---
title: "Cloudflare"
description: "A global cloud platform that provides web security, performance optimization, and internet infrastructure services."
---

# Cloudflare
> A global cloud platform that provides web security, performance optimization, and internet infrastructure services.

## Articles

### [Identify AI model overuse with User Insights](https://yomu.fyi/post/identify-ai-model-overuse-with-user-insights.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Frank Meszaros
- Published: Sep 30, 2026
- Type: Announcement

Cloudflare AI Gateway’s User Insights now provides context beyond model names and request counts, using a dedicated Worker to classify conversations by task type such as coding, research, summarization, or formatting. The “model overkill” view identifies conversations where a high-capability reasoning model is used for simple tasks, showing which users or agents are driving that usage and the associated cost. Teams can analyze conversation turns to see how many back-and-forth exchanges a task requires, helping uncover inefficiencies in prompts or workflows. The Potential Savings view and Auto Router (closed beta) use task and model-fit signals to automatically route requests to appropriate models without a separate rule for each workload. These features are free for AI Gateway users and require stable user\_id and session\_id for analysis, with optional Access integration.


### [Cloudflare Containers, rebuilt to scale agent sandboxes](https://yomu.fyi/post/cloudflare-containers-rebuilt-to-scale-agent-sandboxes.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Thomas Lefebvre
- Published: Sep 30, 2026
- Type: Announcement

Cloudflare Containers have been rebuilt to meet the needs of agent sandboxes, which require on-demand creation, fast startup, and the ability to pause and resume. The new durable\_object scheduling policy lets application code choose each sandbox’s image and instance type at runtime, replacing the previous deploy-time configuration. A redesigned runtime reduces median container startup from over four seconds to 648 milliseconds, and filesystem snapshots are available in public beta for saving and restoring workspaces. Each container retains its Durable Object as a persistent, programmable controller that manages its lifecycle and outbound traffic. These changes make Containers a more flexible complement to Workers and Durable Objects for agents needing a full Linux workspace.


### [The Internet has a second audience](https://yomu.fyi/post/the-internet-has-a-second-audience.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Matthew Conroy
- Published: Sep 30, 2026
- Type: Announcement

More than half of Internet traffic is now automated, and AI agents are the fastest-growing part of it, with daily requests on Cloudflare’s network growing by more than 1,700% over the past year. This second audience consumes bandwidth without generating ad impressions or subscriptions, causing revenue per request to fall while costs rise. Cloudflare is giving site owners tools to see who is visiting, set terms per bot type, and charge for access. These include AI Crawl Control, Web Bot Auth for cryptographically verified agents, Disallow AI Training to block training without losing search indexing, and Pay Per Use to pay publishers when content is actually used. The goal is to build open standards so any site can set its terms and get paid, rather than a few companies controlling discovery and payment.


### [Using AI to chart a course for our post-quantum migration](https://yomu.fyi/post/using-ai-to-chart-a-course-for-our-post-quantum-migration.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Tiago Silva
- Published: Sep 29, 2026
- Type: Explainer

Cloudflare is racing toward a 2029 deadline for full post-quantum readiness, having already upgraded many products to post-quantum encryption but still needing to address authentication and remaining classical cryptography. To manage this massive migration, they built CryptoLabe, an internal AI-powered tool that scans their centralized codebase to discover and classify cryptography usage. The tool operates in two stages: discovery finds raw observations of cryptography across source, configuration, manifests, lockfiles, scripts, tests, and documentation, then analysis re-checks each observation, investigates runtime use and dependencies, and assigns classifications such as classical encryption, signature, or token. CryptoLabe also surfaces prerequisites where PQ migration is blocked by missing standards or library support, enabling Cloudflare to work with standards bodies and ecosystem stakeholders to drive migration plans. The post shares learnings for other organizations, recommending starting with a single repository, validating results, and prioritizing high-impact systems.


