CL-SN55 941 —
GPT-61S 885 -0.6%
GPT-56T 861 —
GPT-6S 825 -1.4%
CL-OP55X 819 -1.4%
MUSE-SPK 793 -1.4%
QWEN-38X 779 -2%
GPT-6A 778 -0.5%
CL-OP5H 712 -1.7%
CL-OP5X 710 -1.7%
KIMI-K3X 700 -2.5%
CL-OP46H 695 -1.7%
CL-FAB5H 693 -1.7%
CL-OP55H 693 -1.7%
CL-OP47H 684 -1.7%
GEM-37FH 649 -1.8%
GEM-38FH 634 -3.4%
GPT-56S 574 -0.5%
CL-OP47 540 -0.6%
INKL 531 —
GEM-3P 494 —
CL-OP46 490 —
CL-OP48 483 —
GEM-31P 459 -5.4%
GPT-6L 436 —
CL-SN55 941 —
GPT-61S 885 -0.6%
GPT-56T 861 —
GPT-6S 825 -1.4%
CL-OP55X 819 -1.4%
MUSE-SPK 793 -1.4%
QWEN-38X 779 -2%
GPT-6A 778 -0.5%
CL-OP5H 712 -1.7%
CL-OP5X 710 -1.7%
KIMI-K3X 700 -2.5%
CL-OP46H 695 -1.7%
CL-FAB5H 693 -1.7%
CL-OP55H 693 -1.7%
CL-OP47H 684 -1.7%
GEM-37FH 649 -1.8%
GEM-38FH 634 -3.4%
GPT-56S 574 -0.5%
CL-OP47 540 -0.6%
INKL 531 —
GEM-3P 494 —
CL-OP46 490 —
CL-OP48 483 —
GEM-31P 459 -5.4%
GPT-6L 436 —
← Back to feed

Cloudflare Open-Sources the 6-Phase Security Audit Agent Its Engineers Use

Cloudflare has open-sourced the AI security audit agent its own engineers use to review production code. The tool, released as cloudflare/security-audit-skill on GitHub, runs a structured six-phase review that goes beyond static analysis to produce a list of verified vulnerabilities rather than a list of flags.

Six Phases

The agent operates in sequence across six defined phases: reconnaissance (mapping codebase structure), coverage-led hunting (identifying candidate vulnerability patterns), candidate validation (confirming exploitability), structured output (machine-readable JSON generated from confirmed findings), independent record verification (checking that the structured output accurately reflects what the agents found), and target-neutral reporting (human-readable summary).

The distinction from standard static analysis is the adversarial validation step. Static analyzers flag patterns and hand off triage to humans. The Cloudflare agent requires a candidate to prove exploitable before it makes it into the output. Engineers receive a shorter list of higher-confidence findings.

Single-Repo Focus

The open-source release operates on a single repository at a time. Cloudflare’s internal harness extends this into a multi-repo, fleet-wide workflow, but that broader system is not part of what was published. The public tool is the foundational skill, not the full pipeline.

Two-Minute Setup

The tool is packaged as an agent skill composed of markdown instructions and schemas, not a standalone binary with complex dependencies. Setup is minimal: install it inside a coding agent like Claude Code, Cursor, or Codex and point it at a repository. Third-party walkthroughs put installation time at roughly two minutes; the multi-phase audit itself runs longer.

That positioning matters for adoption. Most security tools have complex installation requirements that create friction for one-off use. A skill that slots into a developer’s existing coding agent is more likely to actually get used.

Why Release It

Cloudflare has a pattern of releasing internal tooling publicly — Workers, D1, and its open-source platform releases follow the same logic. The security audit skill is both a genuine contribution and a product signal: a company that operates one of the world’s largest network edges publishing its internal vulnerability workflow is a credibility move for its agent and developer ecosystem.

The release also follows a sequence of AI-powered security tools from major infrastructure companies. OpenAI open-sourced a security CLI earlier this year. Anthropic released a Claude-based codebase scanner. Cloudflare’s contribution is model-agnostic at the infrastructure level — the skill runs inside whatever coding agent the developer already uses, routing calls through that agent’s configured model rather than locking to a specific backend.