Cloudflare Agentic Security Harness Uses Workers for Evidence-Grounded Analysis

Cloudflare has published details regarding its new agentic security operations harness, a system designed to augment its Managed Defense team. The architecture relies on a team of specialized artificial intelligence agents built upon Cloudflare Workers. These agents leverage global network telemetry to analyse security alerts, aiming to provide grounded recommendations to human analysts. The core innovation lies in the structural separation of deterministic evidence gathering from the probabilistic nature of model inference.

Root cause

The primary objective of this engineering effort was to address the reliability challenges inherent in using large language models for security operations. By isolating the collection of factual evidence from the reasoning process, the system ensures that recommendations are based on verified data rather than model hallucination.

The harness operates by first gathering deterministic evidence through the global network telemetry infrastructure. This evidence is then passed to the AI agents for inference, creating a chain of reasoning that is transparent and verifiable. This approach allows Managed Defense Analysts to trust the output, as the basis for each recommendation is explicitly grounded in observable network events.

Attack path

This report does not describe a vulnerability or an attack vector against Cloudflare infrastructure. Instead, it details an internal operational enhancement. The "path" described is the workflow of the security analysis process. Alerts generated by the network are ingested by the agentic system. The agents then execute specific tasks to collect relevant telemetry data associated with the alert.

Once the evidence is compiled, the inference models generate recommendations. These recommendations are reviewed by human analysts, who can trace the logic back to the specific evidence collected. This workflow aims to reduce the time to resolution and improve the accuracy of threat assessment by combining automated data collection with human oversight.

Affected versions

This update applies to Cloudflare’s Managed Defense service. It is an internal operational change and does not affect specific software versions deployed by customers. The underlying technology utilizes Cloudflare Workers, which is a serverless execution environment. No specific version numbers are cited in the source material as this is a service-level enhancement rather than a patch for a software defect.

Mitigation

• No mitigation is required as this is not a security vulnerability.
• Managed Defense customers will benefit from the enhanced analysis capabilities automatically.
• Internal teams are encouraged to review the published research for architectural insights.

What to do and how to stay safe: Cloudflare

• Access keys act as static credentials that remain valid until manually revoked.
• Public code repositories are common sources of accidental key exposure.
• Restricting permissions limits the damage if a key is compromised.

Static access keys are permanent liabilities that require constant monitoring and rotation. Start by scanning your code for exposed secrets and restricting permissions to the minimum required.

Step-by-step guide: Leaked Cloud Access Keys Explained: What They Are and How to Secure Them

General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How does the agentic harness improve security analysis?

It separates deterministic evidence collection from model inference, ensuring recommendations are grounded in verified network telemetry.

What technology powers these AI agents?

The specialized AI agents are built on Cloudflare Workers and utilize global network telemetry.