### [Building a certificate authority for the whole Internet](https://yomu.fyi/post/building-a-certificate-authority-for-the-whole-internet.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Steve Goldsmith
- Published: Sep 29, 2026
- Type: Announcement

Cloudflare, which terminates TLS for millions of domains and sits in front of over 20% of global Internet request traffic, announced its intent to become a public certificate authority (CA) during Birthday Week 2026. The company has applied for inclusion in the Chrome, Apple, Microsoft, and Mozilla root programs and signed a definitive agreement to acquire an established root from GlobalSign. This acquisition ensures certificate compatibility with older clients that a fresh root would never reach, addressing the long tail of devices where avoidable breakage occurs. Cloudflare plans to be among the first CAs to issue production Merkle Tree Certificates (MTCs) in early 2027, targeting post-quantum readiness as part of Chrome’s Quantum-resistant Root Program. The CA will be ACME-first, require ACME Renewal Information (ARI) support for issuance, and operate transparently with reproducible builds of signing software and a public dashboard.


### [Adaptive application security for the AI era: how Cloudflare connects code, traffic, and intelligence to stop attacks](https://yomu.fyi/post/adaptive-application-security-for-the-ai-era-how-cloudflare-connects-c.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Christian Reilly
- Published: Sep 29, 2026
- Type: Announcement

An incident in July 2026 showed AI agents autonomously compromising OpenAI and Hugging Face infrastructure, chaining vulnerabilities and credentials over months before executing a final compromise in under 13 hours. Cloudflare argues that application security must become a continuous, connected system rather than isolated controls, because individual alerts miss the complete campaign. It introduces a four-stage framework: discover and prioritize risks, govern access and agent behavior, protect applications at runtime, and investigate, respond, and learn. New capabilities include LLM-based WAF penetration testing, expanded threat intelligence for all customers, automated positive security deployment, and an Autonomous Security Operation framework with three agent stages. Cloudflare’s network visibility across over 20% of the web enables correlating isolated signals into coordinated attack timelines, turning every investigation into stronger protection.


### [Building a post-quantum certificate authority with Merkle Tree Certificates](https://yomu.fyi/post/building-a-post-quantum-certificate-authority-with-merkle-tree-certifi.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Mari Galicer
- Published: Sep 29, 2026
- Type: Announcement

The Web PKI faces a scaling problem because post-quantum (PQ) signatures are roughly 40 times larger than classical ones, making direct adoption at Internet scale expensive. Merkle Tree Certificates (MTCs) address this by batching certificates into an append-only Merkle tree, allowing a CA to sign the tree root and clients to verify with a compact inclusion proof. Cloudflare is building a certificate authority that will support MTC issuance, targeting early 2027 for inclusion in Chrome’s new Quantum-resistant Root Store, and will offer standard MTC issuance at no cost. The MTC architecture couples issuance with logging (“issue by logging”), making transparency a first-party property rather than an add-on, which reduces redundancy and scaling overhead. Cloudflare successfully completed an experimental deployment with Chrome and is now moving to full production, but notes that broader ecosystem participation from browsers, CAs, and monitors is needed for the transition.


### [We tested our own WAF with frontier AI models. Here’s what we found](https://yomu.fyi/post/we-tested-our-own-waf-with-frontier-ai-models-here-s-what-we-found.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Kuber Nandwani
- Published: Sep 29, 2026
- Type: Benchmark

Cloudflare built a WAF tester that uses frontier AI models to iteratively mutate attack payloads based on real-time response feedback. The tester, implemented in Python, orchestrates an LLM proposal and review loop against an authorized customer staging environment protected by Cloudflare’s WAF. It ran 45 scenarios across six attack categories—XSS, SQLi, CMDi, SSRF, path traversal/LFI, and Log4j—starting from known blocked exploits and varying encoding, request placement, or destination representation. The vast majority of 1,107 recorded attempts were blocked; the few non-blocked requests were triaged by humans and used to create new detections that harden security for all Cloudflare customers. The post stresses that a WAF bypass still needs an exploitable application to succeed, so patching software remains essential, and suggests combining Managed Rules, Attack Signature Detection, and positive security controls for defense in depth.


