Cloudflare integrates OpenAI Daybreak into Managed Defense to prioritize vulnerabilities#
Finding a vulnerability in code does not necessarily answer the most urgent question: which one should be fixed first. One flaw may exist in a rarely used route, while another affects an exposed endpoint with high traffic and recent signs of suspicious activity.
Cloudflare wants to bring that context into the process. The company has announced early access to Vulnerability Discovery and Remediation, a new Managed Defense capability that uses OpenAI Daybreak models, including GPT-5.6 Cyber, to analyze authorized code and connect findings with how applications behave in production.
From code analysis to production context#
The system does not treat every vulnerability as an isolated finding. Vulnerability Discovery and Remediation combines source code analysis with information from Web Assets and the Web Application Firewall (WAF).
This makes it possible to determine which routes are active, how much traffic they receive, and whether related security events exist. For applications running on Cloudflare Workers, the system can also connect the analyzed code version with the endpoints actually serving production traffic.
The key difference is prioritization. A vulnerability supported by evidence in the code can be given higher priority when it affects an endpoint with significant traffic or signs of suspicious activity.
Traffic alone does not prove that a vulnerability exists. Cloudflare states that every finding must be backed by evidence in the source code. Network context is then used to better estimate its exposure.
GPT-5.6 Cyber supports reconnaissance and validation#
Cloudflare uses the OpenAI Daybreak Defense Network and Daybreak models across different stages of the investigation. GPT-5.6 Cyber is involved in reconnaissance, vulnerability hunting, and validation tasks.
OpenAI describes GPT-5.6 Cyber as a model specialized for advanced, authorized cybersecurity work, available through Daybreak Red. It is designed for tasks such as vulnerability research, exploit validation, and security testing under stricter access controls.
In Cloudflare's implementation, the harness runs inside Cloudflare infrastructure, while prompts are sent to Daybreak models hosted by OpenAI through Cloudflare AI Gateway. The model does not directly modify the application or apply the rules it proposes.
WAF rules and patches as part of remediation#
When the system validates a finding, it can prepare a code fix and, when enough evidence exists, a custom Cloudflare WAF rule to temporarily reduce exposure.
The approach addresses two different timelines. A WAF rule can limit requests capable of reaching vulnerable code while the development team reviews and deploys the permanent patch. The proposals go through checks outside the model before they are presented to the customer.
This does not make the process fully autonomous. Cloudflare describes the investigation as semi-automated, with the customer reviewing the results before deciding whether to test or deploy a change.
Access is limited to authorized code#
Vulnerability Discovery and Remediation is currently in early access and available by invitation to selected Managed Defense customers.
Each investigation begins with an application whose source code has been explicitly authorized by the customer. The scope is also restricted to the evidence and context approved for that investigation. Cloudflare applies access controls and redaction before information is sent to the models.
That restriction matters because the system combines sensitive information: source code, request metadata, security events, and edge-control configuration. Access is not broad across the customer's infrastructure; it is defined for each investigation.
Conclusion#
The most relevant part of Vulnerability Discovery and Remediation is not simply the use of AI to find more vulnerabilities. The change is in connecting those findings with production evidence to determine which ones represent the most immediate exposure.
Cloudflare combines code analysis, traffic, security events, and WAF controls within the same workflow, while keeping validation and deployment decisions under human control. In an environment where finding more flaws can also create more noise, prioritizing them with production context may be just as important as detecting them in the first place.