# Cloudflare's AI Security Blueprint _Cloudflare details its model-agnostic AI security harness architecture for scalable vulnerability discovery and validation._ **Published:** 2026-06-18 **Source:** https://www.startuphub.ai/ai-news/technology/2026/cloudflare-s-ai-security-blueprint --- Cloudflare is detailing its approach to building a robust AI security system, emphasizing an architecture where models are treated as interchangeable components. This strategy, outlined in their latest [blog post](https://blog.cloudflare.com/build-your-own-vulnerability-harness/), moves beyond relying on single, frontier AI models. Standalone AI LimitsDriver narrow defensive coverage, lack persistence and deduplication for enterprise securitySkill to PipelineContexttransitioning from individual AI capabilities to integrated security workflowsFrom the article 3 mentionsThe journey began with a ~450-line security-audit skill designed for single-repository analysis.Model-Agnostic HarnessCoreorchestrates multiple interchangeable AI models for security analysisFrom the article 5 mentionsThis model-agnostic layer is crucial for adapting to the rapid shifts in the AI ecosystem, preventing disruptions when specific models become unavailable or are superseded.Persistent PipelineContextfleet-wide scanning instead of isolated agent sessions for continuous analysisFrom the articleThe core idea is to create a persistent, fleet-wide scanning pipeline rather than isolated agent sessions.Adaptable EcosystemEffectprevents disruption from model changes or unavailability in AI landscapeFrom the articleThis model-agnostic layer is crucial for adapting to the rapid shifts in the AI ecosystem, preventing disruptions when specific models become unavailable or are superseded.Key StagesContextstructured approach to building and deploying the AI security harnessFrom the article 4 mentionsPersistence is managed by writing each stage's output to a SQLite database, allowing any stage to resume without redoing work.facilitatesScalable DiscoveryEffectenables efficient and broad vulnerability identification across systemsFrom the articleThe workflow is divided into two stages: the Vulnerability Discovery Harness (VDH) for initial scanning and the Vulnerability Validation System (VVS) for rigorous checking.achievesEnterprise SecurityOutcomerobust and reliable AI security system for large organizationsFrom the article 3 mentionsCloudflare is detailing its approach to building a robust AI security system, emphasizing an architecture where models are treated as interchangeable components. The core idea is to create a persistent, fleet-wide scanning pipeline rather than isolated agent sessions. This model-agnostic layer is crucial for adapting to the rapid shifts in the AI ecosystem, preventing disruptions when specific models become unavailable or are superseded. ## Beyond Standalone Models The limitations of single-model approaches are clear: they offer narrow defensive coverage and struggle with the persistence and cross-referencing needed for enterprise-scale security analysis. Subagents, while useful, lack the necessary persistence, deduplication, and resumability for this task. Cloudflare's solution centers on a 'harness' that orchestrates multiple models. This harness, not the individual model, is the lasting component. By frequently interchanging and cross-testing models, the system ensures vulnerabilities are validated by distinct logical sets. ## From Skill to Pipeline The journey began with a ~450-line security-audit skill designed for single-repository analysis. This initial skill mapped out a 7-phase audit, including reconnaissance, attack simulation, adversarial validation, and independent re-verification. However, single runs only captured about half the potential bugs, often the simpler ones. Several walls quickly emerged: context exhaustion, where models forget previous findings; lack of persistence, leading to lost work on crashes; and an inability to reason across repositories. ## Building the Enterprise Harness To address these limitations, Cloudflare developed a unified harness capable of covering a large fleet of repositories with cross-repo tracing. This system handles a diverse mix of languages without per-language tuning, focusing on higher-level security orchestration. The workflow is divided into two stages: the Vulnerability Discovery Harness (VDH) for initial scanning and the Vulnerability Validation System (VVS) for rigorous checking. Crucially, different models are used for VDH and VVS, creating an adversarial validation loop. ## Key Stages and Mechanisms The VDH includes stages like Recon (mapping threat vectors), Hunt (simulating attacks), Validate (mechanical checks and disproving findings), Gapfill (generating new tasks), Dedup (consolidating findings), Trace (walking dependency graphs), and Feedback (optimizing future runs). Persistence is managed by writing each stage's output to a SQLite database, allowing any stage to resume without redoing work. This prevents losing hours of progress due to transient errors. The Recon stage dynamically generates threat models tailored to specific codebases. Hunter agents go beyond code reading to active execution, compiling and attacking code fragments in sandboxed environments. Specialized mechanisms like Sibling Forking (allowing agents to explore interesting code paths outside their current scope) and a Wishlist (for requesting external tools or resources) grant agents significant autonomy. This robust architecture ensures that even transient API errors are classified correctly, preventing empty runs from being logged as successes. This entire process forms the basis of Cloudflare's [Flue Framework: Cloudflare's Agent Push](/ai-news/technology/2026/flue-framework-cloudflare-s-agent-push). --- Original analysis from [startuphub.ai](https://www.startuphub.ai), the #1 AI startup directory.