### [Introducing Threat Signals: agentic skills for open-source threat intelligence, free for every Cloudflare account](https://yomu.fyi/post/introducing-threat-signals-agentic-skills-for-open-source-threat-intel.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Jacob Crisp
- Published: Sep 29, 2026
- Type: Announcement

Cloudflare introduced Threat Signals, a free agentic skill layer for open-source threat intelligence available to every account. The product targets the unstructured-reporting problem: converting research posts into indicators that security tools can consume while preserving the context that explains their relevance. A skill encodes detailed instructions that capture how an experienced analyst handles one part of the job, and it runs identically on every report. The agentic skills summarize reports, surface key context, extract and normalize indicators of compromise, and apply tags within a private, account-scoped dataset. This approach standardizes analyst expertise into repeatable, context-preserving processing for threat reports.


### [Is your domain using post-quantum encryption? Now you can see for yourself](https://yomu.fyi/post/is-your-domain-using-post-quantum-encryption-now-you-can-see-for-yours.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Sharon Goldberg
- Published: Sep 29, 2026
- Type: Announcement

Cloudflare introduced new post-quantum cryptography visibility tools in its Application Security and Logs products, including Logpush, Log Explorer, and the HTTP Traffic Analytics dashboard, to help customers monitor encryption adoption. These tools surface the key exchange algorithm negotiated on every incoming request, enabling customers to audit their post-quantum posture, assess compliance, and identify cryptographic gaps across their domains. The primary post-quantum algorithm in TLS 1.3 is X25519MLKEM768, a hybrid of classical ECDHE over curve X25519 and the post-quantum ML-KEM, which provides belt-and-suspenders security against harvest-now-decrypt-later attacks. Cloudflare Radar data shows about 70% of browser-generated traffic uses post-quantum encryption on the visitor-to-Cloudflare connection, but only 15% of origin connections to Cloudflare use hybrid ML-KEM. For legacy origin servers that cannot support modern post-quantum cryptography, Cloudflare Tunnel can tunnel traffic over TLS 1.3 with X25519MLKEM768 without requiring any upgrade to the origin server itself.


### [Enforce positive security with Cloudflare Application Profiles](https://yomu.fyi/post/enforce-positive-security-with-cloudflare-application-profiles.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Zhiyuan Zheng
- Published: Sep 29, 2026
- Type: Announcement

Cloudflare launches Application Profiles, a positive security feature that learns the expected structure of HTTP requests and identifies deviations. By analyzing path variables, query parameters, headers, cookies, and JSON body fields, the system builds a profile of valid data types, numeric ranges, string lengths, UUIDs, and enums. This approach reduces attack surface by blocking non-conforming requests without relying solely on known attack signatures, addressing the growing threat of AI-generated payloads. The feature extends Schema Learning and Schema Validation, previously available for APIs, to web applications. Profiles are automatically updated weekly as traffic changes. Customers can review violations in Security Analytics and create rules to enforce blocking, starting with observation mode; a closed beta is open to invited Enterprise customers without API Security.


### [Preventing quantum downgrade attacks against IPsec](https://yomu.fyi/post/preventing-quantum-downgrade-attacks-against-ipsec.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Lina Baquero
- Published: Sep 29, 2026
- Type: Announcement

Cloudflare has identified a design flaw in IPsec that allows a quantum attacker to downgrade post-quantum-protected connections to classical cryptography. The attack exploits the fact that IKEv2 endpoints sign only their outbound messages rather than the full handshake transcript. This vulnerability requires a quantum computation in real time during the handshake, and resource estimates for such attacks have decreased, prompting Cloudflare to move its transition deadline to 2029. To mitigate this, Cloudflare worked with the IETF to develop a full transcript authentication extension for IKEv2 that prevents downgrade attacks. The extension is now available in beta for Cloudflare WAN and Magic Transit customers on an opt-in basis.


