Democratizing Security for the Agentic Web with CloudFlare CTO Dane Knecht
In a Nutshell
Cloudflare's CTO Dane Knecht warns that AI has triggered a security crisis with vulnerabilities exploding from yearly to weekly occurrences, forcing over 50% of engineering resources toward security fixes while AI itself becomes the primary tool for discovering these flaws. The company is restructuring as an "AI-first" organization, replacing multi-team workflows with AI-native processes and hiring 1,000 AI-native trainees to re-engineer workflows from the bottom up. Cloudflare is simultaneously building economic infrastructure for AI agents through microtransaction payment systems and content monetization portals while democratizing security by protecting all users—not just paying customers—against emerging threats.
These notes were generated by AI and may contain inaccuracies.
Artificial intelligence has become both the tool that causes security disasters and the tool that can help solve them faster. The industry has shifted from getting everyone to use AI to everyone scrambling to understand what AI security means. Serious technologists are discussing isolating everything important from the internet, not trusting the internet for a while, and assuming critical infrastructure and government services will collapse.
Dane Knecht's top priority as CTO remains helping to build a better internet - making it safe, accessible, and enabling easy content deployment and reach. Over the past year, which felt like ten years compressed into one, the focus has shifted from making AI easier to deploy to addressing AI security concerns.
Security has become a secondary concern that everyone is now scrambling to address. Different parties view AI security differently - companies need to keep data safe from AI leaks, while also preventing hackers from getting in.
Over the past three to six months, the number of security vulnerabilities reported in CVE logs has increased significantly. Previously, incidents like Log4j or Shellshock occurred maybe once a year, but now serious vulnerabilities happen on a weekly basis. Cloudflare considers protecting the internet a public good, protecting both enterprise and free customers.
Over 50% of engineering time will begin to be dedicated to security. This is viewed as a short transitional phase, not something that will last forever. AI is expected to examine most code and discover most loopholes or shortcuts over time.
A recent vulnerability emerged where an encryption key protecting TLS and WebPKI communications was secured with the number "four" only. Since encryption depends on randomness, using "four" as the initial seed makes the key easily detectable and reverse-engineerable. AI can discover these vulnerabilities continuously without sleeping, unlike human penetration testers.
OpenAI recently found the seeds for the NIS curves released in 2000. The standard is rising rapidly, with models becoming sophisticated in cybersecurity. MTOS was just the tip of the iceberg - models have improved, tools for harnessing them have improved, and humans have learned how to use advanced models to find vulnerabilities.
Some major recent vulnerabilities were not implemented by state actors, but by high school students now called "agent novices." These individuals direct their agents toward specific areas, similar to how they used to participate in Capture the Flag security competitions. Financial rewards exist for vulnerability discovery, and tools that were once only available to states are now publicly accessible.
Humans are highly adaptable and can move quickly when needed. The industry comes together during crises, with competitors no longer competing when protecting critical infrastructure. The shift from a "fortress and citadel" approach to "zero trust" architecture over the past five to ten years puts companies in better positions where they don't need to completely isolate offices from the internet.
Greg Brockman from OpenAI predicted that by 2027, people will spend as much on security tokens as they spend on engineering. This transformation is driven by emergency needs, with spending allocated to both red teams focusing on attack and defensive preparation.
Key elements for better software security include discovering that commonly used libraries and services have gaps that are now easier to find. The software development lifecycle and agent development lifecycle will need to change, with security integrated into every step of the process.
The industry is fixing software that has accumulated over 70 years while trying to catch up with the rising rate of software production. The goal is to fix existing issues while exceeding the pace of new delivery.
The basic principle is to reduce attack surface area by providing fewer places where gaps might exist. This involves simplifying software and reducing the software footprint or code. Formal verification, more secure programming languages, and secure operating environments will follow.
AI in its early stages is very verbose and tends to create complexity, so it has not helped build more secure systems yet. Human judgment remains essential to ensure software is designed to operate safely and independently.
The issue must be resolved at all levels, including agents. Engineers writing code, product engineers, and security teams all need to be involved with checks and balances. Internal processes must be built to ensure security.
Cloudflare has moved toward defining internal standards with a document called "Codex," which compiles RFCs about how to build secure cloud software. This has been formulated as "Ten Commandments" that agents follow in every part of the review process.
The internet is in a chaotic transitional phase where humans and agents use the same pathways, but agents are trying to parse a web designed for humans. This is inefficient because agents can visit a thousand pages in the time a human reads one, requiring a new economic model.
Translation layers currently help agents display web pages, consuming additional tokens unnecessarily. APIs only cover a small fraction of internet information, but agents need to understand everything and explore the human internet.
Website owners need easier, cheaper ways to serve agents, and compensation mechanisms must be found. Content sites know CPM values from advertising, so agents might decide to pay CPM rates for content access.
