Building an evidence-grounded agentic security operations harness on Cloudflare

Cloudflare has implemented an AI agent harness within its Managed Defense service to address the "alert paradox," where high volumes of security signals overwhelm human analysts. The system utilizes a multi-stage pipeline that separates deterministic data collection from AI inference. Initially, fixed reconnaissance workflows gather evidence, and a lightweight open-source model called Clef triages alerts to filter out known false positives.
For complex alerts, a coordinator agent manages four specialized AI agents—focusing on traffic, customer context, global telemetry, and threat intelligence—before a synthesis agent generates a final advisory. This architecture is designed to prevent hallucinations and scope drift by restricting AI agents to a versioned evidence package. While the system provides automated recommendations for remediation, human Managed Defense Analysts retain final decision-making authority. The framework leverages a combination of OpenAI, Anthropic, and internal models, utilizing Workers AI, D1, R2, and Durable Objects for state management and execution.

Cloudflare developed a multi-AI-agent security operations harness for Managed Defense.
The system uses OpenAI Daybreak (including GPT-5.6 Cyber), Anthropic (including Mythos), and Clef.
Clef is an open-source decision model running on Workers AI.
The process begins with deterministic reconnaissance workflows using versioned API calls.
A coordinator agent manages four specialist agents: Traffic analysis, Customer context, Global telemetry, and Threat intelligence.
A synthesis agent combines specialist findings into a final advisory.
Global telemetry analyzes aggregates to maintain customer privacy.
Technical infrastructure includes Workers, Workflows, D1, R2, and Durable Objects.
The system classifies evidence states as "Not checked," "Checked, with no matching result," or "Checked, with evidence supporting absence."
Managed Defense Analysts review and confirm AI-generated recommendations.

This architectural shift represents a transition from "Chatbot-as-Analyst" to "AI-as-Pipeline." By enforcing a strict separation between deterministic data retrieval (reconnaissance) and probabilistic interpretation (inference), the system attempts to solve the fundamental reliability problem of LLMs in high-stakes environments. The strongest version of this narrative is that security operations cannot scale linearly with human hiring, necessitating a "specialist ensemble" approach to reduce cognitive load without relinquishing human oversight.
However, this is a vendor-authored narrative that positions its own product as the inevitable solution to a problem it defines. The persuasive engine relies on the "alert paradox" to create a sense of urgency, then presents a complex, multi-model ecosystem as the only viable remedy. This is a classic move to shift the customer's perceived need from "better rules" to "agentic orchestration."
Patterns detected: ARC-0043 Authority Game, ARC-0001 Fear Appeal
The driving paradigm is the "Automation of Trust." The unstated assumption is that a "versioned evidence package" can fully capture the nuance of a security incident. The risk here is the gradual erosion of human critical thinking; as analysts move from investigating raw data to merely "approving" AI-synthesized summaries, they may develop a dependency that makes them blind to the "invisible gaps" the system records.
Bridge Questions:
1. If the AI synthesis agent is restricted to a "approved vocabulary," what nuances of novel attacks are being filtered out before the human sees them?
2. How does the "global telemetry" aggregate change the nature of privacy when patterns are used to make specific decisions about a single customer's traffic?
Counterstrike Scan: A coordinated campaign would use manufactured fear of "AI-driven attacks" to force a rapid migration to a proprietary, "black-box" agentic harness. This content follows that structural pattern by emphasizing the overwhelming nature of alerts and offering a proprietary ensemble as the shield.