cloudflareAug 7, 2026

Introducing Radar Researcher: An AI tool for exploring Internet data in plain language (opens in new tab)

Cloudflare Radar Researcher is an AI-powered assistant that lets users explore Radar’s Internet data through natural-language questions. It replaces manual API queries, filters, and chart hunting with interactive visualizations, explanations, follow-up questions, and auditable analysis. The beta tool is designed for both casual users and technical researchers, while grounding responses in real data from Radar’s API. ## Why Cloudflare Built Radar Researcher - Cloudflare Radar publishes global Internet data covering: - DNS queries from the 1.1.1.1 resolver - HTTP traffic across Cloudflare’s network - Internet quality measurements from Cloudflare Speed Test - Network outages and other datasets - Radar serves a wide audience, from journalists and curious users to network operators and academics. - AI lowers the barrier to using complex datasets by allowing users to ask questions without knowing a dataset’s structure, terminology, or API. - The tool is especially useful for people working under time pressure, such as journalists investigating current Internet disruptions. ## Natural-Language Data Exploration - Radar Researcher is available from every Radar page in a docked panel. - Users can: - Ask questions in plain language. - Receive short answers or more detailed reports. - View real, interactive Radar charts alongside explanations. - Continue with suggested follow-up questions. - Use text, voice input, or Radar’s search bar. - Conversations are saved in searchable history, can be pinned, and can be shared through links that expire after 30 days. - Users can inspect how the assistant interpreted their question, which datasets it queried, and how it derived its answer. ## Explaining Existing Charts - An “Explain with AI” action lets users start a conversation from any Radar visualization. - The assistant receives: - A screenshot of the chart for visual context. - The exact underlying data from Radar’s API. - The current location, date range, and applied filters. - This combination lets the model explain the exact chart being viewed while preserving numerical accuracy and context. ## Example: Internet Quality in Portugal - A user can ask about home Internet quality in Portugal without manually selecting API parameters or searching Radar pages. - Researcher queries the Internet quality API and presents the results through familiar interactive charts. - Users can ask follow-up questions, such as comparing Portugal with Spain or another neighboring country. - The assistant can also suggest related investigations, including common Internet outages. ## Example: Investigating an Internet Shutdown - Researcher can support more open-ended investigations for engineers, researchers, journalists, and network operators. - For Iran’s 2026 government-directed shutdowns, it: - Retrieved recorded outage events. - Collected corresponding HTTP traffic data. - Explained the timeline in natural language. - The analysis described traffic falling from approximately 0.58 on January 7 to nearly zero by January 9, partially recovering around January 17, and approaching normal levels by January 27. - It displayed the findings as an annotated traffic chart and a table of outages, including another shutdown beginning February 28. - Suggested follow-ups included comparing Iran’s traffic with neighboring countries. ## Cloudflare’s Technical Implementation - The application runs entirely on Cloudflare’s developer platform. - A Cloudflare Worker uses the Cloudflare Agents SDK. - Each conversation is stored in a stateful Durable Object with its own SQLite database. - Chat history, titles, and streaming responses persist even if users leave the page during generation. - Workers AI runs open models, including Kimi K2.7. - An ordered fallback chain across three model families helps maintain availability if one model provider reaches capacity. - Requests are routed through AI Gateway. Radar Researcher makes Cloudflare’s extensive public datasets easier to use without sacrificing precision or transparency. It is particularly valuable when users need fast, context-specific analysis backed by interactive charts and verifiable source data.

llmcloudflare-workersdurable-objectssqlite+3

cloudflareAug 4, 2026

How Cloudflare enforces engineering standards using AI (opens in new tab)

Cloudflare built the Codex to turn scattered engineering knowledge into governed, machine-readable standards that both engineers and AI agents can apply consistently. It now supports code reviews, technical design reviews, and incident reviews, with AI systems flagging nearly 230,000 violations and blocking about 16,000 merges. The central approach is to combine human-owned RFCs with structured extraction, staged enforcement, and context-aware agents. ## Why Cloudflare Built the Codex - Engineering guidance previously existed across formal documentation, repositories, chat, and individual experience. - Engineers struggled to determine whether guidance was current, authoritative, or relevant. - Growth made it difficult for anyone to know every standard or for reviewers to check every requirement. - The Codex provides a shared source of truth that can be retrieved and applied at the point of work. ## Governance and RFC Workflow - The Codex is divided into domains such as: - Architecture and control plane systems - Security and reliability - Programming languages including TypeScript and Rust - Each domain has an owner responsible for content quality and consistency. - Standards follow an RFC format using RFC 2119 terminology: - **SHOULD** for recommendations - **MUST** for mandatory requirements - Employees can propose RFCs through structured merge requests. - Proposals undergo increasingly broad review before domain-owner approval. - Approved RFCs are published to an internal Astro-powered site. - Enforcement is deliberately separated from approval: - Approved standards can generate findings. - Only enforced standards can block merges. - This gives teams time to adopt requirements and implement enforcement mechanisms. ## Structured Standards for Agents - Feeding all 60-plus RFCs directly into an LLM would consume too much context and reduce accuracy. - A dedicated agent extracts SHOULD and MUST statements into structured JSON. - Each statement includes: - A stable slug - RFC and domain metadata - Requirement level - Section and source link - Stable identifiers allow Cloudflare to track requirements across RFC revisions, systems, monitoring, and exception handling. - Cloudflare moved from concise Markdown extraction to JSON to enable filtering and progressive disclosure. - Future metadata may identify which SDLC stage applies, such as design, implementation, or runtime. ## AI Code Review - The AI code reviewer retrieves relevant statements first and loads complete RFCs only when more context is needed. - Approved-RFC findings are non-blocking recommendations. - Violations of MUST requirements in enforced RFCs can withhold approval or block a merge. - Since launch, the reviewer has: - Flagged nearly 230,000 violations - Withheld approval for almost 16,000 violations ## Faster Code Review Alternatives - Full AI reviews generally take several minutes because they use coordinators and multiple agents. - To reduce remediation delays, Cloudflare is also developing mechanically verifiable checks. - Language-specific Codex requirements can be distributed through custom linter configuration packages. - TypeScript was the first language to receive Codex linter support, alongside standardization on oxlint. The Codex’s practical value comes from connecting governed human standards to automated enforcement. Cloudflare’s staged RFC lifecycle, stable statement identifiers, and combination of AI review with fast linters provide a scalable way to preserve engineering knowledge while reducing review inconsistency.

