From Cloudflare Blog · 40 stories
Strategic Frameworks and Systems Vital for Successful AI Integration in Enterprises
AI's integration in enterprises is moving beyond model development to focus on creating robust systems for execution and governance. This shift highlights the importance of developing adaptable frameworks to support AI's role across various functions such as finance, HR, and operations. It reflects a broader industry trend where the focus is on building the necessary infrastructure to ensure AI's ongoing, safe, and productive incorporation into real-world workflows, addressing the current challenges and limitations.
New Controls for AI Bots Target Search Economic Model Rebuild
A new set of bot controls was announced to aid web creators in managing AI's impact on search traffic. These measures aim to ensure transparency and uphold existing revenue models disrupted by AI-generated summaries, which have drastically reduced traditional link clicks.
Meta Introduces Hybrid Asset Classification for Privacy-Aware Infrastructure
Meta has unveiled a hybrid asset classification strategy using large language models (LLMs) to handle ambiguous data in privacy-aware infrastructure while maintaining deterministic rules for enforcement. This method addresses the complexities of AI-native products with varied data inputs, ensuring compliance and effective data governance. It is a response to the challenges posed by the increasing speed and scale of AI innovations, and the approach aims to better manage privacy controls for evolving AI products.
Cloudflare moves to post-quantum cryptography with ML-KEM and ML-DSA
Cloudflare is transitioning its encryption methods to ML-KEM and ML-DSA to address quantum computing threats. The U.S. NIST standardized these algorithms in 2024, and Cloudflare aims for full post-quantum security by 2029.
New AI Models for Long-Horizon Coding Tasks Introduced
Several AI models aimed at long-horizon tasks in coding and robotics have been released. GLM-5.2 by Hugging Face extends support for coding-agent scenarios with a 1 million token context. Cognition's SWE-1.7 enhances long-horizon asynchronous tasks with reinforcement learning. Xiaomi-Robotics-1 combines vast pre-training data for improved robotics capabilities. These releases highlight advances in scaling and reasoning capabilities.
Cloudflare Introduces Tools for an "Agentic Internet" to Support AI Agents
Cloudflare has launched a suite of new tools and concepts, including Cloudflare Wallets, Kitesurf, WebMCP integration, Cloudflare Computer, and Precursor, to establish an "Agentic Internet." This initiative aims to provide AI agents with stable identities, native payment methods, specialized browsing capabilities, efficient runtimes, and enhanced security for interacting with web content and APIs.
Model Context Protocol (MCP) 2026-07-28 Specification Released, Adopting Stateless Core
The Model Context Protocol (MCP) has released its 2026-07-28 specification, transitioning from a bidirectional stateful protocol to a request/response stateless core. This update, the largest revision since its launch, aims to improve reliability and scalability for MCP servers, addressing a highly requested developer feature. Major SDKs, including TypeScript, Python, and C#, have been updated to support the new specification.
WordPress wp2shell Vulnerability Exploited; Urgent Patches Released
Two critical WordPress vulnerabilities, dubbed 'wp2shell' (CVE-2026-60137 and CVE-2026-63030), allow unauthenticated attackers to execute code. Affecting versions 6.9.0-6.9.4 and 7.0.0-7.0.1, fixes were released in versions 6.9.5 and 7.0.2. The vulnerabilities, actively exploited, prompted immediate patching, affecting over 500 million sites. WordPress initiated forced automatic updates, while Cloudflare deployed protective measures.
Cloudflare Open-Sources AI Productivity Platform Cloudflare OS for Enterprise Use
Cloudflare has open-sourced Cloudflare OS, an internal AI productivity environment designed to help employees use AI safely and productively. The platform provides an agent chat UI, sandboxed application development, and a security framework called Gatekeepers, allowing other companies to adapt and customize the system for their own AI workloads and internal operations.
Cloudflare and Patreon Partner to Block Unauthorized AI Crawlers and Monetize Content
Cloudflare announced updates to their policies and tools, including blocking mixed-use AI crawlers by default from September 15, 2026, to help website owners manage AI traffic and monetize their content. Patreon has joined forces with Cloudflare to block AI crawlers from accessing creator content. The move aligns with industry shifts towards AI-dominated web traffic and aims to protect content owners' intellectual property.
New Interrupt Injection Attack Bypasses Spectre v2 Defenses on Intel and AMD CPUs
Researchers have discovered a new attack, named Interrupt Injection or TONTOU, that bypasses existing Spectre v2 mitigations on Intel and AMD CPUs. This vulnerability allows an unprivileged local attacker to leak kernel memory, such as Linux password hashes, by exploiting a timing window during branch predictor neutralization. AMD has released a kernel patch for Linux, while Intel states no mitigation is necessary.
Cloudflare introduces task-based OAuth consent with scope customization
Cloudflare has launched OAuth scope customization, allowing users to deselect optional scopes during authorization. This change moves from an all-or-nothing consent model to a more granular, task-based approach, enhancing user control over application permissions.
