AI-assisted Vulnerability Discovery

6 posts · Apr 2025 – Sep 2026

What this trail covers

Cloudflare One's AI offerings are converging into a unified control plane, integrating Workers AI and AI Gateway. This unification provides a single entrypoint (Workers binding and REST API) for accessing various AI models, including those hosted on Cloudflare's infrastructure (Workers AI) and external providers. The unified control plane offers automatic observability, logging, and cost attribution for all AI inference traffic, even for users who haven't explicitly configured an AI Gateway. New features include Threat Signals, which automates the ingestion and processing of open-source threat intelligence reports into actionable indicators and threat events, making this capability available to all Cloudflare accounts.

All Cloudflare trails

Sep 2026Adaptive application security for the AI era: how Cloudflare connects code, traffic, and intelligence to stop attacksThis post introduces a connected application security framework for the AI era, organizing capabilities around four stages: Discover and prioritize risks, Govern access and agent behavior, Protect applications at runtime, and Investigate, respond and learn. It details new and evolved Cloudflare capabilities including using LLMs for WAF penetration testing, expanding threat intelligence, automating positive security deployment, and introducing Adaptive Security for automated runtime pentesting. It also enhances agent governance with Botbase for known automated entities and Precursor for client-side and session-level signals to distinguish human from automated behavior. The post highlights the shift in application security to address AI-enabled attackers, govern agentic clients, and secure applications containing AI models.
Sep 2026Introducing Threat Signals: agentic skills for open-source threat intelligence, free for every Cloudflare accountIntroduces Threat Signals, a new capability that leverages agentic skills to automate the processing of open-source threat intelligence reports (via RSS feeds) into actionable threat events. This includes summarizing reports, extracting and normalizing indicators of compromise (IOCs), applying account-specific tags, and storing contextualized indicators in a private, account-scoped dataset. Threat Signals integrates with Cloudflare Workflows, Browser Run, R2, and the Threat Events Platform, allowing for the creation of WAF rules from these events. This expands the AI-assisted vulnerability discovery and threat intelligence capabilities by automating the conversion of unstructured threat reporting into structured, actionable intelligence.
Sep 2026Agents can now set up your website’s security with Turnstile SpinThis post introduces Turnstile Spin, an agent-mediated workflow for setting up and managing Cloudflare Turnstile. It automates the integration of Turnstile's frontend widget and backend Siteverify API calls, adapting to fresh installs, fixing existing implementations, and migrating from other CAPTCHA providers. Spin leverages AI coding agents to modify codebases directly, simplifying the security setup for developers and non-developers alike. The post highlights the shift in web development towards AI-driven workflows and how Spin bridges the gap for seamless security integration.
May 2026Project Glasswing: what Mythos showed usThis post details Cloudflare's experience using Anthropic's Mythos Preview LLM for AI-assisted vulnerability discovery. It highlights Mythos's ability to construct exploit chains from primitives and generate proofs of concept, surpassing previous models. The post identifies challenges with model refusals, the signal-to-noise problem exacerbated by programming languages and model bias, and the limitations of generic coding agents for vulnerability research. It introduces the concept of a 'harness' to manage AI execution, enabling narrow scopes, adversarial review, and parallel tasks for improved coverage and reasoning. The described vulnerability discovery harness stages include initial scanning, adversarial review, and proof generation.
Mar 2026From reactive to proactive: closing the phishing gap with LLMsThis post details how Cloudflare is integrating LLMs into its email security tools to move from reactive to proactive detection of phishing threats. By using LLMs to categorize millions of emails, Cloudflare gains high-fidelity signals in near real-time, allowing for earlier identification of emerging threat vectors like 'Sales Outreach' phishing. This enables the creation of specialized ML models trained on LLM-generated linguistic and structural traits, focusing on sentiment and intent rather than static indicators. The output is a risk score that, combined with existing signals, drives enforcement. This approach has led to a 20.4% reduction in reported Sales Outreach phishing misses in Q4 2025 and a further two-thirds reduction in Q1 2026, demonstrating the effectiveness of LLM-driven environmental awareness in narrowing the threat landscape.
Advertisement
Sep 2025A simpler path to a safer Internet: an update to our CSAM scanning toolThis post details an update to Cloudflare's CSAM Scanning Tool, simplifying its adoption by removing the requirement for users to provide their own NCMEC credentials. This change has resulted in a 1600% increase in monthly adoption and aims to make it easier for site owners to contribute to keeping the Internet safer by detecting and blocking CSAM. The tool uses fuzzy hashing to identify potential CSAM even if images are slightly altered. The process now involves enabling the tool, scanning cached content, and Cloudflare blocking identified URLs and notifying the user.
Apr 2025Meta Llama 4 now available on Workers AIThis post announces the availability of Meta's Llama 4 models (specifically Llama 4 Scout) on the Cloudflare Workers AI platform. It details the technical aspects of Llama 4, including its Mixture of Experts (MoE) architecture, early-fusion multimodal capabilities, and large context window (up to 10 million tokens, with Workers AI supporting 131,000 tokens at launch). The post explains how MoE models use specialized 'experts' and a 'router' for efficient inference, and how early-fusion enables native multimodal understanding (text and images). It emphasizes that Workers AI handles the complex infrastructure requirements for hosting these large models (over 200 GB of weights), making them accessible via a simple API request.