Loading…
Cloudflare
A global cloud platform that provides web security, performance optimization, and internet infrastructure services.
- 96 posts summarised
- latest
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
From their blog
Latest articles
Protected Quick Tunnels: simple accountless authentication for your next dev project
Cloudflare’s Quick Tunnels now support email-based access control via the –allowed-mail flag, requiring no account on either side. The feature addresses the risk of exposing sensitive work, especially as AI coding agents increasingly use tunnels to share previews. Cloudflare Access verifies the visitor’s email with a one-time PIN, while cloudflared on the developer’s machine authorizes the request against a local rule list. The guest list never leaves the developer’s machine, and the tunnel remains accountless and free. The feature was built and shipped by two interns, Hugo Vicente and Alessandro Frigerio.
Building for good: How civil society organizations are automating on Cloudflare
Cloudflare awarded $7.5 million in credits to 30 civil society organizations to build automation tools using Workers AI and AI Gateway on its global network. LebTown replaced manual editorial workflows with a custom management system, and Kaya Guides built a WhatsApp mental health app processing 500,000 messages monthly with real-time counselor feedback. Larger groups like Freedom House and Article One received volunteer engineering support to build tools for tracking transnational repression and assessing human rights risks from factory audits. Cloudflare’s developer services include automatic DDoS protection and data minimization, addressing privacy and cost barriers that have limited AI adoption in the sector. The program is now open for a second cohort of non-profit organizations to apply for up to $250,000 in credits.
2026 Birthday week: network performance update
Cloudflare is now the fastest provider in 74% of the top 1,000 global networks, up from 60% in April 2026, representing an additional 150 networks and 38 countries. Performance is measured using connection time (TCP handshake) and the trimean of connection times, which combines the 25th, 50th, and 75th percentiles to reduce outlier influence. To expand data collection, Cloudflare introduced a new methodology using Challenge Pages, which run non-interactive background measurements fetching lightweight files from providers including Cloudflare, Amazon CloudFront, Google, Fastly, and Akamai. Challenge Pages are delivered by Turnstile and preserve privacy while providing broader reach than error-page measurements alone. This increased measurement volume narrows confidence intervals around trimean values, making rankings more stable in networks where top providers are separated by only a millisecond or two.
Introducing Clef: our open-source decision models, and new RL fine-tuning platform
Cloudflare released two open-source decision models, Clef and Clef-flash, hosted on Workers AI under an Apache 2.0 license and fully compatible with the Jev API. These models produce bounded structured outputs for agentic workflows, classifying inputs like customer support messages or website domains with typed probabilities and confidence scores. Clef includes a vision encoder and a 64k context window, distinguishing it from text-only decision models such as Jev, and currently leads the Jev Decision Index benchmark. The models demonstrated lower latency than alternatives, with Clef classifying a website in 2.2 seconds versus 4.7 seconds for Cloudflare’s fastest general LLM, while Clef-flash offers even faster inference at 38.8 ms median latency. Cloudflare also debuted a reinforcement learning fine-tuning platform that lets customers adapt Clef to their specific use cases using their own data.
One year later: Sovereign AI and the fight for choice
A year after arguing that AI sovereignty means choice, Cloudflare adds two European open models—EuroLLM and Apertus—to Workers AI, reflecting a year where access to frontier models became constrained and attacks using AI increased. EuroLLM supports 35 languages including all 24 EU official languages, many underserved by existing open models, and was trained on the MareNostrum 5 supercomputer. Apertus, Switzerland’s first fully open multilingual model, was trained on 15 trillion tokens across 1,500+ languages on the Alps supercomputer (10,000+ GH200 GPUs) and outperforms leading models on rare and regional languages. Cloudflare also launches hands-on workshops for government cyber agencies and critical infrastructure operators to build model-agnostic AI security defenses, starting in Singapore in October. The company open-sourced its own security harness that coordinates multiple AI models for vulnerability hunting, ensuring defenses remain operational even if access to one model is lost.
Cloudflare OS: your company’s agent workspace, managed for you
Cloudflare OS is an open-source agent workspace that connects to company data and systems. The fully managed version lets organizations launch an agent workspace in a few clicks from the Cloudflare dashboard, with control over access, skills, and connected systems. Recent updates add GitHub repository integration, allowing agents to explore codebases, fix bugs, and open pull requests. Google Workspace connectivity now supports reading Gmail, creating drafts, sending emails, and accessing Google Drive. Users can export work to formats like Excel, CSV, PDF, Markdown, or HTML, with Word and PowerPoint export coming soon. The managed service is available via waitlist, while the open-source version can be deployed into your own Cloudflare account.
Announcing Cloudflare K2: serverless event streams
Cloudflare launched K2, a serverless event streaming service in public beta, to decouple producers and consumers in distributed systems. K2 stores events as an ordered log, allowing independent consumers to read at their own pace without losing data. Under the hood, it builds a partitioned durable log on top of R2 object storage, using atomic operations for ordering. Produce latency at the 99th percentile is about 1 second due to batching writes to R2 segments. K2 is available now for Workers Paid accounts with a 10GB storage limit and 30 MB/s produce per stream, with no billing during beta.
