Cloudflare details multi-layered defense architecture against frontier AI cyber models

Cloudflare puts a condition on its own argument. Exploitability, the post says, depends on how the code is used, whether attacker-controlled input can reach the vulnerable path, and the protections that sit around it ^[14]. Both of the first two are properties of the call graph and the ingress path.

The patching half rests on an experiment Cloudflare has already run. It let an AI coding assistant write patches against its own bugs ^[12]. "Some of those patches fixed the original bug while quietly breaking something else the code depended on," the company wrote ^[13]. Writing a fix, regressing it, and shipping it without breaking the code around it has constraints that AI does not remove, according to the post ^[11], while the same tooling is making developer teams ship faster ^[10]. Generated fixes therefore arrive faster than the regression review that has to clear them.

By Cloudflare's own account, a rule holds up against sheer volume. A model can produce thousands of variations of a single exploit and run reconnaissance at the same scale, but many of those iterations carry the same underlying signature, so a rule that catches the first will catch the rest ^[17]. Adaptation is the part that gets through: told there is a WAF in the way, the model probes, learns what gets blocked, and rewrites the payload until it slips past the rule ^[18]. Each block tells the attacker something, and how much it tells them is up to the defender.

The intrusion chain stays intact. Reconnaissance, initial access, lateral movement, persistence and exfiltration still have to happen, and the change is in speed and scale ^[7]. The three tasks the model compresses, discovery and exploit chain construction and proof-of-concept generation, all sit ahead of initial access ^[9], which leaves lateral movement, persistence and exfiltration as the three stages an architecture investment can touch ^[21]. Against a hardened target, the post says, a model still has to probe and adapt, and it often produces more noise than a careful human operator would ^[8].

The architecture Cloudflare describes is built almost entirely from its own products, because its security team is customer zero for the security products it builds ^[4]. Customers get every layer today, and everyone else gets the principles applied to whatever stack they built ^[5].

The post does not report dwell times, block rates or incident counts for the architecture it describes ^[22]. It states the gap it is built around: "The gap between when an attacker discovers a vulnerability and when defenders learn it exists is what worries us most," the company wrote ^[15]. It added, "If you are not running these models against your own code, it is safe to assume someone else is" ^[16].