### [Next.js applications, powered by Vite: introducing Vinext 1.0](https://yomu.fyi/post/next-js-applications-powered-by-vite-introducing-vinext-1-0.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Matt “TK” Taylor
- Published: Sep 28, 2026
- Type: Announcement

Vinext 1.0 graduates from an AI experiment to a production-ready framework that lets Next.js applications run on Vite, supporting both Pages and App Router. It achieves over 99% test compatibility for customer-requested features, excluding cache components, and includes support for pre-rendering, cache warming, and observability with OpenTelemetry and Sentry. Cache warming moves page prerendering from the build machine to Cloudflare’s network by deploying a new Worker version to zero traffic and requesting pages to populate the cache before promotion. The framework supports React Server Components, Server Actions, API routes, middleware, and shared caching functions across both routers, with first-class runtime support for Cloudflare Workers and bindings like image optimization and hyperdrive. Migration requires only two commands, and the project is open source with a nightly Next.js end-to-end test suite and community-driven issue tracking, also supporting output: ‘export’ for fully static sites and background revalidation.


### [Introducing cf: the agentic CLI for the entire Cloudflare API](https://yomu.fyi/post/introducing-cf-the-agentic-cli-for-the-entire-cloudflare-api.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Samuel Macleod
- Published: Sep 28, 2026
- Type: Announcement

Cloudflare introduced cf, a new CLI that provides access to the entire Cloudflare API surface of over 3,000 operations, far exceeding Wrangler’s roughly 280 commands. Cf is designed primarily for AI coding agents, which account for nearly half of Wrangler usage, and defaults to JSON output with condensed formatting to minimize token consumption. The CLI includes a natural language search command, cf cli search, that helps agents discover the right operation without bloating context, and uses TypeScript-based configuration via cloudflare.config.ts for type safety. Cf is generated by Forge, Cloudflare’s internal pipeline that produces CLI commands from OpenAPI schema annotations, enabling consistent and comprehensive API coverage. The open beta is available globally via npm, and cf adopts Vite as its default local development server, with a migration path from Wrangler and maintenance support for 18 months after beta ends.


### [How fast is the web? Explore billions of real-user measurements with BEACON](https://yomu.fyi/post/how-fast-is-the-web-explore-billions-of-real-user-measurements-with-be.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Nic Jansma
- Published: Sep 28, 2026
- Type: Announcement

Cloudflare has released the BEACON dataset, an anonymized collection of billions of real-user performance measurements from 10,000 of the largest websites. The dataset reports Core Web Vitals (LCP, CLS, INP) with full histograms, enabling analysis of any percentile including the long tail. It reveals that WebKit browsers underperform Blink in 46 countries, and that resource-discovery and render-blocking contribute more to slow LCP than download time. Soft navigations in single-page applications load two to three times faster than hard navigations, but landing pages remain heavy. The dataset is publicly available on Google BigQuery and includes differential privacy via the RAPPOR algorithm to protect individual user data.


### [Introducing Forge: the open source pipeline for generating SDKs, CLIs, docs, and more](https://yomu.fyi/post/introducing-forge-the-open-source-pipeline-for-generating-sdks-clis-do.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Samuel Macleod
- Published: Sep 28, 2026
- Type: Announcement

Cloudflare introduced Forge, an open source, pluggable generation pipeline for producing SDKs, CLIs, documentation, and other API surfaces from API definitions. Forge runs in CI on each team’s API repositories, linting every change and generating preview builds of the CLI, docs, and SDKs with only the changes highlighted, similar to Workers Previews. It supports OpenAPI as input and can chain transformers to produce outputs like Cap’n Web bindings, TanStack Query, or MCP servers, enabling generation of bindings from Workers to other APIs. Forge is designed to reduce coordination overhead across Cloudflare’s hundreds of services and repos, and to enable better API versioning without breaking existing clients or SDKs. It is available under the Apache 2.0 license and can be run for free, privately or publicly, and already generates the output required for the cf CLI.


