Cloudflare's New AI Vulnerability Scanner Puts Context Before Patches

Your scanner just flagged 4,000 new vulnerabilities, 78 of them critical. Which one do you fix first? Cloudflare's answer: stop guessing and start using production context.

Cloudflare is announcing early access to Vulnerability Discovery and Remediation (VDR), an invitation-only service under Cloudflare Managed Defense. VDR uses OpenAI Daybreak models—including GPT-5.6 Cyber—to scan customer-authorized codebases, propose patches, and automatically validate them before presenting anything for human review.

Context is the killer feature

Traditional scanners tell you a vulnerability exists in a handler, but not whether that code is deployed, whether anyone hits that route, or what security controls are already in place. VDR pulls in traffic and security data from Cloudflare's network—Web Assets, WAF, and Workers Observability—to turn a generic finding into a specific priority: this vulnerability is in live code, on a heavily used route, with recent attack activity and no existing protection.

For Workers, VDR retrieves the latest source and configured routes, then matches them to Web Assets and request metadata. The harness uses a Reconnaissance agent to map request paths to code sections, then sends hunter agents into those areas. Every finding must be corroborated by source code evidence—network context can raise the risk rating but cannot alone establish a vulnerability.

How the model runs

When you authorize an investigation, VDR runs the harness on Cloudflare and sends prompts through Cloudflare AI Gateway to OpenAI Daybreak models on OpenAI's servers. No model inference runs at Cloudflare's edge, and the model cannot apply any patch or rule it proposes. Each call is logged and checked against the investigation's access policy, and every proposal must pass checks implemented outside the model.

For WAF rules, VDR scopes them conservatively around the method, path, and request details needed to reach the vulnerable code. If a route pattern contains only variables and wildcards, no rule is suggested. The team would rather miss a possible connection than claim one the evidence cannot support.

Early access details

VDR is available to selected customers by invitation during early access. Each engagement starts with one application whose codebase the customer authorizes. The investigation is semi-automated, but you review every result before deciding whether to test or deploy a change.