# AI Agents That Hunt Vulnerabilities and Propose Patches: Cloudflare's Wild New Feature

Hi, I'm Shii-chan!

Today I found an interesting announcement from Cloudflare's blog that combines AI and security, so let's dig in.

## What was announced?

According to the Cloudflare Blog, Cloudflare has announced Vulnerability Discovery and Remediation, a new Managed Defense feature built on OpenAI's Daybreak models. It's currently available through an invite-only early access program.

## Why it matters

The post describes a few pain points in security operations:

- Vulnerability scanners can surface thousands of findings at once, but figuring out which ones actually deserve attention first is hard
- Findings often get prioritized without context, like whether the flagged code is actually deployed or how much traffic it's handling
- AI tools have made finding vulnerabilities a matter of minutes, but that's created a new problem: it's unclear how those findings relate to your existing defenses

Against that backdrop, there's a real need for something that doesn't just find vulnerabilities, but prioritizes them using production context and helps you actually fix them.

## What changes

With this feature, you can assess the risk of discovered vulnerabilities using production-environment signals — how active a web asset's routes are, how much traffic they receive, and WAF security events. On top of that, it proposes patches that have been verified against your actual source code, so your security team gets help not just finding issues but fixing them too.

## Dive Deep

Here's how the mechanism is described in the post:

- A Reconnaissance Agent maps request paths to the codebase, and a Hunter Agent investigates the relevant sections in depth
- Network-level evidence, like whether a route is actually receiving traffic, is factored in to raise risk scores or adjust prioritization
- Only patches that are demonstrated against the actual source code get proposed
- Custom WAF rule suggestions are also provided as a stopgap mitigation until the code fix lands
- Model inference runs on OpenAI's servers, not at the edge. Cloudflare sends prompts from Workers through AI Gateway to OpenAI's Daybreak models, with GPT-5.6 Cyber used for reconnaissance, search, and verification
- Information that isn't needed for the investigation is stripped out before being sent, and all tool access is logged and verified
- It covers code running on Cloudflare Workers and applications proxied through Cloudflare

At this point it's an invite-only early access program, and the post doesn't mention pricing or a general availability date — if you're interested, you'd need to talk to your Cloudflare account team.

## Wrap-up

- Cloudflare announced Vulnerability Discovery and Remediation, a Managed Defense feature built on OpenAI's Daybreak models
- It prioritizes vulnerabilities using context like production traffic and WAF events
- A Reconnaissance Agent and Hunter Agent work together to investigate code and propose patches verified against the real source
- Model inference runs on OpenAI's servers; unnecessary data is stripped and tool access is logged and verified
- Currently invite-only early access, with pricing and GA timing not yet public

This one's a great fit for security teams drowning in unprioritized vulnerability scan results, or anyone trying to shorten the time it takes to get from finding to fixing.