llmtypescriptrustastro+4

cloudflareJul 1, 2026

Content Independence Day, one year on- building the business model for the agentic Internet (opens in new tab)

Cloudflare argues that generative AI has rapidly replaced the traditional web model in which publishers traded content access for search referrals. With AI now driving much of online discovery and crawler activity, content is increasingly consumed without users visiting its source. The company says a new market is emerging in which transparency, access controls, scarcity, and licensing can help publishers regain economic value. ## AI’s rapid transformation of the Internet - Generative AI adoption has reached more than 2.5 billion regular users—over 30% of humanity—in roughly 3.5 years, reportedly more than twice the adoption speed of smartphones. - Users now spend only about 15 minutes on the open web for every hour spent searching for information. - Instead of visiting and comparing multiple websites, users increasingly receive consolidated answers directly from AI systems. - More than 50% of Internet traffic is now non-human, marking the arrival of what Cloudflare calls the “agentic Internet.” ## Crawlers are increasingly focused on AI - AI training accounted for 52% of crawler requests in June 2026, up from 22% in spring 2025. - Mixed-use crawlers, combining search, agent activity, and training, represented more than 36% of crawler traffic. - Traditional search crawlers make up a smaller share of activity, even though they remain important for sending visitors to publishers. - Mixed-purpose crawling makes it difficult for site owners to remain visible to AI-driven discovery without also giving away content for training without compensation. ## The traditional web business model is breaking down - Historically, publishers allowed search engines to crawl their content in exchange for visibility and referral traffic. - AI systems now answer questions, conduct research, compare products, and complete tasks without necessarily sending users to original sources. - Content can therefore be crawled, indexed, and monetized by AI companies while the original publisher receives little or no traffic. - News and media organizations experienced the disruption first, but retail, software, IT, finance, and other sectors are also affected. - Some heavily crawled categories have seen human traffic fall by as much as 40% in under a year. - Publishers are preparing for “Google Zero,” in which search referrals provide little meaningful traffic. ## The impact extends across industries - Any organization publishing proprietary information online may need a strategy for AI access and monetization. - The issue affects not only traditional publishers but also businesses whose websites contain valuable product, technical, financial, or industry knowledge. - Cloudflare frames the sustainability of online content as an economic and public-interest concern because the Internet remains a major global information resource. ## Building a market for content Cloudflare says Content Independence Day focused on three goals: - Give site owners transparency and control over how their content is accessed and monetized. - Create scarcity by allowing publishers to restrict or selectively permit AI access. - Establish a marketplace where publishers and AI companies can discover, license, and price content. According to the post, these efforts have helped create the early conditions for a monetized content market. ## Control and data create negotiating power - Cloudflare’s attribution, business intelligence, and enforcement tools let publishers observe AI access at the network level. - These tools provide stronger practical enforcement than voluntary mechanisms such as `robots.txt`. - Publishers can identify: - How often LLMs attempt to access their content - Which competing AI systems are crawling their sites - Which URLs are most in demand - The relationship between crawling and referrals - Restricting or controlling access creates scarcity, which gives publishers leverage in licensing negotiations. - Better operational data reduces information asymmetry and allows content owners to negotiate with evidence rather than guesswork. Ultimately, the post recommends treating online content as an economic asset rather than an unlimited free input. Publishers should measure AI consumption, control access, and pursue licensing arrangements so that the agentic Internet can support content creation instead of undermining it.

llmaigen-aicloudflare+3

cloudflareJul 1, 2026

Unmasking the crawls with Attribution Business Insights (opens in new tab)

Cloudflare argues that the traditional exchange between crawlers and publishers has broken down as AI bots extract content without sending meaningful referral traffic. This creates lost revenue for publishers while increasing hosting costs, making granular traffic attribution essential. Its new Attribution Business Insights dashboard aims to help site owners identify which bots provide value and make informed decisions about access, blocking, and commercial relationships. ## The Internet’s Changing Economics - Traditional search engines generally crawled content a few times for each visitor they referred. - That crawl-to-referral balance supported advertising, affiliate revenue, subscriptions, and direct audience relationships. - AI crawlers increasingly create a “zero-click” ecosystem by summarizing content without directing users to the original publisher. - Cloudflare observed AI crawl-to-referral ratios ranging from 118:1 to nearly 50,000:1. - Publishers face both reduced traffic-based revenue and higher infrastructure costs from unproductive automated access. ## Attribution Business Insights Dashboard - The dashboard is available to Cloudflare Bot Management customers. - It provides an immediate view of bot activity without requiring extensive manual analytics filtering. - It measures: - Human versus bot traffic to content pages. - Overall and operator-specific crawl-to-referral ratios. - Crawl-to-referral trends over 24 hours, seven days, or 30 days. - Top bots by traffic volume, country, bandwidth usage, and current allow/block status. - AI crawlers are classified by behavior: - **Training:** collecting data for future large language models. - **Search:** refreshing indexes used by retrieval-augmented generation. - **Agent:** supporting automated interactions that return answers to users. ## Turning Traffic Data into Business Strategy - Site owners can use high-level metrics to evaluate whether their content security policies are effective. - More detailed operator-level data helps publishers understand how individual AI companies use their content. - Comparing operators can support negotiations about: - Blocking or allowing specific crawlers. - Licensing content. - Reconsidering existing commercial agreements. - Prioritizing relationships with companies that provide meaningful compensation or referrals. - The dashboard is intended to give publishers concrete evidence—such as comparative crawl volumes and referral performance—when discussing content access with AI companies. Cloudflare’s recommendation is effectively to stop treating all crawlers alike. Publishers should use crawl-to-referral ratios, resource consumption, crawler purpose, and commercial value to decide which bots deserve access and under what conditions.

