Cloudflare And OpenAI Team Up To Automate Vulnerability Detection And Patching At The Edge

Cloudflare has launched a new vulnerability management service that uses OpenAI’s Daybreak models to find, prioritise and help fix software vulnerabilities, deploying edge-level defences that can block attacks before engineering teams have written a patch.

The service, called Vulnerability Discovery and Remediation, is available in early access through Cloudflare Managed Defense. It combines code analysis and automated patch generation using OpenAI Daybreak models, including GPT-5.6 Cyber, with real-time traffic and security context drawn from Cloudflare’s global network.

A vulnerability backlog that keeps growing

The service arrives as the volume of disclosed software vulnerabilities continues to accelerate. By September 2026, the National Vulnerability Database had logged 60,475 vulnerabilities, already surpassing the 48,185 total recorded across all of 2025.

Traditional vulnerability scanners can surface thousands of findings but often lack production context to indicate which ones warrant immediate attention. Without that context, security teams risk spending time sorting through noise while active threats go unaddressed. The gap between when a vulnerability is discovered and when it gets fixed has become one of the more dangerous exposure windows in enterprise security.

How the service works

Cloudflare’s approach integrates AI-driven code analysis across its platform, spanning web assets, its web application firewall (WAF) and Workers Observability. Rather than treating vulnerability findings in isolation, the system correlates them with live internet traffic data from Cloudflare’s network, which processes trillions of requests per day across millions of web properties.

The service is designed to allow eligible customers to triage vulnerabilities that are actively being targeted by correlating live traffic patterns with code vulnerability scans. This surfaces high-priority issues while keeping quieter vulnerabilities visible rather than buried.

When a vulnerability is identified, customers can instruct Cloudflare to deploy custom WAF rules tailored to the specific attack vector, effectively patching the exposure at the network edge while developers work on a code-level fix.

OpenAI’s Daybreak models, including GPT-5.6 Cyber, then generate suggested code patches that developers can review and implement. No code fix or edge rule takes effect without explicit human approval.

Shifting from reactive to automated defence

Co-Founder and CEO of Cloudflare, Matthew Prince, framed the service as a departure from the traditional patch-by-patch approach to vulnerability management.

“If your security team is manually fighting AI-driven attacks, you’re not just burning them out, you’re losing. Now, we’re shifting the defence strategy away from chasing patches one vulnerability at a time to an automated approach,” Prince explained.

“We built Cloudflare’s global network to analyse what’s happening across the internet in real time. Pair that with the power of OpenAI GPT-5.6 Cyber, and you’re not just reacting to attacks anymore, you’re stopping them before they land.”

Head of Global Cyber Partnerships at OpenAI, McCall McIntyre, pointed to the collaboration as part of the company’s broader Daybreak Defense Network initiative.

“Our goal through the OpenAI Daybreak Defense Network is to give defenders the advantage of frontier AI, safely,” McIntyre commented. “We are excited to team up with Cloudflare to put proactive, AI-driven security directly into the hands of enterprise defenders.”

The role of Cloudflare’s network

Cloudflare operates one of the larger global networks, and the company argues this gives it an advantage over security vendors that rely on isolated code scanning or static network telemetry. The scale of traffic flowing through Cloudflare’s infrastructure allows its threat intelligence team to detect signals and patterns in real time, potentially spotting emerging weaknesses and zero-day exploits before they are widely exploited.

By integrating vulnerability discovery directly into the same platform that handles web traffic and edge security, the company aims to close the loop between detection and mitigation more quickly than approaches that require handoffs between separate scanning, alerting and remediation tools.

Last Updated on September 4, 2026 by Nick Ross