### [The road to the agentic browser: A Kitesurf update](https://yomu.fyi/post/the-road-to-the-agentic-browser-a-kitesurf-update.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Celso Martinho
- Published: Sep 28, 2026
- Type: Announcement

Kitesurf, Cloudflare’s browser for AI agents built entirely on Workers, has received a major update. It now supports WebMCP, enabling agents to call site functions like searchFlights() instead of simulating clicks, and site owners can enable WebMCP with one switch. The browser passes over 730,000 Web Platform Tests, up 500,000 since launch, and adds support for CSS Layout, CSSOM, custom elements, URL-based module resolution, and improved iframe behavior. Efficiency optimizations reduce DOM traversal overhead, font fetching, and timer work, keeping CPU usage in line with launch benchmarks despite expanded capabilities. Kitesurf also gains full Browser Run API coverage, including Quick Actions from Worker bindings, and a terminal rendering mode using the Kitty protocol or ANSI text, with open-sourcing planned soon.


### [Introducing The Cold Start: pitch your startup live at Cloudflare Connect](https://yomu.fyi/post/introducing-the-cold-start-pitch-your-startup-live-at-cloudflare-conne.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Sunil Pai
- Published: Sep 28, 2026
- Type: Announcement

Cloudflare announces The Cold Start, a live startup competition at Cloudflare Connect in San Francisco on Monday, October 19, 2026. Five early-stage companies with less than $10 million raised will each get five minutes on stage to pitch their vision to judges including Cloudflare co-founders Matthew Prince and Michelle Zatlyn, and CTO Dane Knecht. The winning startup receives $500,000 in Cloudflare credits, a billboard in San Francisco, and an invitation to the VIP speakers dinner. Applications close Friday, October 2, 2026, and Cloudflare will pay travel for the five finalists. The competition is inspired by Cloudflare’s own launch at TechCrunch Disrupt in 2010 and is part of its Cloudflare for Startups program, which offers eligible companies up to $350,000 in credits.


### [EmDash 1.0: the stable CMS with a secure plugin registry](https://yomu.fyi/post/emdash-1-0-the-stable-cms-with-a-secure-plugin-registry.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Noah Pham
- Published: Sep 28, 2026
- Type: Announcement

EmDash 1.0 is a stable, free, and open source content management system built on Astro, offering a production-tested admin for editors and agent-friendly workflows through an API, CLI, and built-in MCP server. Its decentralized plugin registry, built on AT Protocol, lets developers publish plugins without ceding ownership of their identity or releases to a central marketplace, while site owners can discover and install plugins directly. Cloudflare migrated its own blog to EmDash as part of its “Customer Zero” approach, handling millions of pageviews per week and spikes up to 5,000 RPS, which led to features like KV object caching and Hyperdrive database adapter. The project is MIT-licensed with over 175 contributors and translations into 25 languages, and it supports sandboxed plugins for security. EmDash separates the plugin from the catalog, allowing other services to index the same publications without requiring developers to start over.


### [Supporting native Rust in Workers with the new Emscripten target for wasm-bindgen](https://yomu.fyi/post/supporting-native-rust-in-workers-with-the-new-emscripten-target-for-w.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Mitch Foley
- Published: Sep 28, 2026
- Type: Announcement

Cloudflare announced an experimental Emscripten target for wasm-bindgen, enabling native Rust code compiled with wasm-bindgen to run directly on Workers with full platform feature virtualization. This resolves the long-standing incompatibility between Emscripten and wasm-bindgen by having Emscripten drive the build while wasm-bindgen produces portable bindings included in Emscripten’s library system. The integration virtualizes timers, file system operations, and sockets atop Workers’ Node.js APIs, bringing significantly improved library compatibility for many previously unsupported Rust crates after minor patches to libraries like libc and socket2. Tokio async runtime support is achieved through WebAssembly JavaScript Promise Integration, which suspends blocking calls and returns control to the event loop without stalling. In testing, a Rust Minecraft server (Pumpkin) was deployed inside a Durable Object with TCP ingress using real Tokio sockets, persisting world state through Durable Object storage and supporting multiplayer connections.


[Newer posts](https://yomu.fyi/company/cloudflare/page/2.md) · [Older posts](https://yomu.fyi/company/cloudflare/page/4.md)