The Vulnerability Flood: Cloudflare's CTO on Security, Agent Traffic and an AI-First Company

Knecht says this past year felt like ten compressed into one, but Cloudflare's mission of building a better internet has not changed. As usual with technical transitions, security was an afterthought as everyone rushed to adopt AI and deploy agents. Now organizations are racing to understand what AI security means, both keeping their data from leaking out through AI and keeping attackers from getting in.

Over the last three to six months, he says, the number of reported CVEs has gone up exponentially. Incidents on the level of Log4j or Shellshock used to arrive about once a year and put Cloudflare on all hands deck to protect enterprise and free customers alike. Now similarly serious problems are happening weekly, though not all are publicly reported.

Knecht expects that within the next 18 months the majority of engineering time will go to security, citing a statistic shown in a Cloudflare keynote that more than half of engineering time will be spent that way. He does not think it will last forever, because eventually AI will have surveyed most code and found most of the bugs. He gives as an example a recently blogged case where a key underpinning web PKI was reportedly derived from an absurdly weak seed, which an AI could reverse engineer without sleeping.

Models are improving at cybersecurity, he adds, and so are the harnesses and the human skill in using frontier models to find exploits. Asked who is behind the attacks, he says some of the bigger recent vulnerabilities were found by high school kids, former capture-the-flag players who point agents at a target for bug bounties. Host Sarah Guo jokes about calling them agent kitties.

Guo notes she has heard serious technical people suggest air gapping everything important. Knecht is less doomsday. He has seen competitors partner when critical infrastructure is at stake, and says humans are adaptable and move fast when they need to. Companies that moved from castle-and-moat security to zero trust over the past five to ten years are in a better position, since they secure devices and flows rather than relying on an air-gapped office.

On what will drive the shift in spend, he says it is emergency. Security budgets will be pulled forward over the next 18 months on both the offensive red-team side and the defensive side. Guo mentions that Greg Brockman of OpenAI told the podcast that by 2027 people would spend as much on tokens for security as for engineering. Knecht expects software productivity to rise again in about 18 months as those resources return.

Knecht says the world is currently patching 70 years of software, so part of the work is catching up. Going forward, the software and agent development lifecycle will change, with security built in at every step, in the same way red teaming is used now. He believes software will become more secure over time.

Asked what Cloudflare has learned about building secure production software, Knecht returns to first principles: reduce attack surface. Look at the software and simplify it, reduce the code and the footprint. Formal verification, safer languages and runtime protections will come, he says, but it starts with simplicity.

He notes that early AI tends to be verbose and to create complexity, so it has not so far helped produce more secure software. Human judgment is still needed to design software that can stand on its own securely. Guo agrees that asking a model for something with a tenth of the complexity is not its natural inclination.

Knecht says the problem has to be solved at every level, from training the engineers writing code to security teams who give checks and balances. Cloudflare has written down its principles in a document called the Codex, built from many internal RFCs on how to build secure and available software and distilled into a short list of commandments that agents follow during review. Some agents write the slop, while deeper in the factory others run performance and security checks, and he says you still need adversarial reviews.

Agent-driven traffic has outpaced expectations, Knecht says. He describes a messy middle in which agents try to parse a web built for humans, who read pages, see ads and take part in the economic model, while an agent can visit a thousand pages in the same time. He expects content to be delivered in ways that meet agents and humans where they are, because the translation layers now in use burn tokens needlessly.

APIs only ever covered a small fraction of internet information, and agents want to understand everything, so they explore the human web. That needs to get cheaper for site owners and, crucially, compensate them. He imagines a Substack-like site that knows its CPM, where an agent decides whether to read and pay that rate, which requires payment rails able to handle millions of tiny transactions a second.

Knecht observes that micropayments have always been two years away, and says agents will push them forward. Business owners are skeptical because past transformations displaced people, and some, like Amazon, simply block agent shopping to keep negotiating leverage. He thinks personal agents will eventually complete tasks as seamlessly as humans, but neither the technology nor the business models are there yet.

On the product side, Cloudflare has released a monetization gateway that lets sites take microtransactions for their content, including wallets for agents and a stablecoin to facilitate payment. With OpenAI it is working on Signals, which helps agents discover new content instead of crawling the whole internet, a win for labs and for site owners. He also praises x402 from Stripe for reviving the HTTP 402 payment status code, and says the success case is Cloudflare paying creators, covering their infrastructure costs and growing the number of creators.

Cloudflare OS is the internal platform employees use for AI every day. It grew from security worries about customer and internal data leaking, so staff could use new models safely with governance over data flows. It also teaches agents what makes Cloudflare special, much as Cloudflare University and onboarding teach humans, and lets employees build things without having to think about security.

Knecht describes it as a reference architecture, built on Cloudflare's developer platform of over 100 tools, that others can fork to build their own company OS. It is used more by go-to-market and G&A teams than by engineers. A blank chat interface was too much of a blank slate, whereas a platform designed around how the business works shows people it is trying to make them better at their jobs, not replace them. The marketing team built hundreds of internal tools, including some used for putting the conference together.

The restructuring that began in May was hard, he says, and a first for Cloudflare, which had always avoided over-hiring. It was driven by seeing how AI changed some teams, and treated like a factory floor that needed rethinking. He gives the example of a product manager emailing customers, which once required BI, marketing and marketing operations, and is now a tool where a PM describes a cohort, writes an email, has it rewritten in Cloudflare's voice and sends it to a manager to approve.

On who owns such changes in a roughly 5,000-person company, Knecht says Cloudflare always has a thousand more things to do, so it looks for people who take initiative, and the effort was bottoms-up. On token budgeting, he thinks it is silly to ask humans to choose a model for each task, expecting intelligent routing, such as frontier models for planning, open models for execution and frontier models again for review. Cloudflare has no token leaderboard and grades people on output, but sends a notice at $300 a day, goes to the manager at $500 and a VP at $1,000.

Knecht says Cloudflare is still early in its AI journey. Two years ago it hired about 200 interns who he believes were the first fully AI-native group, and their managers adopted AI faster. So this year it decided to hire a thousand interns, who bring many ideas and reach for AI by reflex. He still catches himself doing things manually that AI could do.

The company also ran an email alias called agents at Cloudflare in January, where people asked whether AI could do part of their job and got back a skill file, which interns were actually helping write. That showed real needs without a consulting firm cataloguing tasks. Curiosity is what Cloudflare hires for, so someone not using AI at home is a red flag, and he says the company invents new things at a scale off-the-shelf technology cannot handle.

On security, he expects the current one red team to grow to four or five by the end of next year, focused on finding vulnerabilities. Process improvements help, but crisis is how things get fixed, and engineers, who are lazy in a good way, will automate patching when volumes require it. He does not want a feature freeze, since if you're not shipping you're dying, and thinks AI can help do both faster.

On open versus closed models for cyber, he says over time everything has to be open because everyone will get access anyway, and keeping it closed excludes the many who need it. For those who cannot afford red teams, he says to build behind Cloudflare. Major vulnerabilities like last year's React one are mitigated for everyone, not only paid customers. Before Cloudflare there were maybe 3,000 sites with a large-scale CDN, and now hundreds of millions, and the goal is to democratize security and performance for everyone.