Agents will push forward new internet payment methods capable of processing millions of transactions per second for small payments. Small payments have always been "a couple of years away," but agents will accelerate this development.
Cloudflare has an important role, but personal proxies like Instinct and Muse raise questions from a transactional perspective. Business results aren't fully realized yet, with skepticism similar to past predictions that the internet would eliminate traditional stores.
Amazon has said no to personalized shopping via AI agents as companies go through a difficult transitional phase trying to determine their future course and maintain bargaining power.
Cloudflare launched a content monetization portal making it easier for sites to receive small amounts of money for content. Digital wallets and a stablecoin facilitate agent transactions.
The Signals project with OpenAI makes it easier for agents to discover content instead of scanning the entire internet and returning to pages. This reduces burden on website owners who won't have to bear infrastructure costs from constant scanning.
Stripe's "X42" initiative returns to HTTP status code 402, which Tim Berners-Lee invented 20-30 years ago for payments. This represents the need for better online payment systems that agents will lead.
Instead of content creators paying Cloudflare, Cloudflare pays them by covering infrastructure costs and providing earnings. The goal is to increase the number of content creators, potentially doubling what YouTube, TikTok, and X achieved.
Cloudflare OS is the internal platform employees use to interact with AI daily. It addresses security concerns about customer and internal data leaks while ensuring employees can use AI tools securely with good governance.
As the number of agents increased, Cloudflare needed to teach them what makes the company special and how it builds products. For humans, this was done through "Cloudflare University," but agents needed clearer documentation.
Employees attempting to create contact lists don't need to worry about security because it's built in. Work is done consistent with Cloudflare's business principles and values.
Cloudflare OS serves as a reference structure showing how to build entirely using Cloudflare's 100+ developer platform tools. It demonstrates internal building practices and gives people the option to modify and build their own company operating systems.
Cloudflare OS is used more by commercial and administrative teams than engineering teams. It provides super speed by giving guidance and direction, making people better at their jobs rather than replacing them.
The May restructuring to become an AI-first organization involved difficult decisions, including the first layoffs in Cloudflare's history. This was done because AI was changing how some teams operate, requiring rebuilding and rethinking processes.
Previously, product managers sending customer emails involved three teams: one for email lists, marketing for tone design, and marketing operations for sending. The new process involves a single tool where product managers log in, describe the set, write emails that get rephrased in "Cloudflare" style, get manager approval, and are sent.
Cloudflare always had many initiatives to pursue. Rather than ranking and prioritizing from one to one hundred, anything that someone is passionate about is probably good. People who take initiative and assume responsibility drive the changes.
It's absurd to ask humans to determine the right model for every task. This needs to be handled intelligently as cost dynamics change with every model release.
Humans will never be good at governance tasks. The approach involves starting in a primitive way with people experimenting, using the best advanced models for the planning stage. Once the plan is written, agreed upon, and developed, some open-source models can implement it. Then one of the advanced models does the reviews, penetration tests (Red Teaming), and similar tasks. All of this is done largely by hand today, but as people learn and experiment, there will be more governance around it over time.
Coveware largely allowed people to use whatever models and tools they deemed appropriate for the job. They do not have a leaderboard for using symbols and do not encourage that. Instead, they encourage people to focus on the outputs - people are not evaluated based on whether they used the symbols, but rather on what they have accomplished and what they have built.
Alerting people about costs is helpful. If someone spends $300 a day, they receive an email asking "Hello, were you aware of that?" Because most of the time people were unaware that they were doing it. If the number reaches $500, it goes to the manager. If it reaches $1,000, it reaches the Vice President in one day. These things rarely happen, and people are usually happy to receive those notifications.
Considering the current level of model capabilities without assuming any new development, Cloudflare is still in a very early stage of rethinking how different things are done, from bringing products to market to engineering.
Comfort did something a couple of years ago with about 200 trainees. These trainees were the first generation who were truly "artificial intelligence experts," to the point that if artificial intelligence was taken away from them, they wouldn't be able to work. They know how to use the tools better than previous generations do. It's like if Google had been taken away from people for the past ten years - how else would they have learned anything? This is the first thing they resort to.
Managers who had interns that summer adopted artificial intelligence more quickly. Last summer and last year, Cloudflare decided to hire a thousand trainees for a company with 5,000 employees.
The number of ideas coming from the trainees is great. With artificial intelligence, fewer people can experiment faster, so getting more ideas with more people was helpful. Also seeing how they use artificial intelligence - they need to fill out a form, so they resort to artificial intelligence. Many people still find themselves in situations saying "Oh wait, I'm still doing this manually," and then realize they should use artificial intelligence. This is not normal for most people yet and will take some time.