llmragai-crawlersweb-crawling+4

cloudflareJun 15, 2026

Growing the Cloudflare AI team with talent from Ensemble AI (opens in new tab)

Cloudflare is bringing key members of Ensemble AI onto its team to improve AI infrastructure and inference efficiency. Ensemble’s work on model compression, structured neural architectures, and parameter-efficient fine-tuning complements Cloudflare’s Workers AI platform. The combined effort aims to make powerful AI models faster, cheaper, and easier to deploy globally. ## Incorporating Ensemble AI’s Expertise - Ensemble AI has focused on reducing the memory, compute, and deployment costs of large language and multimodal models. - Its NdLinear technology replaces standard transformer linear layers while preserving multidimensional structure such as attention heads, channels, and spatial dimensions. - NdLinear-LoRA reduces the number of trainable parameters needed to fine-tune large models. - These techniques complement quantization and vector quantization to improve model efficiency without significantly sacrificing quality. ## Improving AI Inference Economics - Cloudflare Workers AI provides serverless GPU-powered inference across Cloudflare’s global network. - Lower model size, memory usage, and compute requirements can improve throughput, GPU utilization, and overall inference costs. - These improvements are increasingly important for agents, multimodal applications, personalization, fine-tuning, retrieval, and reinforcement learning. - The Ensemble team will contribute to Cloudflare’s existing work, including the Infire inference engine, Unweight tensor compression, and systems for running very large language models. ## Supporting Next-Generation Workloads - Developers increasingly need AI infrastructure that is reliable, affordable, globally distributed, and close to end users—not merely access to models. - Cloudflare’s network, serverless platform, and Workers AI provide a foundation for deploying AI with less operational complexity. - Combining Cloudflare’s infrastructure with Ensemble’s efficient model architectures should enable lower-cost, higher-performance AI deployments at scale. Cloudflare’s stated goal is to make advanced AI workloads more accessible by improving the economics and efficiency of inference across its platform.

llmmachine-learningquantizationcloudflare-workers-ai+4

cloudflareApr 20, 2026

Orchestrating AI Code Review at scale (opens in new tab)

Cloudflare built a CI-native AI code review system to reduce review bottlenecks without overwhelming engineers with noisy or generic model feedback. Instead of using one large prompt, it orchestrates up to seven specialized agents for areas such as security, performance, compliance, and documentation, then uses a coordinator to deduplicate and assess findings. The system now reviews tens of thousands of merge requests, approving clean changes and blocking serious bugs or vulnerabilities. ## Why Naive AI Review Wasn’t Enough - Traditional code review can leave merge requests waiting for hours and creates repeated context switching. - Commercial AI review tools provided useful functionality but lacked the flexibility and customization required across Cloudflare’s organization. - A basic “send the Git diff to an LLM” approach produced: - Vague recommendations - Hallucinated syntax errors - Repetitive advice such as adding error handling where it already existed - Complex codebases required specialized analysis rather than generic summarization. ## Specialized Agents and Coordination - The system launches up to seven focused reviewers covering: - Security - Performance - Code quality - Documentation - Release management - Internal Engineering Codex compliance - A coordinator agent: - Deduplicates overlapping findings - Evaluates the actual severity of issues - Produces one structured review comment - The system can actively block merges when it detects serious defects or security vulnerabilities. ## Plugin-Based Architecture - The platform uses composable plugins so it can support different: - Version-control systems - AI providers - Internal standards - Repository-specific requirements - Each plugin implements a `ReviewPlugin` interface with three lifecycle phases: - `bootstrap`: Runs concurrently and is non-fatal. - `configure`: Runs sequentially and is fatal if essential configuration fails. - `postConfigure`: Handles asynchronous work after configuration assembly. - Through `ConfigureContext`, plugins can: - Register agents and AI providers - Set environment variables - Inject prompt sections - Configure agent permissions - Plugins contribute through the context API rather than accessing the final configuration directly. - The core assembler combines these contributions into `opencode.json`. - This separation prevents unrelated components from becoming tightly coupled; for example, GitLab logic does not need to understand Cloudflare AI Gateway settings. ## Plugin Responsibilities - `@opencode-reviewer/gitlab` - Provides GitLab merge request data and a comment server. - `@opencode-reviewer/cloudflare` - Configures AI Gateway model tiers and fallback chains. - `@opencode-reviewer/codex` - Checks compliance with internal engineering RFCs. - `@opencode-reviewer/braintrust` - Adds distributed tracing and observability. - `@opencode-reviewer/agents-md` - Verifies that repository `AGENTS.md` instructions are current. - `@opencode-reviewer/reviewer-config` - Retrieves remote model overrides for individual reviewers. - `@opencode-reviewer/telemetry` - Tracks reviews asynchronously. ## Why OpenCode - Cloudflare already used OpenCode extensively and understood its behavior. - Its open-source implementation allows engineers to: - Investigate problems directly - Contribute fixes upstream - Extend the system through its SDK - Cloudflare engineers had contributed more than 45 upstream pull requests at the time of writing. - Its server-first design was especially important: - Review sessions can be created programmatically. - Prompts can be sent through an SDK. - Multiple concurrent sessions can be managed without scraping or wrapping a CLI interface. ## Coordinator Process - The coordinator runs OpenCode as a child process using `Bun.spawn`. - Its prompt is passed through `stdin` rather than a command-line argument. - This avoids Linux’s `ARG_MAX` limit, which previously caused `E2BIG` failures for unusually large merge requests containing extensive descriptions or logs. - OpenCode runs with `--format json`, emitting JSONL events through standard output. - This event-based interface allows the orchestration layer to collect and process results from concurrent reviewer sessions. A practical takeaway is to treat AI review as an orchestrated CI system rather than a single LLM prompt. Specialized agents, strict plugin boundaries, structured outputs, and observability are essential for making automated review reliable enough to influence merge decisions at organizational scale.

