Cloudflare deploys multi-agent AI harness to triage security alerts at scale

What changed?

• 1First prototype with a single general-purpose agent hallucinated claims not supported by evidence — Cloudflare redesigned the approach
• 2Deterministic code now handles reconnaissance (identity, detection history, traffic baseline, network data) before any AI inference runs
• 3Clef, Cloudflare's open-source decision model on Workers AI, filters obvious false positives early so only uncertain alerts reach deeper analysis
• 4Four specialist agents (traffic, customer context, global telemetry, threat intelligence) analyze alerts in parallel, each restricted to its own evidence
• 5A synthesis agent combines specialist findings into one advisory using only an approved classification vocabulary — it cannot fetch new evidence
• 6Cloudflare uses approved OpenAI Daybreak and Anthropic models, including GPT-5.6 Cyber and Mythos, for deeper analysis
• 7Evidence package is versioned; every citation is validated by application code before an advisory is produced
• 8System distinguishes 'not checked', 'checked, no match', and 'checked, evidence of absence' instead of hiding failed lookups
• 9Early beta available in Managed Defense for eligible application-security alerts and cases; built on Workers, Workflows, D1, R2, and Durable Objects