When AI reads the code: what Cloudflare's Glasswing experiment means for defenders

Much has been said about AI that writes code. Far more interesting, and more consequential for IT security, is what happens when AI reads code: deliberately, to find vulnerabilities. Cloudflare has just published an unusually honest experiment on exactly that. As part of "Project Glasswing", the company received early access to a specialized, security-focused AI model (Mythos Preview from Anthropic) and set it loose on more than fifty of its own code repositories, not on a test project, but on productive, critical infrastructure.

The results are remarkable, but not in the way you know from marketing announcements. They show where automated, AI-driven security research stands today and what has to happen around it to turn it into something reliable. For us as a managed service provider, this is highly relevant, because the same technology will soon be available to everyone: defenders and attackers alike.

What changes with the new model generation

Vulnerability scanners so far have worked with signatures and patterns: they know established bug classes and look for them. The new generation of AI models takes a different approach. Cloudflare describes it as the models developing a line of reasoning while working through the code that resembles an experienced security researcher more than the output of an automated tool. The model understands relationships across file boundaries, traces how data flows through a system, and infers from that where something might be exploitable.

That is a qualitative leap. Where traditional tools only find what someone taught them beforehand, these models uncover new vulnerabilities from their understanding of the code, closer to the way a human works, but at a pace and breadth no human can match.

The same capability, cutting both ways

This is exactly the point Cloudflare states openly, and one that should not be argued away: the same models that help secure your own systems also show what attackers can do with the latest AI generation at any given time. Whoever finds vulnerabilities faster can close them faster, or exploit them faster. The capability is neutral; what matters is who uses it first and more consistently.

For defenders, this means the window between "the vulnerability exists" and "the vulnerability is being exploited" keeps shrinking. The idea that you can patch at your leisure once an advisory eventually appears holds up less and less. Security is shifting from one-off assessments to continuous, day-to-day operations. This is where a managed approach pays off.

The signal-to-noise problem: the real bottleneck

As good as the hit rate is, the hardest work starts afterwards. One of the most difficult tasks in vulnerability analysis is deciding which findings are real, which are actually exploitable, and which need to be fixed with priority. Here the models also produce noise: reports that sound plausible but turn out to be harmless or false positives on closer inspection.

Cloudflare names one concrete factor that drives the noise rate: the programming language. In memory-unsafe languages such as C and C++, where entire bug classes like buffer overflows are possible in the first place, they saw significantly more false positives than in memory-safe languages such as Rust, which rule out such errors at compile time. Put differently: the AI does not simply deliver a finished list of defects. It delivers many leads that still have to be evaluated.

Why a generic AI agent alone is not enough

Perhaps the most important insight from the report: it is not enough to point a strong model at a repository and hope for the best. Cloudflare had to build an entire architecture around it: a framework that gives the model the right context, checks its findings in a structured way, filters out duplicates and false positives, and prepares the remaining results for human experts. Only this interplay of model, process, and human triage makes the approach usable at scale.

This matches our day-to-day experience as a managed security service provider: tools, however advanced, only deliver value within a clean process with clear responsibilities and trained people who put the results in context. An alert without someone to assess it and act on it is not protection, just noise.

What this means for security teams and midsize companies

For large providers like Cloudflare, building such a harness is routine. For midsize companies, it is neither affordable nor necessary, but the conclusion that follows from it is. When AI makes attacks faster and broader, the right priorities shift: away from the illusion of closing every single gap in time, toward architectures that can withstand a hit.

In practice, this means two things. First: actively and automatically protect the Internet-facing attack surface. Here, together with Cloudflare, we rely on a cloud-native platform for Application Security with WAF, bot, and API protection that continuously adapts to new threats.

Second: assume that something will get through eventually, and limit the damage from the outset. That is exactly what Zero Trust segmentation delivers: it ensures that a compromised point does not become the gateway to the entire network. "Assume breach" is not capitulation; it is the realistic mindset in a world where attackers use AI tools.

And third, it means using AI itself securely and in line with data protection requirements instead of avoiding it. How applications, data, and AI inference are managed close to the user and under control is shown on our page on Compute & AI .

Conclusion: honest, level-headed, a wake-up call

Cloudflare's Glasswing report is valuable precisely because it does not exaggerate. AI finds real vulnerabilities, at a quality that was unthinkable until recently. But it replaces neither the process nor the experts, and it produces noise that has to be put into context. For defenders, that is good news, as long as they act first. For anyone who still treats security as a one-off project, it is a wake-up call.

The full original report is available on the Cloudflare blog .

For a compact overview of all Cloudflare products, from Zero Trust to the developer platform, visit our Cloudflare page .

Want to know how resilient your environment is against the next generation of attacks? In a joint analysis workshop, we make attack surfaces and data flows visible. Get in touch .