llmdatabase-designgitlabci-cd+4

cloudflareApr 17, 2026

Unweight: how we compressed an LLM 22% without sacrificing quality (opens in new tab)

Unweight is Cloudflare’s lossless compression system for LLM weights, reducing model size by 15–22% while preserving bit-exact outputs. It targets the memory-bandwidth bottleneck in GPU inference by compressing weights in HBM and decompressing them directly into fast on-chip memory before tensor-core computation. On Llama-3.1-8B, the approach saves roughly 3 GB of VRAM and enables more models to run per GPU. ## The GPU Memory Bottleneck - LLM inference is often limited by memory bandwidth rather than computation. - Each generated token requires reading the model’s weights from GPU high-bandwidth memory (HBM). - NVIDIA H100 tensor cores can process data far faster than HBM can supply it. - Smaller weights reduce the amount of data transferred across the memory bus. - Decompression must be carefully integrated: if it adds latency that cannot overlap with matrix multiplication, token generation becomes slower. ## Why Lossless Compression Matters - Quantization commonly converts 16-bit values into 8- or 4-bit integers. - Because quantization is lossy, it can change model behavior and response quality unpredictably. - Unweight instead preserves exact outputs and does not require specialized hardware. - Existing systems were unsuitable because they focused on CPU decompression, custom FPGA hardware, or consumer GPUs rather than Hopper-generation GPUs and production inference. ## Compressing BF16 Weights - BF16 values contain: - A sign bit - An 8-bit exponent - A 7-bit mantissa - Sign and mantissa values appear largely random and are difficult to compress. - Exponents are highly predictable: the 16 most common exponent values account for more than 99% of weights in a typical layer. - Unweight applies Huffman coding to exponent bytes while leaving sign and mantissa bits unchanged. - Rare exponents are handled by storing an entire row of 64 weights verbatim, avoiding per-element branching during decoding. ## Selective Compression of Model Layers - Unweight compresses the MLP gate, up, and down projection matrices. - These matrices represent roughly two-thirds of model parameters and generate substantial memory traffic during decoding. - Attention weights, embeddings, and layer norms remain uncompressed. - The exponent compression produces about 30% savings in the targeted streams and approximately 20% reduction in total MLP weight size. - Overall model-size reductions reach 15–22%. ## Direct GPU Decompression - Model weights normally reside in large but slower HBM and are staged into small, fast shared memory before computation. - Conventional approaches decompress full matrices back into HBM and then run standard matrix multiplication, creating additional memory traffic. - Unweight decompresses weights in shared memory and feeds them directly to tensor cores. - Different execution strategies are used depending on the weight matrix and batch size. - An autotuner selects the fastest strategy for each workload. ## Results and Availability - Tests on Llama-3.1-8B achieved: - Around 30% compression for MLP weights - 15–22% reduction in total model size - Approximately 3 GB of VRAM savings - The savings allow more models to fit on each GPU, potentially reducing inference cost and improving global deployment coverage. - Cloudflare is publishing a technical paper and open-sourcing the GPU kernels. Unweight demonstrates that lossless, inference-time compression can improve GPU utilization without changing model behavior. The practical recommendation is to compress the portions of a model that dominate memory traffic while integrating decoding directly into the GPU execution path.

llmdatabase-designrustmodel-inference+4

cloudflareApr 16, 2026

Building the foundation for running extra-large language models (opens in new tab)

Cloudflare is building infrastructure for serving extra-large open-source language models efficiently, especially for agentic applications with long prompts and frequent tool calls. Its approach combines specialized hardware configurations, prefill/decode disaggregation, prompt caching, distributed KV-cache management, and speculative decoding. These optimizations substantially improve latency, throughput, and cost efficiency without requiring more GPUs. ## Hardware Configurations for Agent Workloads - Different applications stress models differently: - Content generation sends fewer input tokens but produces many output tokens. - Summarization sends very large inputs and generates relatively short outputs. - Agent workloads typically involve: - Large system prompts - Tool and MCP definitions - Accumulated conversation history - Generated code and previous interactions - Workers AI therefore prioritizes fast input processing and tool-calling performance. ## Prefill-Decode Disaggregation - LLM inference has two stages: - **Prefill:** Processes input tokens and populates the KV cache; generally compute-bound. - **Decode:** Generates output tokens; generally memory-bound. - Running both stages on one server can underutilize GPUs because they stress different resources. - Cloudflare separates them across dedicated inference servers: - A prefill server processes the request and stores its KV cache. - A decode server retrieves the cache and generates the response. - This enables independent tuning, scaling for input- or output-heavy traffic, and use of heterogeneous hardware. - The architecture requires a sophisticated load balancer that: - Transfers KV-cache metadata between stages. - Rewrites streaming SSE responses. - Handles different inference-server protocols. - Balances traffic based on estimated in-flight prefill and decode tokens. - After adopting this design, Cloudflare saw: - Lower p90 time to first token and reduced tail-latency variance. - Intertoken latency fall from roughly 100 ms to 20–30 ms. - About a threefold improvement while using the same number of GPUs. ## Prompt Caching and Session Affinity - Long agent conversations repeatedly reuse the same context, making prompt caching essential. - The `x-session-affinity` header routes requests toward regions containing previously computed input tensors. - Cloudflare added support for this header to agent harnesses such as OpenCode. - Cached prompts improve: - Overall throughput - Interactive response times - Pricing, with discounted cached tokens - GPU efficiency - Adoption by heavy internal users increased peak input-token cache hit rates from 60% to 80%. ## Distributed KV-Cache Optimization - Larger models span multiple GPUs, requiring KV caches to be shared across devices and nodes. - For Kimi, Cloudflare uses Moonshot AI’s: - **Mooncake Transfer Engine** for high-speed memory transfers using RDMA technologies such as NVLink and NVMe over Fabric. - **Mooncake Store** to extend cache storage beyond GPU VRAM onto NVMe. - Combined with LMCache or SGLang HiCache, the system can: - Reuse cached prompts from any node in a cluster. - Reduce reliance on session-aware routing. - Balance traffic more evenly. - Keep sessions cached longer. - Increase cache hit rates and supported throughput. ## Speculative Decoding - The post begins introducing speculative decoding as another optimization. - It describes the basic LLM process of predicting successive tokens, but the provided text ends before explaining the technique or its results. Cloudflare’s overall strategy is to match infrastructure to real usage patterns rather than rely on a single hardware configuration. Separating inference stages, maximizing cache reuse, and distributing KV caches are practical ways to make large-model hosting faster and more economical.