U.S. Executive Order Mandates Post-Quantum Encryption by 2030
President Trump signed Executive Order 14412, requiring federal agencies to transition to post-quantum encryption by December 31, 2030, and authentication by December 31, 2031. This move addresses the imminent threat quantum computing poses to traditional cryptographic systems, stimulating the broader tech industry's shift towards post-quantum technologies.
Cloudflare introduces WriteGuard for fine-grained control over AI agent actions on MCP servers
Cloudflare has launched WriteGuard, a new control system designed to manage and restrict the actions of AI agents connected to Model Context Protocol (MCP) servers. This system addresses the risk of AI agents performing unintended or destructive operations by providing granular permissions, preventing scenarios like mass ticket closures or data deletion. WriteGuard is now available in private beta for Cloudflare MCP server portals.
Cloudflare launches CI SDK for running CI/CD pipelines on its platform
Cloudflare introduced a CI SDK built on Cloudflare Workflows, enabling continuous integration (CI) pipelines to run directly on its platform. This development allows platforms to manage CI/CD for their own code and their customers' code, integrating with Cloudflare Artifacts for versioned code storage.
Cloudflare Introduces Agent Tracing and Local Debugging for AI Agents on Workers
Cloudflare has launched Cloudflare Agents, a platform for deploying and managing hosted agents, starting with agent tracing for visibility into agent behavior. Concurrently, `wrangler dev` and `vite dev` now automatically capture OpenTelemetry traces for local Worker invocations, enabling AI agents to debug issues using a new Local Explorer API. This provides structured feedback for agents during local development, reducing manual logging.
Cloudflare Reports 519% Surge in 1 Tbps DDoS Attacks in Q2 2026
Cloudflare's H1 2026 DDoS Threat Report indicates a 519% quarter-over-quarter increase in network-layer DDoS attacks exceeding 1 Tbps between Q1 and Q2 2026. The report, based on data from Cloudflare's network, highlights a shift in attack vectors, with DNS-based attacks becoming the primary method, and notes the influence of geopolitical events on the threat landscape.
Cloudflare Internal DNS Launches for Private Networks
Cloudflare has launched its Internal DNS, providing unified management of authoritative and recursive DNS for private networks. This service aims to simplify DNS operations by consolidating public and private DNS management on a single platform, thereby enhancing security and visibility across networks.
Cloudflare open-sources 'pvcli' debugger for OHTTP and MASQUE privacy protocols
Cloudflare has open-sourced "privacy-client" (pvcli), a command-line debugger for Oblivious HTTP (OHTTP) and MASQUE protocols, under an Apache 2.0 license. This tool addresses the difficulty of troubleshooting privacy services like Apple's iCloud Private Relay and Microsoft's Edge Secure Network VPN, which split trust across multiple operators to prevent any single entity from linking user identity to online activity.
Cloudflare prototypes Zstandard compression in Pingora to save petabytes of cache storage
Cloudflare prototyped a Cache Transcoding system using Zstandard compression within its Pingora proxy, reducing cached asset sizes by two-thirds on average. This system aims to expand effective cache capacity and decrease cross-data center bandwidth usage by trading a minor CPU increase for significant storage savings.
Cloudflare Launches Bot Preference Sync to Automate robots.txt Updates for AI Bot Management
Cloudflare introduced Bot Preference Sync, a new feature that automatically updates a website's robots.txt file to reflect AI bot configurations set within Cloudflare's platform. This aims to simplify managing how different AI bot categories, such as search, agent, and training crawlers, interact with website content, ensuring consistency between stated preferences and enforcement rules.
Cloudflare's Certificate Transparency Monitoring is now generally available with filtered alerts
Cloudflare has made its Certificate Transparency Monitoring generally available, now featuring a filter that removes alerts for certificates Cloudflare itself issues. This change addresses a significant "noise problem" by only notifying users of unexpected certificates, making the service more effective for identifying mis-issued certificates.
Cloudflare for Government Achieves FedRAMP Class D (High) Certification
Cloudflare for Government has achieved FedRAMP Class D (High) certification, allowing it to handle the U.S. government's most sensitive unclassified data. This certification enables Cloudflare to provide its security and performance services to federal agencies managing critical national security and infrastructure information.
Cloudflare unifies Workers AI and AI Gateway into a single AI control plane
Cloudflare has merged its Workers AI and AI Gateway products into a single unified control plane, allowing users to manage model access, observability, billing, and security from one interface. This consolidation simplifies interaction with AI models, whether hosted on Workers AI or through external providers, by providing a consistent API and binding.
Cloudflare introduces new tools for Agent Development Lifecycle, expanding AI agent capabilities
Cloudflare launched new tools to support an "Agent Development Lifecycle" (ADL), enabling AI agents to manage more stages of software development beyond just code generation. This initiative aims to address the increased workload on human engineers caused by the rapid code output from AI, by allowing agents to handle tasks like CI/CD, testing, and observability.