Running a very small partnership always has one or two interns within a team of twelve people, for ideas, intern energy, and similar benefits. One university trainee was converted into a full-time employee and made to drop out of studies. There should be increased focus on people who have an innate and deep understanding of these tools. It's great for them too.
Schools like Waterloo and Northeastern see that with collaborative programs, people who get real-world work experience are among the best employees for many years and achieve great things.
Instead of creating a master plan, Cloudflare draws a map of each department and sub-department and identifies the main workflows that will be re-engineered. This is a strategy based on the assumption that people are rational about their use of code if they have the information, and on hiring a group of trainees and assuming that highly proactive people will start transforming those workflows into something smarter over time, then proceeding with direct action and experimentation.
Initially, there was an email address called "agents" at Cloudflare in January of this year, where people were told: If you're wondering "Can I use AI for this?", email your tasks and they'll get back with the work files. For a while, people thought it was all artificial intelligence and completely automated. In fact, it was a group of trainees who were helping people write the work files. This allowed seeing things in a way that made it unnecessary to hire a consulting firm to come and classify each task individually. The employees themselves are the ones who realize that something seems more difficult than it should be and wonder if an artificial intelligence agent can help.
One of the biggest things Cloudflare has always looked for is curiosity. If people aren't using artificial intelligence in their homes and personal lives, that's a big warning sign. How can you not embrace artificial intelligence if you have a certain level of curiosity? Focusing more on core characteristics such as motivation, curiosity, and empathy will yield better results with the upcoming group of employees.
Being an experimental user of all products and technologies since time immemorial. The answer to fear and skepticism lies in curiosity. What this claim about curiosity implies, including experimentation with advanced AI tools, should be a core principle for those working at Cloudflare.
Much of what Cloudflare does is not just routine work - they invent new ways of doing things. The scope they operate within, the number of sites they support, and the volume of free services they provide cannot be achieved using off-the-shelf technologies. They need people who can come in and literally create new things, and that starts with curiosity.
If half the engineering team were to work solely on security to fix 70 years of vulnerabilities, the question is how to address this problem internally, assuming software is not perfect, even the amazing kind that operates on internet scale. Today there is one red team, but by the end of next year there will probably be four or five red teams. People will be divided into groups that are more hostile and actively work to try to find loopholes.
The question is why focus on the discovery approach instead of making correction systems and processes accurate. Processes and those things can always be improved. There is a process for managing vulnerabilities and a process for correcting them. It is not perfect, but the best way found to improve such things is to let crises drive their reform. When the volumes become too large for the engineering team to handle using their usual processes, engineers are naturally inclined to be lazy - in a positive sense - so they will automate those tasks when they realize there is no other way to do it. The focus should be on the discovery side, and people will do the right thing to figure out how to fix the gaps in a way that is scalable over time.
There is a particular philosophy about prioritizing security compared to introducing new features. It's not as if there wasn't a growing list of flaws in all the major programs that needed fixing. It only comes down to whether that was a priority for engineering teams previously as a general case. The approach is to figure out how to do both things together. This may come at the expense of cost optimization or other things, but the perspective is that if companies don't introduce new products, they die. There will be no freeze on work in order to do security work.
There is absolutely no need to stop building and introducing new things. But there is a need to make sure it's done securely, fixing the gaps and errors. If done right, both things can be done faster using artificial intelligence. While artificial intelligence has become the tool that causes this kind of security "apocalypse," it is also the tool that can help solve it faster. It works on both sides.
The debate about the role of open and closed models on the cybersecurity front involves the argument that having defensive and offensive capabilities in the same model goes in parallel, despite the safety procedures and barriers included in it. Therefore, you cannot have open defensive models without them also being offensive. The concern regarding security capabilities existing only in a set of advanced closed models is: how will you release them? You cannot in any way deliver it to the distributed group of entities that need defending.
Over time everything should become open, because everyone will be able to access it anyway. This is how things usually work in open source. The villains will always find a way to get it, so major companies will find a way to get it too. Excluding a large group of people who do not have access to it, while they desperately need it, is problematic.
As Cloudflare moves towards its goals and takes part of the responsibility for the resilience of the internet, the question is what about people who cannot afford security teams, or who have never had a security team before, and who manage important systems. The answer is to put sites behind Cloudflare and put infrastructure behind Cloudflare. When major vulnerabilities emerge, like last year's React vulnerability, Cloudflare doesn't just protect customers who pay for advanced firewall features - they protect everyone. These things are viewed as part of the benefit provided and the protection offered, just as high performance is provided for everyone.
Before Cloudflare began, there were probably around 3,000 websites in the world using a wide-area content delivery network to store their data at the edge. Now there are hundreds of millions of sites doing that. Cloudflare has always considered its goal to be democratizing security and performance for everyone.
Keep No Priors: AI, Machine Learning, Tech, & Startups in your library
Save the videos and channels worth coming back to, and find them again in one place.