llmcloudflaregpu-optimizationprompt-caching+4

cloudflareApr 12, 2026

Welcome to Agents Week (opens in new tab)

Cloudflare argues that AI agents require a fundamental shift in Internet and cloud infrastructure. Unlike traditional one-to-many applications, agents create unique, ephemeral execution environments for individual users and tasks, making current container-based economics and scaling inadequate. The company positions lightweight V8 isolates, alongside containers and browser support, as the foundation for making agents practical at global scale. ## The Internet Was Built for Applications, Not Agents - Cloud infrastructure evolved during the smartphone era to serve many users through a finite number of application instances. - Microservices, containers, Kubernetes, load balancing, and replication all support this one-to-many model. - Agents differ because an LLM dynamically determines code paths, tool usage, and task duration. ## One User, One Agent, One Task - Each agent may need its own execution environment, filesystem, tools, and state. - Coding agents currently use containers with access to Git, Bash, filesystems, and arbitrary binaries. - As agents spread to assistants, analysts, customer service, and planning tasks, the number of simultaneous environments could grow dramatically. ## The Scale Challenge - If 100 million US knowledge workers used agents at 15% concurrency, infrastructure would need about 24 million simultaneous sessions. - At 25–50 users per CPU, that implies roughly 500,000 to 1 million server CPUs in the US alone. - Multiple agents per person and global adoption would increase demand by orders of magnitude. ## Isolates as Agent Infrastructure - Cloudflare’s Workers platform uses V8 isolates instead of containers. - Isolates start in milliseconds, use only a few megabytes of memory, and provide secure sandboxing. - They can be up to 100 times faster to start and up to 100 times more memory-efficient than containers. - Dynamic Workers can create execution environments on demand, run code, and discard them at a scale of millions per second. - This efficiency could make one-agent-per-user economics viable beyond expensive coding assistants. ## The “Horseless Carriage” Phase - Early agent infrastructure often adapts existing systems instead of using designs built specifically for agents. - Agents use headless browsers to navigate human-oriented websites, though structured protocols such as MCP could provide direct service access. - Many MCP servers simply wrap REST APIs, despite LLMs often being better at writing and executing code than making long sequences of tool calls. - CAPTCHAs and behavioral fingerprinting ask whether a requester is human, while agent systems need identity, authorization, and permission controls. - Full containers are frequently used for tasks that require only a few API calls and a response. ## Supporting Both Old and New Models - Infrastructure transitions rarely happen all at once; technologies such as IPv4/IPv6, HTTP/2/HTTP/3, and TLS 1.2/1.3 coexist. - Cloudflare plans to support existing agent workloads while developing more efficient primitives. - Containers remain important for coding agents that need filesystems, Git, Bash, and arbitrary binaries. - Cloudflare is also expanding container-based sandbox environments and browser-rendering capabilities for services that do not yet support agent-native protocols. Cloudflare’s broader recommendation is to build infrastructure that can serve today’s container-based agents while moving toward lightweight, ephemeral isolates designed for billions of specialized agent sessions.

llmdatabase-designk8scloudflare-workers+4

cloudflareMar 30, 2026

Cloudflare Client-Side Security: smarter detection, now open to everyone (opens in new tab)

