Cloudflare says OpenAI models aid vulnerability discovery and fixes
News
Cloudflare says it is using OpenAI Daybreak models to find security weaknesses and suggest fixes. It also uses Codex to help developers work faster and write better code.
Cloudflare says it uses OpenAI Daybreak models to look for security weaknesses and suggest fixes for people to review. This adds another way to use AI to improve security during software development. The company also said its developers use Codex to work faster and improve code quality. OpenAI shared this information on 2026-10-21.
Evidence and context
OpenAI's post says Cloudflare uses OpenAI Daybreak to find security weaknesses and help protect systems. The models investigate possible problems and suggest ways to fix them, which people then review. This matches what Cloudflare announced earlier, on 2026-09-03. At that time, the company said its Vulnerability Discovery and Remediation service was available only through an invitation-only early-access program. Selected Enterprise customers could use it through Cloudflare Managed Defense.
Cloudflare's earlier announcement said the process combines OpenAI Daybreak models, including GPT-5.6 Cyber, with information about Cloudflare's live internet traffic and security systems. This helps the models investigate code that customers have allowed the company to examine, decide which security weaknesses matter most, check whether the findings are valid, and suggest code changes to fix them. The system can also suggest custom web application firewall rules when the evidence supports doing so. Cloudflare said the models run on OpenAI's servers and that prompts pass through Cloudflare AI Gateway. Suggested changes must still go through checks and human review.
The available evidence does not show that the service is generally available to everyone. Information published with Cloudflare's 2026-09-03 announcement said it was still available only through an invitation-only early-access program. OpenAI's Daybreak partner page also described the partnership as part of a limited rollout. Registering interest does not guarantee access to the program, access to the models, or a date when the service will be available for production use.