We want you to build the next Git platform on Cloudflare
Cloudflare announced Artifacts, a programmable versioned filesystem speaking Git, is now in open beta for Workers Paid customers. Aimed at an era where AI agents write more code, Artifacts offers primitives for per-agent or per-task repositories, forking, versioned storage, and Git operations. New capabilities include deploying Artifacts repos to Workers via Workers Builds, managing repos from Workers with bindings, subscribing to push events for CI or review, setting US/EU data jurisdiction, and viewing metrics. Cloudflare is hosting a competition to build the next Git platform on Artifacts, requiring a 5-10 minute video and permissively licensed source code that reimagines agent coordination, review, and concurrent changes. Submissions close October 14, 2026; the first-place team wins $25,000 in Cloudflare credits and a trip to Cloudflare Connect, with three teams invited to San Francisco.
AI Search is now generally available
Cloudflare’s AI Search, a managed pipeline combining Workers AI, Vectorize, R2, and Browser Run, is now generally available after a year of preview. The update adds native image embeddings via the Qwen3-VL-Embedding model with Matryoshka Representation Learning, enabling visual search by texture and composition alongside caption-based text search. AI Search now supports files up to 10 MiB and optical character recognition for scanned PDFs; queries undergo optional rewriting, parallel vector and keyword search, fusion, and optional reranking. Previously reliant on caption generation only, image retrieval now embeds query images directly using multimodal models, while text-only models convert images to text via ToMarkdown. Billing starts November 1, 2026, with a free monthly allotment of 5 million ingestion tokens, 10 GB storage, 1,000 semantic queries, and 1,000 full-text queries, with no capacity units or monthly minimums.
Support for modern cryptographic algorithms in Workers
Cloudflare Workers now provides opt-in support for post-quantum cryptographic algorithms ML-KEM and ML-DSA within the Web Crypto API, including ML-KEM-768, ML-KEM-1024, ML-DSA-44, ML-DSA-65, and ML-DSA-87. These algorithms enable key encapsulation via encapsulateBits and decapsulateBits, and signatures via sign and verify, along with helper APIs like getPublicKey and SubtleCrypto.supports for feature detection. The implementation is gated behind the webcrypto_modern_algorithms compatibility flag and is based on a draft WICG specification, meaning it is opt-in while the specification is still moving. Developers can now use native primitives instead of bundling separate cryptographic code, reducing application size and maintenance burden for developers. Libraries such as panva/jose for JWTs and panva/hpke for HPKE can delegate ML-KEM and ML-DSA to the runtime, enabling experimentation with post-quantum protocols and preparing for the migration.
Introducing Cloudflare Basin: an open, serverless data platform, now generally available
Cloudflare announced the general availability of Basin, a serverless data analytics platform built on Apache Iceberg and R2 Object Storage. Basin consists of three integrated products: Pipelines for ingesting and transforming events via SQL, Catalog for managing Iceberg metadata and automatic table maintenance, and SQL for distributed querying. The platform emphasizes speed with instant resource creation and query execution, scalability through metadata compaction and statistics-driven query planning, and openness by supporting any Iceberg-compatible engine like DuckDB and Snowflake. Basin offers cost efficiency with zero egress fees and usage-based pricing, charging only when data is ingested, processed, or queried. Early adopters have used Basin for use cases including real-time e-commerce optimization, billing metrics storage, and infrastructure telemetry analysis.
Cloudflare Impact reaches $100 million in donations
Cloudflare’s Impact programs have reached $100 million in donated services, protecting journalists, governments, election bodies, and public schools. The programs began as free services for developers and small businesses but evolved after discovering that some free customers doing essential work faced large attacks. Project Galileo, launched in 2014, now includes over 3,500 domains in 120 countries and blocked over 38.5 billion cyberattacks in 2025; a 2026 report found participants faced vulnerability exploit attempts at seven times the average rate. Other programs include the Athenian Project for election websites in 33 U.S. states and eight countries, Cloudflare for Campaigns with over 530 websites, and support for critical infrastructure like public schools and Ukraine. Cloudflare is expanding beyond cybersecurity to help public interest groups adapt to AI, including a hackathon for journalists that produced winning tool AIdas for studying AI bias, and a non-profit startup program.
Cut your AI spend with AI Gateway's Auto Router
Cloudflare released Auto Router in public beta through AI Gateway. Set the model to “cloudflare/auto” and the gateway automatically routes each request to a model capable enough for the task, filtering by credentials, access controls, and provider health. A multi-head classifier on Workers AI assigns probabilities across 14 task categories and rates complexity, ambiguity, stakes, and context dependence on a 1-5 scale. A separate scoring matrix combines those signals with model benchmark results and token prices, applying an adaptive cost penalty and switching costs for cached contexts in long sessions. On an internal general knowledge-work benchmark of 97 tasks with three samples each, Auto Router achieved 86.6% success at $0.0084 per success, costing 35% of Claude Opus 5.5 and 80% of GPT-6 Sol while remaining free during beta.