Cloudflare is making its Client-Side Security Advanced product self-serve and offering domain-based threat intelligence free to users of its basic bundle. The service detects malicious browser-side JavaScript through browser reporting, AST-based behavioral analysis, and a new LLM review layer. Its goal is to catch sophisticated skimming attacks while reducing false positives and avoiding performance impacts on customer applications. ## Growing Threat of Client-Side Attacks - Browser skimmers can steal credentials, payment data, and personal information without disrupting page loads or checkout flows. - Recent examples include: - A browser keylogger placed on a major U.S. bank’s employee merchandise store. - Malicious npm package releases capable of enabling browser-based crypto theft when bundled into front-end applications. - These attacks often exploit trusted first-party or third-party scripts rather than obvious server vulnerabilities. ## Broader Access to Client-Side Security - Client-Side Security Advanced, formerly the Page Shield add-on, is now available to self-serve customers. - Domain-based threat intelligence is complimentary for customers using the free Client-Side Security bundle. - Advanced capabilities include: - Machine-learning and LLM-assisted malicious script detection. - Continuous code-change monitoring for compliance requirements such as PCI DSS v4.0 requirement 11.6.1. - Proactive positive security rules maintained through ongoing monitoring. ## Browser-Based Monitoring Without Application Changes - Cloudflare evaluates approximately 3.5 billion scripts per day, with enterprise zones averaging about 2,200 scripts. - The system gathers signals through browser reporting mechanisms such as Content Security Policy. - Customers do not need scanners or application instrumentation. - Traffic must be proxied through Cloudflare. - The approach adds no latency to web applications. ## Detecting Script Intent - Enterprise sites may contain thousands of scripts, and roughly one-third change within a 30-day period. - Manually approving every DOM interaction or outbound connection would create excessive operational overhead. - Cloudflare instead analyzes what scripts are attempting to do. - JavaScript is represented as an Abstract Syntax Tree (AST), allowing the system to identify behavioral patterns even when code is minified, renamed, or obfuscated. ## Reducing False Positives - Client-side compromises are relatively rare but potentially severe, unlike the high-volume attacks typically handled by a WAF. - Because genuine incidents are uncommon, even accurate detection systems can produce more false alarms than real alerts. - False positives contribute to security-team fatigue and can obscure actual compromises. - Legitimate but heavily obfuscated code—such as bot challenges, tracking pixels, advertising bundles, and minified frameworks—can resemble malicious code structurally. ## GNN and LLM Detection Pipeline - Cloudflare’s primary detector is a Graph Neural Network (GNN) operating on JavaScript ASTs. - The GNN learns structural representations of code and can recognize similar behavior despite syntactic changes. - It is optimized for high recall to detect novel and zero-day threats. - Although fewer than 0.3% of analyzed traffic is incorrectly flagged, Cloudflare’s scale makes that percentage a significant number of alerts. - An LLM provides semantic context, recognizing common JavaScript frameworks, domain-specific coding patterns, and benign forms of suspicious-looking obfuscation. - The LLM complements rather than replaces the GNN: - Scripts classified as benign stop after the fast GNN evaluation. - Scripts exceeding the GNN’s risk threshold are sent to an open-source LLM hosted on Cloudflare Workers AI for a second opinion. Cloudflare’s approach combines low-overhead browser telemetry, structural machine learning, and semantic LLM review. For organizations handling payments or sensitive user data, enabling these controls can improve visibility into third-party scripts, detect unexpected code changes, and reduce the chance that false alarms overwhelm security teams.

llmmachine-learningjavascriptabstract-syntax-tree+4

cloudflareMar 24, 2026

Sandboxing AI agents, 100x faster (opens in new tab)

Cloudflare argues that AI-generated code needs secure execution, but traditional containers are too slow, memory-intensive, and difficult to scale for consumer-scale agents. Its Dynamic Worker Loader uses lightweight V8 isolates to create disposable, isolated sandboxes in milliseconds, with controlled access to APIs and no internet connectivity. The result is a sandbox roughly 100 times faster and substantially more memory-efficient than containers, provided agents can write JavaScript. ## Why Containers Fall Short - AI-generated code cannot safely run directly through `eval()`, since prompts could cause the model to introduce vulnerabilities. - Containers provide isolation but typically: - Take hundreds of milliseconds to start - Consume hundreds of megabytes of memory - Require warm instances to reduce latency - May encourage unsafe container reuse - These limitations make containers poorly suited to running a fresh sandbox for every request or user agent. ## Dynamic Worker Loader - Cloudflare’s Dynamic Worker Loader lets a Worker instantiate another Worker dynamically from runtime-provided code. - The host can: - Supply generated JavaScript modules - Expose selected APIs through RPC stubs - Disable or intercept outbound internet access - Invoke methods exported by the dynamically loaded Worker - The feature is in open beta for paid Workers users. ## Faster, Smaller Isolates - Dynamic Workers use V8 isolates, the same sandboxing technology underlying Cloudflare Workers. - Isolates: - Start in a few milliseconds - Use only a few megabytes of memory - Are approximately 100 times faster and 10–100 times more memory-efficient than typical containers - A new isolate can be created for one request and discarded afterward without maintaining a pool of warm sandboxes. ## Scalability and Latency - Dynamic Worker Loader has no container-style global concurrency or sandbox-creation limits. - It relies on the infrastructure that already scales Cloudflare Workers to millions of requests per second. - Each request could theoretically load its own isolated sandbox, even at very high concurrency. - Dynamic Workers commonly run on the same machine or thread as their parent Worker, avoiding network round trips and warm-sandbox lookup delays. - They are available across Cloudflare’s global network. ## JavaScript as the Agent Runtime - The main limitation is that agent-generated code should generally be JavaScript. - Workers also support Python and WebAssembly, but JavaScript is faster to load for short-lived snippets. - Cloudflare argues this is acceptable because: - LLMs can generate major programming languages - JavaScript has extensive training data - JavaScript was designed for web-based sandboxed execution ## TypeScript APIs for Agent Tools - Agents still need access to external capabilities such as chat systems and APIs. - TypeScript interfaces provide a concise way to describe these programming APIs. - Compared with MCP’s flat tool schemas or verbose OpenAPI specifications, TypeScript can express: - Methods and parameters - Return types and promises - Objects such as messages - Subscription and disposal behavior - This gives agents precise API knowledge with fewer tokens and lets them write direct code rather than issuing numerous tool calls. Dynamic Worker Loader is presented as a practical foundation for secure, disposable AI-agent execution: use V8 isolates for low-latency sandboxing, expose only narrowly defined TypeScript/RPC capabilities, and block network access unless explicitly required.

llmtypescriptjavascriptcloudflare-workers+4

cloudflareMar 19, 2026

Powering the agents: Workers AI now runs large models, starting with Kimi K2.5 (opens in new tab)