Workers RPC now supports cross-language communication between Python and JavaScript
Workers RPC, built on Cap'n Proto RPC, now enables direct communication between Python and JavaScript Workers, allowing methods to be called across languages without custom APIs or serialization formats. This update simplifies the development of multi-language systems within the Workers environment.
Cloudflare launches Billable Usage API for programmatic cost visibility
Cloudflare introduced a new Billable Usage API for self-serve accounts, providing programmatic access to usage and cost data across all usage-based products. This API allows automation and FinOps tools to consume detailed billing information, addressing the need for machine-readable cost visibility as infrastructure management becomes more automated.
Cloudflare Workers and Containers now support inbound TCP connections and gRPC
Cloudflare has added support for inbound TCP connections and gRPC to its Workers and Containers platforms. This update allows developers to build real-time applications, such as AI-powered voice interfaces, that require low-latency communication.
Cloudflare launches MoQ provisioning API for isolated relays with access controls
Cloudflare introduced a new API that allows users to provision isolated Media over QUIC (MoQ) relays with separate credentials for publishers and subscribers. This update provides the necessary isolation and access controls for running applications on Cloudflare's global MoQ network, which previously offered only an unauthenticated endpoint.
cdnjs Migrates Entirely to Cloudflare's Developer Platform
cdnjs, an open-source CDN for JavaScript and CSS libraries, has fully migrated its operations to Cloudflare's Developer Platform as of June 23, 2026. This migration demonstrates the platform's maturity and its ability to handle large-scale, high-traffic services, impacting how developers access and utilize common web libraries.
Cloudflare Introduces Cache Response Rules for Enhanced CDN Caching Control
Cloudflare has launched Cache Response Rules, a new feature that allows users to modify HTTP response headers after an origin server replies but before content is cached by Cloudflare's CDN. This enables better control over caching behavior, addressing issues like unwanted `Set-Cookie` headers or incorrect `Cache-Control` directives that prevent content from being cached efficiently.
Albania's .al TLD DNSSEC failure led to validation issues for Cloudflare's 1.1.1.1
On July 3, 2026, Albania's .al TLD experienced DNSSEC validation failures due to a key rollover error, blocking public access to various domains. Cloudflare's 1.1.1.1 responded by bypassing DNSSEC validation, introducing a new error notification to users about this change.
Cloudflare Enhances Smart Tiered Cache for Better Public Cloud Performance
Cloudflare has improved its Smart Tiered Cache to better serve public cloud origins by allowing users to provide a cloud region hint. This development enhances the system's efficiency, enabling more accurate routing and cache selection even for ambiguous origin IPs.
Cloudflare joins UK's Cyber Resilience Pledge to enhance cybersecurity governance
The UK government launched the Cyber Resilience Pledge, aimed at enhancing cybersecurity governance. Cloudflare joined as a founding signatory, emphasizing collective defense principles against increasing cyber threats.
Cloudflare Introduces Saga Rollbacks for Workflows
Cloudflare has launched saga rollbacks for Workflows, enabling developers to implement compensation logic directly within each step of a multi-step application. This feature simplifies transaction management by allowing automatic rollbacks for failed steps, reducing the need for developers to manually track and implement their own rollback logic.
Cloudflare Introduces Self-Managed OAuth for API Access
Cloudflare has announced self-managed OAuth for its API, allowing all developers to create and manage OAuth clients. This change simplifies the process of granting scoped access for integrations, enhancing user consent and application control.
Cloudflare identifies race condition bug in hyper HTTP library
Cloudflare discovered a race condition bug in the hyper HTTP library affecting its Images service. This bug caused data for larger images to be truncated in transformation requests, leading to intermittent failures.
Cloudflare Introduces Temporary Accounts for AI Agent Deployments
Cloudflare has launched Temporary Accounts for AI agents, allowing them to deploy without prior registration. This enhancement facilitates seamless deployments, addressing a significant roadblock for background AI sessions that currently rely on human authentication.
Cloudflare Tracks Adoption of BGP Role Model (RFC 9234) for Route Leak Prevention
Cloudflare evaluated the adoption of RFC 9234, which introduces BGP Role and Only to Customer (OTC) attributes to prevent route leaks by expressing routing intent within the BGP protocol itself. The analysis revealed that two large Tier-1 networks are stripping the OTC attribute, hindering the effectiveness of this new standard for early adopters. This matters because RFC 9234 simplifies route leak prevention, which traditionally relies on complex, error-prone manual policies.
Cloudflare Reports Q2 2026 Internet Disruptions from Natural Disasters and Government Actions
Cloudflare's Q2 2026 report details significant Internet disruptions, including a super typhoon in Guam, government shutdowns in Sudan, and infrastructure damage in Iran and Venezuela. These events highlight the Internet's fragility due to natural disasters, geopolitical actions, and physical infrastructure failures, impacting global connectivity.