According to OpenAI's own announcement dated October 21, 2026, Cloudflare is using OpenAI models—accessed through a product OpenAI calls Daybreak—within its Vulnerability Discovery and Remediation service, offered as an early-access option through Cloudflare Managed Defense. OpenAI states the models investigate customer-authorized source code to identify potential vulnerabilities and check supporting evidence, while Cloudflare adds live traffic data, security signals, and validation to prioritize findings. The service prepares proposed code patches and, where appropriate, custom web application firewall rules. Per the announcement, Cloudflare runs automated checks on these proposals and has its team review them before sharing with customers, who retain control over which changes to implement. Cloudflare is quoted stating it proxies roughly 20% of the web's traffic. A Cloudflare representative identified as Anderson describes separately using OpenAI's Codex coding tool: he says a four-developer team rebuilt a previously postponed product 'in three days,' spending '$1,100 on tokens,' work he estimates would otherwise have required months and 'maybe 10x more developers.' These figures come from Cloudflare via OpenAI's post and are not independently verified. OpenAI is the primary and only named source for this announcement.
- Service is early-access via Cloudflare Managed Defense, using OpenAI models through 'Daybreak'
- Models investigate code; Cloudflare adds traffic/security signals and human review before customer sees proposals
- Customers retain control over which patches and WAF rules to implement
- Cloudflare claims a 3-day product rebuild by 4 developers using Codex at '$1,100 on tokens' (vendor-stated, unverified)
What it means for you
This is a vendor announcing how it uses AI internally and in a product it sells—useful as a signal of where security tooling is heading, not something that changes your week. The notable detail isn't the AI: it's that Cloudflare kept a human review step between the AI's proposed fixes and the customer, and left customers deciding which changes to apply. That's the right shape for anything touching security. The productivity claims (3 days, $1,100, 10x fewer developers) are Cloudflare's own numbers, not independently verified—treat them as a vendor story, not a benchmark.
Try this
If vulnerability management is part of your operation, write down who currently decides which flagged issue gets fixed first and who signs off before a patch ships. Most teams can't name that person cleanly—and no AI tool fixes an unowned decision.
Who should care
Whoever owns application security or vulnerability remediation, and teams already running on Cloudflare Managed Defense who might be offered this early-access service.
Skip this if
You don't manage your own application code or security patching, or you're not a Cloudflare customer. For most operators this is industry context, not an action item.
Sources: OpenAI — read the original