Cloudflare is expanding Workers AI beyond smaller models by adding Moonshot AI’s Kimi K2.5, a frontier open-source model designed for agentic workloads. With a 256k context window, tool calling, vision, and structured outputs, Kimi can power an agent’s full lifecycle directly on Cloudflare’s platform. Cloudflare argues that its price-performance makes open-source models essential as personal and enterprise agents dramatically increase inference demand. ## Kimi K2.5’s Price-Performance Advantage - Cloudflare uses Kimi internally for: - Agentic coding through OpenCode - Automated code review via the Bonk public code review agent - Security analysis of Cloudflare codebases - A security-review agent processes more than 7 billion tokens daily and has found over 15 confirmed issues in one codebase. - Compared with a mid-tier proprietary model, switching to Kimi reduced the estimated cost of this workload by 77%, from roughly $2.4 million annually. - As employees increasingly run multiple agents continuously, inference costs become a major barrier to scaling. - Cloudflare positions open-source, frontier-quality models as a more economical alternative to proprietary systems. ## Serving Large Models on Workers AI - Supporting Kimi required upgrades to Workers AI’s inference stack, which historically focused on smaller models. - Cloudflare uses its proprietary Infire inference engine and custom kernels to improve: - Model performance - GPU utilization - Throughput - The platform applies advanced serving strategies such as: - Data, tensor, and expert parallelization - Disaggregated prefill, separating input processing from generation across machines - Workers AI handles these infrastructure optimizations so developers do not need specialized machine learning, DevOps, or reliability engineering expertise. ## Prefix Caching for Agent Workloads - Agents frequently resend large prompts containing: - System instructions - Tool definitions - MCP server tools - Conversation history - Entire codebases - Prefix caching avoids reprocessing unchanged input tokens during multi-turn interactions. - This reduces prefill work, improving: - Time to First Token (TTFT) - Tokens Per Second (TPS) - Overall inference cost - Workers AI now exposes cached tokens as a usage metric and charges less for them than regular input tokens. - Cloudflare has also introduced techniques to improve cache hit rates. ## Session Affinity - Workers AI provides an `x-session-affinity` header to route requests from the same session or agent to the same model instance. - Keeping requests on the same instance increases prefix-cache reuse. - Higher cache hit rates lead to faster responses, greater throughput, and lower costs. - Clients should provide a unique session or agent identifier with the header. Cloudflare’s recommendation is to use Workers AI when building agents that need frontier-level reasoning without the cost and operational burden of proprietary models or self-hosted infrastructure.

llmdatabase-designk8scloudflare+4

cloudflareMar 11, 2026

AI Security for Apps is now generally available (opens in new tab)

Cloudflare’s AI Security for Apps is now generally available to help organizations discover, detect, and mitigate threats targeting AI-powered applications. The service protects AI endpoints through Cloudflare’s reverse proxy and integrates AI-specific signals with existing WAF controls. New GA features include free endpoint discovery for all customers, custom topic detection, and custom prompt extraction capabilities. ## Why AI Applications Create a New Attack Surface - Traditional applications follow predictable workflows, while AI applications accept natural-language input and produce probabilistic outputs. - Attackers can exploit models through: - Prompt injection - Sensitive information disclosure - PII exposure - Toxic or off-policy content - Unbounded resource consumption - Risks become more serious when AI agents can call tools to issue refunds, change accounts, apply discounts, or access customer data. - Organizations may struggle to maintain consistent safeguards as teams rapidly adopt new models and providers. ## AI Endpoint Discovery - AI Security for Apps automatically identifies LLM-powered endpoints across web properties, regardless of hosting location or model provider. - Discovery analyzes endpoint behavior rather than relying only on paths such as `/chat/completions`, since AI may also power search, valuation, and recommendation features. - Discovered endpoints appear under **Security → Web Assets** with the `cf-llm` label. - Discovery is now free for Cloudflare Free, Pro, and Business customers: - Free-plan discovery begins when users open the Discovery page. - Paid plans receive recurring background discovery. - Sufficient valid traffic is required to confidently identify AI-powered endpoints. ## Always-On AI Threat Detection - Prompts sent to discovered AI endpoints are evaluated by multiple detection modules. - Built-in protections cover: - Prompt injection - PII exposure and extraction - Sensitive or toxic topics - Detection results are attached as metadata and can be used in custom WAF rules. - Cloudflare intends to use its global network data to identify emerging attack patterns across millions of sites. ## Custom Topics and Prompt Extraction - Custom topics allow organizations to define their own sensitive categories, such as securities, patient data, or competitor products. - Each prompt and response receives a relevance score that can be logged, blocked, or handled through custom policies. - Custom prompt extraction identifies where prompts are located in request bodies, supporting formats such as: - `$.messages[*].content` - `$.requests[*].params.messages[*].content` - `$.property_description` - Standard formats from providers including OpenAI, Anthropic, Google Gemini, Mistral, Cohere, xAI, and DeepSeek are supported. - Unknown payload formats use a default-secure approach that scans the full request body, which may create false positives. - Cloudflare plans to support user-defined JSONPath expressions and automated prompt learning to improve accuracy. ## WAF-Based Mitigation - Organizations can block, log, or customize responses to detected threats using the existing Cloudflare WAF rule builder. - AI-specific signals can be combined with broader request data, including IP reputation, browser fingerprints, bot activity, and attack history. - This lets security teams distinguish isolated suspicious prompts from attacks associated with broader malicious behavior. ## Expanding Partnerships - IBM has selected Cloudflare to provide AI security for its cloud customers. - Cloudflare and Wiz are partnering to provide mutual customers with a unified view of AI security posture. - The service is being extended through Cloudflare’s broader security ecosystem. Organizations adopting AI agents should first inventory their AI endpoints, then apply detection and WAF policies tailored to their data, users, and business risks. Cloudflare’s unified approach is designed to provide a practical fail-safe as AI deployments expand.

llmdatabase-designcloudflareai-security+4

cloudflareMar 3, 2026

How Cloudy translates complex security into human action (opens in new tab)

