Cloudflare Inc. today opened early access to Vulnerability Discovery and Remediation, a service that uses OpenAI Group PBC’s cybersecurity models to find software flaws in customer applications and block attacks on them at the network edge.
The service runs inside Cloudflare Managed Defense, the company’s security operations center offering, and reaches OpenAI’s GPT-5.6-Cyber model through the Daybreak Defense Network. Cloudflare first takes a snapshot from its Web Assets inventory and web application firewall showing which routes are live and what security events they have thrown off.
A reconnaissance agent maps request paths to sections of the codebase, and hunter agents work from that map. Code running on Cloudflare Workers is pulled in through Workers Observability.
Every finding is validated before it gets a risk rating, which then moves up if production evidence shows heavy traffic or active probing against the affected route.
Two kinds of fixes come out of the process. Custom firewall rules, scoped to the method, path and request details needed to reach the vulnerable code, can go up as a stopgap while developers work. The models also draft code patches for engineers to review. No rule and no patch takes effect without explicit human approval, and Cloudflare said the models cannot apply either one on their own.
Prompts travel through Cloudflare AI Gateway to OpenAI servers, and no inference runs on Cloudflare’s own edge. Redaction strips out context the model does not need. Every proposal must also pass checks written outside the model. A failed check stops the workflow before a customer sees anything.
Nobody is short of vulnerabilities to fix. The National Vulnerability Database took in 60,475 of them by September, Cloudflare said. The total for all of 2025 was 48,185. Scanners will hand a team thousands of findings without showing which ones matter in production, and Cloudflare said that’s the gap the service is meant to close.
Cloudflare is leaving behind what co-founder and Chief Executive Matthew Prince called chasing patches “one vulnerability at a time.” Teams fighting AI-driven attacks by hand are losing, in his view. A network that reads internet traffic in real time, paired with GPT-5.6-Cyber, lets defenders stop attacks before they land, he added.
GPT-5.6-Cyber arrived in August, when OpenAI split Daybreak into two access tiers and put the model behind the higher one, Daybreak Red, for vulnerability research and exploit validation. The model completed 95% of advanced cybersecurity requests on OpenAI’s own benchmark, against 1.5% for the general-purpose GPT-5.6 Sol. McCall McIntyre, head of global cyber partnerships at OpenAI, said the network is meant to give defenders the advantage of frontier AI “safely.”
Palo Alto Networks Inc. put the same models to work inside its Unit 42 consulting engagements last month. Notably, Proofpoint Inc. also announced today that Daybreak models now sit behind a SOC Analyst Agent for threat investigation. OpenAI used the same day to commit $1 billion to subsidized Daybreak access for water and electricity utilities, local government, community banks and nonprofits.
Access is by invitation only. Cloudflare is holding the early phase to selected enterprise customers, and each engagement begins with one application the customer nominates. Pricing was not disclosed. Cloudflare gave no timeline for taking the service beyond early access.
