Cloudflare Blocks 234 Billion Daily Threats Using OpenAI Daybreak

Cloudflare blocks an average of 234 billion cyber threats per day across its network, and it now uses OpenAI's Daybreak to find and fix software vulnerabilities before attackers can reach them. The company disclosed the figures as part of its early-access security service, Vulnerability Discovery and Remediation, offered through Cloudflare Managed Defense.

The service combines OpenAI models accessed through Daybreak with Cloudflare's global network and threat context. The models investigate customer-authorized code, assess potential vulnerabilities, and check the evidence supporting each finding. Cloudflare then adds live traffic data, security signals, and validation to prioritize what matters, and prepares proposed mitigations and patches for customers to review.

The stakes are significant. Cloudflare proxies roughly 20 percent of the web's traffic, and organizations depend on that network to keep their applications secure, fast, and reliable. A vulnerability discovered and patched at that scale affects a substantial share of the internet's attack surface.

Why does this matter for security teams?

Security teams face a constant stream of vulnerability information and alerts. Manually sifting through that data takes time and effort, and leaves teams with less capacity to investigate and address critical issues. A Cloudflare executive named Anderson described the problem directly: "Traditional security teams have a ton of useful data. They just don't have the people and time to deal with it."

Cloudflare's answer is to connect a vulnerability in source code to what is actually happening in production. The service answers three questions for each finding: Is the affected route active? Is it receiving suspicious traffic? Are existing security controls already protecting it? Those signals give security teams context for deciding what to investigate first, rather than working through a queue of undifferentiated alerts.

The workflow proceeds in defined steps:

• OpenAI models accessed through Daybreak investigate customer-authorized code and identify potential vulnerabilities.
• The models check the evidence supporting each finding.
• Cloudflare adds live traffic data, security signals, and validation to prioritize findings.
• The service prepares proposed code patches and, where appropriate, custom web application firewall rules to reduce exposure while developers review a fix.
• Cloudflare runs automated checks on the proposals, and its team reviews them before sharing anything with customers.

For Cloudflare customers, the result is a clear path from identifying a vulnerability to protecting the affected application. They receive evidence to prioritize vulnerabilities, proposed edge protections to reduce exposure, and code fixes to review. Customers retain control over which changes to implement. The service does not push patches automatically; humans make the final call.

What do the humans do?

Anderson framed the division of labor between machines and engineers as the core design decision. "The beauty of the automation that Daybreak and Codex provide is that you can assign machines to do the grunt work so humans can exercise their judgment on the most important engineering and security decisions," he said.

That statement describes the architecture of the service as much as its philosophy. Models do the repetitive work of reading code and gathering evidence. Cloudflare's team reviews every automated proposal before it reaches a customer. Customers decide what ships.

The same logic extends to Cloudflare's engineering organization through Codex, OpenAI's coding agent, which developers use to increase output and improve code quality.

How far does Codex stretch a development team?

The numbers Cloudflare reported from its own engineering work are specific. Anderson said that a third of Cloudflare's company consists of software developers building services and features for the platform, and that all of them use the tool.

"At Cloudflare, a third of our company are software developers building services and features for our platform, and 100% of them use Codex to boost their output and deliver better code," Anderson said.

He described a recent product rebuild the team had postponed. "We were putting off building it because we didn't have the manpower to do it," he said. With Codex scaling developer productivity, the question shifts from "Can we take this on?" to "Why not?"

Anderson estimated that the work would have required months of sequencing and "maybe 10x more developers." Instead, a Cloudflare team of four developers took on the build.

"We built it in three days, rolled it out and tested it, and spent $1,100 on tokens," he said.

The figures anchor a concrete comparison: a project once scoped at months of engineering sequencing and roughly ten times the headcount landed in three days, with four developers, for $1,100 in token spend. Cloudflare also reports a 10x reduction in development resources needed to create a new product.

What changes in the build process?

Anderson argued that adopting AI across engineering is not a matter of adding a tool, but of restructuring how software gets built. Making AI part of everyday engineering means "rebuilding the internal process to build technology with machines in mind, not as a separate element, but as something that's integrated into the build process," he said.

That integration shows up on both sides of Cloudflare's operation. On the security side, models investigate code while production traffic data validates whether a vulnerability is actually exposed. On the development side, four engineers deliver what once required a larger team over months.

The security service is early access, offered through Cloudflare Managed Defense, and its scope is deliberately bounded. Customers authorize the code the models investigate. Customers review proposed patches and firewall rules. Customers choose what to implement.

What is the trajectory?

Cloudflare's early-access service puts the integrated approach into practice by connecting code investigation with production evidence and proposed actions customers can review. The stated goal is to give security teams the information they need to decide which vulnerabilities to prioritize and how to protect and fix affected applications, while customers retain control over changes.

The company's stated metrics define the scale at which the approach operates: 234 billion threats blocked daily on average in Q1 2026, roughly 20 percent of web traffic proxied, 100 percent of a developer workforce one third of the company using Codex, and a three-day, $1,100 product rebuild by a team of four. If the early-access service performs as intended in customer environments, the pairing of model-driven code investigation with live network evidence will test whether vulnerability management can move from alert triage to prioritized, evidenced remediation at internet scale.