Cloudy is Cloudflare’s LLM-powered explanation layer for Cloudflare One, translating complex security detections into clear, actionable guidance. It helps security teams understand why emails or SaaS findings were flagged and helps end users make better decisions in real time. Its integration with Phishnet aims to reduce unnecessary SOC submissions while preserving strong protection against genuine threats. ## Turning Complex Detections into Human Guidance - Email and CASB systems analyze numerous signals, including sender reputation, authentication, links, infrastructure, behavior, misconfigurations, and exposed data. - Traditional detections may correctly identify risk without clearly explaining the reasoning. - Cloudy converts machine-learning outputs into concise explanations for both administrators and nontechnical users. - For Email Security, it explains why messages are classified as Malicious, Suspicious, Spam, Bulk, or Spoof. - For CASB, it is intended to clarify the risk and remediation path for SaaS findings. ## The Challenge for Email Users and SOC Teams - Users increasingly serve as an additional defense layer against social engineering and impersonation attacks. - Periodic security training and phishing simulations do not provide enough context when users encounter real messages. - This creates two problems: - Some users report nearly every questionable email, overwhelming SOC queues. - Others interact with risky messages because no clear warning appears at the moment of decision. - Excessive reporting creates backlogs and slows investigations of genuinely dangerous emails. ## Cloudy in Phishnet - Cloudy will be integrated into the Phishnet reporting workflow for Microsoft. - When users report a message, they will receive a simplified, plain-language explanation of the relevant security signals. - The goal is to help users decide whether a message is truly suspicious and reduce unnecessary escalations. - This allows SOC teams to focus on messages requiring investigation while making users more effective participants in security operations. ## How the Explanation Pipeline Works - A Phishnet report triggers a Cloudflare Workers-based workflow. - The workflow aggregates outputs from multiple detection models, including: - Sender reputation - Domain and infrastructure characteristics - SPF, DKIM, and DMARC authentication results - Link and content analysis - Behavioral indicators - Workers AI processes these structured signals using purpose-built prompts. - The prompts generate a natural-language explanation rather than changing the original message classification. - The experience is optimized for end users, avoiding overly technical terms such as ASNs, IP reputation, and raw authentication failures. ## Translating Technical Signals - An SPF failure becomes: “This email failed a sender verification check.” - A DKIM failure is explained as a failed message-integrity check that may indicate tampering. - A DMARC failure indicates that the sender’s domain could not confirm the email’s legitimacy. - These translations preserve the meaning of the underlying detections while making them understandable to nontechnical recipients. Cloudy’s practical value is its ability to connect sophisticated security analysis with immediate human decision-making. Embedding understandable explanations directly into Phishnet should improve user judgment, reduce SOC noise, and make complex detections more actionable without altering the underlying security verdict.

llmmachine-learningcloudflarecloudflare-workers+4

cloudflareMar 3, 2026

From reactive to proactive: closing the phishing gap with LLMs (opens in new tab)

Cloudflare argues that email security must move beyond reacting to user-reported phishing misses. LLMs can analyze millions of emails, reveal emerging threat patterns that traditional systems overlook, and guide specialized detection models before attacks become widespread. Its Sales Outreach phishing program reportedly reduced average daily reported misses by 20.4% from Q3 to Q4 2025, with a further two-thirds decline in Q1 2026. ## The Blind Spot in Reactive Defense - Traditional systems improve mainly after users report messages that were incorrectly classified as clean. - This feedback is valuable but inherently delayed: it reveals attacks that already succeeded. - The authors compare this problem to Abraham Wald’s World War II aircraft analysis: - Engineers studied bullet holes on returning planes. - Wald identified the missing data—the damage on planes that never returned. - Email security faces the same challenge because undetected threats are largely invisible. ## Mapping Threats with LLMs - LLMs can interpret context, intent, urgency, deception, and other nuanced characteristics in natural-language emails. - Cloudflare processes millions of unwanted messages daily, making manual classification and detailed threat mapping impractical. - LLM-generated categories expose emerging patterns and persistent trends, including: - `PrizeNotification` - `SalesOutreach` - These tags give analysts near-real-time, high-fidelity signals and reduce the need for manual investigation. - The resulting intelligence helps Cloudflare create or retrain targeted machine-learning models before threats become widely visible through customer reports. ## Detecting Sales Outreach Phishing - Sales Outreach phishing imitates legitimate B2B communication, using offers, special deals, or transactional requests to encourage malicious clicks or credential disclosure. - After identifying it as a major threat category, Cloudflare used LLM tags to build a continuously growing corpus of relevant messages. - Training data was grouped by linguistic and structural traits such as: - Persuasive framing - Manufactured urgency - Transactional language - Subtle social proof - Feature extraction focused on sentiment and intent rather than static indicators. - A specialized sentiment-analysis model was trained for Sales Outreach behavior instead of overloading a general phishing classifier. ## From Classification to Enforcement - The specialized model produces a risk score based on how closely an email matches known Sales Outreach patterns. - That score is combined with other signals, including: - Sender reputation - Link behavior - Historical context - Messages can then be allowed, quarantined, or blocked. - LLMs serve as the discovery layer, identifying new language variants, while the specialized model provides fast, scalable enforcement. - Newly detected examples continuously feed back into the pipeline as attackers change their tactics. ## Reported Results - Cloudflare says the proactive approach reduced customer-reported Sales Outreach misses. - Average daily submissions fell from 965 in Q3 2025 to 769 in Q4 2025. - This represented a 20.4% quarterly reduction. - The company reports that average daily submissions decreased by another two-thirds in Q1 2026. - Fewer misses mean less analyst work, fewer interruptions for users, and fewer opportunities for phishing messages to reach inboxes. Cloudflare’s approach recommends combining broad LLM-based threat discovery with narrowly focused detection models. This creates a proactive feedback loop that can identify and address emerging phishing techniques before relying on large volumes of user-reported failures.

llmmachine-learningnlpdeep-learning+3