TL;DR

Cloudflare is using OpenAI models, accessed through OpenAI’s Daybreak security programme, in an early-access service that hunts for vulnerabilities in customers’ code and drafts fixes, according to an OpenAI customer story published on 21 October. Cloudflare adds its own traffic and threat data to decide which findings matter. The company also says a team of four used Codex to rebuild a product in three days for $1,100 in tokens.

How the service works

The offering, Vulnerability Discovery and Remediation, sits within Cloudflare Managed Defense. With a customer’s permission, OpenAI’s models examine source code, flag likely weaknesses and check the evidence behind each one. Cloudflare then asks production questions the code alone cannot answer: is the vulnerable route actually in use, is it seeing suspicious traffic, and is it already shielded by existing controls?

The output is a set of proposed code patches and, where it fits, custom web application firewall rules to limit exposure while developers review the fix. Cloudflare says it runs automated checks and has its own staff review every proposal before a customer sees it, and customers decide which changes to make.

Mark Anderson, Cloudflare’s president of revenue, said security teams “have a ton of useful data. They just don’t have the people and time to deal with it.”

The Codex claims

Anderson also said that about a third of Cloudflare’s staff are software developers and that “100% of them” use Codex. He described a product rebuild the company had put off for lack of people, which he estimated would otherwise have needed “maybe 10x more developers”. Four developers took it on with Codex: “We built it in three days, rolled it out and tested it, and spent $1,100 on tokens.” The story does not name the product.

Context and outlook

This is a vendor case study published by OpenAI, so the productivity figures are Cloudflare’s own and have not been independently verified. It lands the same day as OpenAI’s account of the PHP vulnerabilities, in which it lists Cloudflare among the partners that helped prepare protections before disclosure; we cover the UK response in a separate article. We covered how OpenAI tiers access to Daybreak in August.

In our view, the useful idea for UK security teams is the ranking step: tying a code flaw to whether the affected route is live and under attack, rather than working through findings in order of severity alone. Firms without Cloudflare’s network data can still apply the same logic using their own logs before deciding what to patch first.