Cloudflare turns OpenAI's GPT-5.6 Cyber on its own traffic data to write patches and block exploits mid-attack
Cloudflare has opened early access to Vulnerability Discovery and Remediation, a service inside Cloudflare Managed Defense that uses OpenAI Daybreak models, including GPT-5.6 Cyber, to investigate code, generate patches and deploy temporary blocking rules at the network edge while a fix is still being written. The service runs through the OpenAI Daybreak Defense Network and is available by invitation to selected enterprise customers.
The timing reflects a counting problem that has quietly become a staffing problem. By September 2026, the National Vulnerability Database had logged 60,475 vulnerabilities, roughly 25% more than the 48,185 recorded across the whole of 2025 with a quarter of the year still to run. Conventional scanners return thousands of findings with little sense of which ones an attacker is actually touching.
For most security teams, the gap between disclosure and remediation is not a technical failure so much as an arithmetic one. Analysts triage by hand, engineering queues fill, and the genuinely dangerous flaw sits in the same undifferentiated list as a dependency nobody has called in three years. The people doing that work absorb the cost in hours and attrition.
"Now, we're shifting the defence strategy away from chasing patches one vulnerability at a time to an automated approach," said Matthew Prince, co-founder and CEO of Cloudflare. The service correlates live internet traffic against code scan results to surface issues under active exploitation, and lets customers instruct Cloudflare to deploy custom WAF rules matched to a specific attack vector, buying time before developers touch the code.
Cloudflare's argument rests less on model quality than on what it can see. The company processes trillions of requests a day across millions of web assets, which gives its threat intelligence team a view of emerging patterns and zero-day activity earlier than isolated code scanning or static telemetry allows.
"We built Cloudflare's global network to analyse what's happening across the Internet in real time," Prince said. That position is difficult for rivals to replicate, and it points to where competition in security tooling is heading. Vendors with distribution at the traffic layer can feed models something most cannot: evidence of which theoretical weakness is being probed right now, on live systems, at scale.
The industry has spent two years debating whether models should write production code. Cloudflare's answer is a conditional yes with a human gate: developers review patches generated by the Daybreak models, and no code fix or edge rule takes effect without human approval. That constraint matters more than it sounds, given that an automated remediation system with commit rights is also an automated attack surface.
"Our goal through the OpenAI Daybreak Defense Network is to give defenders the advantage of frontier AI, safely," said McCall McIntyre, Head of Global Cyber Partnerships at OpenAI. "We are excited to team up with Cloudflare to put proactive, AI-driven security directly into the hands of enterprise defenders."
For the wider sector, the significance is structural. Security has been sold for a decade as detection, with remediation left to whoever owns the repository. Moving generation and mitigation into the same platform as the traffic layer collapses that division, and it will push competitors toward similar partnerships or toward explaining why their telemetry is good enough without one. The question enterprise buyers should be asking is not whether the patches are correct, but who is accountable when one of them is incorrect.
