services, so the figure carries over only to sites whose pages cache as well.
Reality
- Evidence35
- Adoption10
- Hype gap+30
- Incentives70
- Confidence45
The invitation-only service takes read access to authorized repositories and ranks findings by whether the route is deployed, busy and already covered by a WAF rule, then proposes a fix, pre-checks it, and hands you the approval.
Reality
- Evidence40
- Adoption
- Insufficient
- Hype gap+15
- Incentives80
- Confidence60
Cloudflare made Python Workers generally available on September 21, moving binding type conversion into the runtime and adding ASGI and WSGI connectors for FastAPI, Django and Flask. Outbound TCP still goes through JavaScript's connect().
Perspective Coverage
3 publishers
- Builder
- Builder 70%
- Operator
- Operator 20%
- Investor
- Investor 10%
Reality
- Evidence60
- Adoption
- Insufficient
- Hype gap+20
- Incentives65
- Confidence70
An InfoQ account of a multi-CDN edge platform describes splitting one Cloudflare Worker into a gateway plus feature workers over service bindings, after the shared script tied every team's cadence to the slowest change in flight.
Reality
- Evidence35
- Adoption25
- Hype gap+20
- Incentives40
- Confidence55
Earlier coverage
- Cloudflare hands the Vary normalization call to whoever writes the Cache Rule
Build · September 22, 2026 · 1 publisher
- Cloudflare gives each Git branch its own Durable Objects and Containers
Build · September 22, 2026 · 1 publisher
- A five-minute function ceiling pushes long agent loops off Vercel's Hobby tier
Build · September 21, 2026 · 1 publisher
- Attackers rewrote Brevo's embedded scripts at Cloudflare's edge with a hardcoded full-permission key
Security · September 17, 2026 · 3 publishers
- A Cloudflare Worker generates the code_challenge IFTTT's redirect leaves out
Build · September 16, 2026 · 1 publisher
- Scoping an agent to one Worker filters what Cloudflare's API returns to it
Build · September 15, 2026 · 1 publisher
- Click-time code generation strips the 15-minute limit out of device code phishing
Leadership · September 13, 2026 · 1 publisher
- A dev-server alias kept a cron handler out of the deployed Cloudflare Worker
Build · September 11, 2026 · 1 publisher
- Cloudflare CASB now revokes the risky share before an admin opens the finding
Build · September 11, 2026 · 1 publisher
- Port 25 decides which email check you can actually run
Build · September 11, 2026 · 1 publisher
- Sharing an MCP server across a team now costs an OAuth 2.1 authorization flow
Build · September 10, 2026 · 1 publisher
- Cloudflare gates workerd's rewritten module registry behind a new_module_registry flag
Build · September 9, 2026 · 1 publisher
- Talos ties a fake Google CAPTCHA to a DLL executing from a remote WebDAV share
Security · September 8, 2026 · 1 publisher
- Talos found ClickFix operators moving their skimmer into a Tampermonkey userscript
Product · September 8, 2026 · 1 publisher
- Anthropic's Fable 5 answers the old thinking toggle with an HTTP 400
Build · September 8, 2026 · 1 publisher
- An 11MB Worker bundle put a three-second compile in front of a 5ms handler
Build · September 7, 2026 · 1 publisher
- Cloudflare's send_email binding reaches only verified addresses until onboarding finishes
Build · September 7, 2026 · 1 publisher
- Cloudflare turns OpenAI's cyber model into WAF rules that wait on human approval
Product · September 3, 2026 · 1 publisher
- A 169-line build verifier catches the mechanical bugs AI diffs keep shipping
Build · September 1, 2026 · 1 publisher
- Next.js 15.5 stops writing cache entries for any path middleware rewrites
Build · September 1, 2026 · 1 publisher
- Bytebox compiles Java to WebAssembly for Cloudflare Workers on a single blocking thread
Build · August 31, 2026 · 1 publisher
- An internal app pushed its reporting reads into the browser rather than resize D1
Build · August 31, 2026 · 1 publisher
- Superior ships its wallet drainer as a routine auto-update to extensions users already trusted
Build · August 30, 2026 · 1 publisher
- Edge KV puts the permission check an hour behind the Postgres row
Build · August 29, 2026 · 1 publisher
- One boolean on the click step decides whether the agent's browser launches at all
Build · August 29, 2026 · 1 publisher
- Cloudflare's connect(socket) handler makes the edge a termination point for arbitrary TCP
Build · August 29, 2026 · 1 publisher
- The transcription pipeline where the model was the easy part
Build · August 27, 2026 · 1 publisher
- A 120-line Figma plugin, and everything the host made you build around it
Build · August 26, 2026 · 1 publisher
- FTP welcome banners are the new dead drop, and that suits whoever reads netflow
Security · August 25, 2026 · 1 publisher
- The hard part of 12-language search was not translating it, it was writing like an AliExpress seller
Build · August 25, 2026 · 1 publisher
- QUICSILVER runs its C2 over QUIC, and most port-443 inspection is scoped to TCP
Security · August 24, 2026 · 1 publisher
- A spec-clean 402 is not a listing: x402scan bounced the tunnel, not the JSON
Build · August 22, 2026 · 1 publisher
- Eleven tables, no indices: 119.1 ms per read, and a tracing pipeline that accepted nothing
Build · August 22, 2026 · 1 publisher
- One chat, four cards: three stacked causes and why each correct fix looked broken
Build · August 22, 2026 · 1 publisher
- Cloudflare's agent browser makes a cost argument and skips the cost
Build · August 22, 2026 · 1 publisher
- Nine locales, no middleware: route groups as a Cloudflare billing decision
Build · August 22, 2026 · 1 publisher
- The malware asks a question and reads its orders off the doormat: PowerShell in FTP banners
Build · August 21, 2026 · 1 publisher
- Cloudflare's own team beat its Spectre defence and pulled 12 bits a second out of production
Build · August 21, 2026 · 1 publisher
- Cloudflare lets users strip scopes at the consent screen, and your agent has to cope
Build · August 20, 2026 · 1 publisher
- Cloudflare's own researchers broke the Spectre defense it shipped in 2021
Build · August 19, 2026 · 1 publisher