Detect and send production issues straight to your agent
Cloudflare introduces Issues, a built-in error monitoring feature for the Workers platform now in open beta. It automatically groups repeated exceptions, HTTP 5xx responses, and error logs into a single issue, eliminating manual telemetry linking. Developers enable it by setting observability.issues.enabled to true in wrangler.jsonc, with no SDK required. Issues captures stack traces, console logs, distributed traces, and Worker version, and via automations sends failure context—including user-provided identifiers—directly to a configured coding agent like Claude Code, Cursor, or Devin. The agent receives a structured summary and can further query logs through the Cloudflare MCP to propose code changes and open a pull request. Internally, the Workflows team uncovered and fixed two production bugs within a day using Issues (a migration retry loop and an incomplete deletion process).
Simplifying domains for people and agents
Cloudflare Registrar introduced a redesigned domain search that shows every supported extension and responds progressively as the user types. The search gathers availability evidence from prepared datasets, DNS, and live registry checks, updating only changed results via WebSocket deltas. The system uses Workers, Durable Objects, and Workers KV on Cloudflare’s developer platform to coordinate more than 420 extension checks per query. The Registrar API beta now includes a sandbox for testing, transfer support, and an extensions endpoint with registry requirements. Agents can search, register, or transfer domains through the MCP or the newly launched cf CLI with natural-language prompts.
Monetization Gateway beta: charge AI agents for consumption with HTTP 402
Cloudflare announced the Monetization Gateway closed beta, enabling domain owners to charge AI agents per request for websites, APIs, MCP tools, or datasets. The gateway uses the HTTP 402 Payment Required status code to allow inline payment without redirects or separate payment APIs. Sellers define pricing rules matching request parts and choose from several schemes, with settlement on the Base blockchain using USDC via Coinbase’s x402 Facilitator. Customer use cases include Cloudflare AI Gateway for inference, Ceramic.ai for web search, Stocktwits for stock signals, and API2PDF for document conversion. The beta is available to eligible U.S.-based sellers and buyers, with plans to support additional geographies and payment rails over time.
Pay Per Use: when AI uses your work, you should get paid
AI answer engines can read a publisher’s page and deliver a summary without the reader ever visiting the site, costing the publisher the visit and its associated revenue. Most publishers cannot negotiate individual licensing deals, and no AI company can contract with millions of sites. Pay Per Use, now in beta, is Cloudflare’s system that lets a buyer define a specific use of content and a price, and lets each publisher choose whether to accept that offer. The buyer reports each downstream use through a single Cloudflare API endpoint, and Cloudflare then bills the buyer and pays the publisher monthly. Publishers can track estimated earnings and usage by buyer and domain in the Cloudflare dashboard, with planned future enhancements such as report context like keywords or product type.
Identify AI model overuse with User Insights
Cloudflare AI Gateway’s User Insights now provides context beyond model names and request counts, using a dedicated Worker to classify conversations by task type such as coding, research, summarization, or formatting. The “model overkill” view identifies conversations where a high-capability reasoning model is used for simple tasks, showing which users or agents are driving that usage and the associated cost. Teams can analyze conversation turns to see how many back-and-forth exchanges a task requires, helping uncover inefficiencies in prompts or workflows. The Potential Savings view and Auto Router (closed beta) use task and model-fit signals to automatically route requests to appropriate models without a separate rule for each workload. These features are free for AI Gateway users and require stable user_id and session_id for analysis, with optional Access integration.
Cloudflare Containers, rebuilt to scale agent sandboxes
Cloudflare Containers have been rebuilt to meet the needs of agent sandboxes, which require on-demand creation, fast startup, and the ability to pause and resume. The new durable_object scheduling policy lets application code choose each sandbox’s image and instance type at runtime, replacing the previous deploy-time configuration. A redesigned runtime reduces median container startup from over four seconds to 648 milliseconds, and filesystem snapshots are available in public beta for saving and restoring workspaces. Each container retains its Durable Object as a persistent, programmable controller that manages its lifecycle and outbound traffic. These changes make Containers a more flexible complement to Workers and Durable Objects for agents needing a full Linux workspace.
The Internet has a second audience
More than half of Internet traffic is now automated, and AI agents are the fastest-growing part of it, with daily requests on Cloudflare’s network growing by more than 1,700% over the past year. This second audience consumes bandwidth without generating ad impressions or subscriptions, causing revenue per request to fall while costs rise. Cloudflare is giving site owners tools to see who is visiting, set terms per bot type, and charge for access. These include AI Crawl Control, Web Bot Auth for cryptographically verified agents, Disallow AI Training to block training without losing search indexing, and Pay Per Use to pay publishers when content is actually used. The goal is to build open standards so any site can set its terms and get paid, rather than a few companies controlling discovery and payment.
Topics they write about
All topics →Weekly digest
The best engineering reads, once a week.